Tenable Nessus
By Tenable, Inc.
The implementation process for Tenable Nessus software involves several steps, which vary depending on the deployment type (e.g., Nessus Professional, Nessus Manager, or Nessus Agents). Below is a detailed breakdown of the process:
Licensing: Obtain and activate a license key for Nessus during installation.
Deploy Nessus Agents on individual hosts using command-line tools, MSI packages, or third-party software like Active Directory or Systems Management Server (SMS).
Create scan templates based on organizational needs (e.g., Basic Network Scan, Advanced Scan) and configure credentials for credentialed scans.
Deploy using cloud-specific guidelines (e.g., Azure CLI commands).
Monitor bandwidth utilization during test scans to optimize performance for production environments.
Schedule recurring scans and monitor agent health via the management interface.
Monitor scan results, manage vulnerabilities, and generate reports as needed.
The time required for implementation depends on the scale of deployment:
Tenable Nessus can be customized to fit specific business needs. The platform offers a wide range of customization options to tailor its functionality to an organization’s unique security requirements:
Custom Policies and Templates: Nessus includes over 450 pre-configured scan templates that can be modified or used as-is. Users can create custom scan policies to focus on specific vulnerabilities or compliance requirements.
Advanced Settings: Administrators can configure advanced settings such as logging, scanning performance, and security parameters. These settings include options for vulnerability grouping, plugin activation, and UI customization (e.g., dark mode).
Customizable Dashboards and Reports: Nessus allows users to create tailored dashboards and reports that meet specific business or regulatory needs. Reports can be exported in various formats, such as PDF and CSV.
API Integration: Nessus provides free API access for custom integrations with other tools, enabling businesses to enrich and automate workflows.
Tenable Nessus has several additional costs beyond the base subscription price:
Tenable offers discounts on multi-year licenses, which can reduce overall costs for long-term users.
Overall, while the base subscription covers most essential features, additional costs for advanced support or maintenance may apply depending on organizational needs.
Tenable Nessus provides comprehensive training and support options for new users to ensure effective deployment and usage of the software. These include:
Nessus Advanced: Focused on advanced features such as Infrastructure-as-Code (IaC) scanning, external attack surface assessment, and results analysis. This course is designed for Nessus Expert users.
Hands-on labs and instructor-led courses are available for more in-depth learning. These courses focus on product deployment, configuration, and operational usage, with certifications offered for specific Tenable products like Tenable Security Center.
Free introductory courses that provide a guided tour of technical concepts through short-form video lectures. These courses are recommended as prerequisites for advanced training.
While certifications are not available for Nessus specifically, other Tenable products offer certifications to validate expertise.
Priority response times: Critical issues (<2 hours), High (<4 hours), Medium (<12 hours), Informational (<24 hours).
Access to a knowledge base, live chat, forums, documentation, and tips from other users.
Extensive user guides, integration guides, and command-line references are available for free on the Tenable website.
These resources ensure that both new and advanced users can effectively deploy and manage Nessus while addressing any issues promptly.
Tenable Nessus employs robust security measures to ensure the confidentiality, integrity, and availability of user data:
Communications between Nessus scanners, agents, and management platforms (e.g., Tenable Security Center) are encrypted via HTTPS.
Account lockout mechanisms prevent unauthorized access after multiple failed login attempts.
Traffic monitoring at multiple network points helps detect anomalies.
Data localization ensures that customer scan data is processed within their geographic region to comply with privacy regulations such as GDPR.
Tenable complies with industry standards such as ISO 27001 and is certified under frameworks like FedRAMP, StateRAMP, Privacy Shield Framework, and CSA STAR for cloud security assurance.
Recommendations include deploying Nessus on secure internal-facing networks and using hardware-level disk encryption for additional protection of data at rest in high-security environments.
These measures collectively ensure that Tenable Nessus maintains a high standard of data security while complying with global regulatory requirements.
Tenable Nessus releases updates regularly to ensure the platform remains secure, functional, and up-to-date with the latest vulnerabilities. The update process includes both software updates (new versions) and plugin updates (vulnerability definitions). Below are the key details:
Agents and scanners check for plugin updates every 24 hours, depending on when they were deployed or last online.
Delayed Updates: Users can delay updates to remain on an earlier version (e.g., one version prior to the latest GA release).
For cloud-managed environments (e.g., linked to Tenable Vulnerability Management), updates are automatically downloaded from Tenable's servers.
Manual updates involve downloading files from Tenable’s website and uploading them to the Nessus instance.
Downgrade paths are also supported if required for compatibility or stability reasons.
For air-gapped or offline installations, plugins and software must be updated manually using files downloaded from a secure source.
This flexible approach ensures that organizations can balance security needs with operational requirements.
Tenable Nessus has clear policies regarding data ownership and portability, ensuring that users retain control over their data while providing mechanisms for data migration:
Tenable does not collect or store scan data unless explicitly configured to do so (e.g., in cloud-managed environments).
Personally Identifiable Information (PII) is excluded from collection unless required for specific services.
Policies and configurations can also be exported for backup or migration purposes.
For cloud-managed environments like Tenable Vulnerability Management, scan data is processed within the customer’s geographic region to comply with privacy regulations such as GDPR.
For cloud-managed environments, retention periods align with customer agreements.
Tenable’s policies ensure that customers maintain control over their data while providing flexibility for migration and compliance with global privacy standards.
Tenable Nessus is designed to be scalable, allowing organizations to adjust their usage as their needs evolve. Here are the key terms and details:
Horizontal Scalability: Nessus supports horizontal scaling by adding more scanners or agents to handle larger environments. This is particularly useful for organizations with growing infrastructure or dynamic cloud environments.
Licensing Adjustments: Organizations can increase their license count (e.g., adding more assets) during the subscription period. This is common for businesses experiencing growth or requiring broader coverage.
For cloud-based solutions like Tenable Vulnerability Management, additional scanner resources can be pooled and managed centrally for unlimited scalability.
Granular Management: Features like Tenable Patch Management allow precise control of deployments, testing, and approvals, making it easier to scale up or down based on operational requirements.
Support for Dynamic Environments: Nessus is built to handle highly dynamic environments, such as remote workforces or cloud assets, ensuring seamless scaling without significant reconfiguration.
Cost Implications: Scaling up typically requires purchasing additional licenses or capacity. Conversely, scaling down may involve adjusting licenses at renewal time.
This scalability ensures that Tenable Nessus can adapt to both small and large organizations with changing security needs.
The terms for contract renewal and cancellation for Tenable Nessus are as follows:
Customers not enrolled in auto-renewal can manually renew their subscription through their Tenable account or by contacting sales.
Cancelling auto-renewal does not impact the current subscription term; users retain access until the end of their paid period.
In cases of material breach, termination can occur with a 15-day notice if the issue is not resolved within that time frame.
These flexible terms ensure customers can manage their subscriptions effectively while maintaining control over renewals and cancellations.
Tenable Nessus supports a wide range of compliance standards, making it suitable for organizations across industries. The platform includes pre-configured audit policies and templates aligned with these standards:
General Data Protection Regulation (GDPR).
Federal Desktop Core Configuration (FDCC).
Sarbanes-Oxley Act (SOX) for corporate governance.
Site Data Protection (SDP).
Detailed remediation guidance and customizable reporting facilitate audits and demonstrate regulatory adherence.
These features make Tenable Nessus a powerful tool for achieving and maintaining compliance across various regulatory frameworks.
