RE: [fw-wiz] commercial va

From: Ben Nagy (ben@iagu.net)
Date: 04/17/03

  • Next message: Ahmed, Balal: "RE: [fw-wiz] PIX Licensed Connections Limit" 
    From: "Ben Nagy" <ben@iagu.net>
To: "'Behm, Jeffrey L.'" <BehmJL@bvsg.com>
Date: Thu, 17 Apr 2003 09:43:12 +0200

    > -----Original Message-----
    > From: firewall-wizards-admin@honor.icsalabs.com
    > [mailto:firewall-wizards-admin@honor.icsalabs.com] On Behalf
    > Of Behm, Jeffrey L.
    > Sent: Wednesday, 16 April 2003 8:02 PM
    > To: firewall-wizards@honor.icsalabs.com
    >
    > Do you have any specifics on what got "freaked out?" by
    > nessus?

    Network infrastructure, particularly (in my case) switches with spanning
    tree enabled. I still feel the pain. This was a while ago, yada yada, but
    AFAIK it's still a fairly widely held belief. Most people recommend that you
    avoid routing your nessus scans around a lot, or scanning your
    infrastructure (routers, switches, firewalls) devices too heavily.

    Obviously if you don't run in safe mode you have even more potential
    problems, but I already assumed that nobody sane would do that on a
    production network.

    I have also "heard" (this is code for "I can't remember where I heard it,
    nor can I back it up from my own experience") that some hosts or servers
    have had problems with safe nessus scans and crashed anyway.

    As for the rest of the thread, I'll shut up now that there has been a decent
    discussion - I was terrified that the poster would go and evaluate nothing
    but ISS and Cybercop - which is probably not a good plan.

    General points that I would like to underline:

    - VA can't yet replace a smart security person in terms of turning scan
    results into sensible risk management and remediation.

    - The whole VA space is still evolving. Event correlation, distributed
    scanning, automatic remediation and early attempts at intelligent risk or
    threat assessment are already out there from a number of vendors.

    - No tool is perfect, and while everyone is working to reduce false
    positives and false negatives, writing checks that don't crash things is
    actually pretty hard. Don't assume that your tool is giving you the gospel.

    > I.E. what in particular should one be concerned
    > about? [...]
    >
    > Please enlighten me if I am astray.
    >
    >
    > At some point, Ben Nagy spewed:

    Spewed? ;)

    > > You should look at Retina as well. For freeware, Nessus is
    > also cool,
    > > but I, personally, would be very careful running it on production
    > > networks (we often recommend that people use nessus as a
    > complement to
    > > Retina, but it does have a habit of freaking out networks).

    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: Ahmed, Balal: "RE: [fw-wiz] PIX Licensed Connections Limit"

    Relevant Pages

    • Circa 1976, Long Distance Network Mapping Project [telecom]
      ... I had the opportunity to do some university level work in the 1970s related to the cost of operation and ROI feasibility for long-line costs over the old Bell Operated Public Switched Telephone Network. ... calls would default to a route based on what was termed a "homing" priority. ... There were five levels of ranked switches, or a hierarchy of switches based on where calls needed to go. ... For example, under the strict homing hierarchy-topology, a call from Walla Walla, Washington to Moscow, Idaho - a distance of less than 100 miles - would route from Walla Walla, to Yakima, to Seattle, to Sacramento, to Denver, to Salt Lake, to Boise, to Coeur d'Alene and finally to Moscow. ...
      (comp.dcom.telecom)
    • Re: Single domain two IP subnets
      ... hardware or any of the complexities of "network hardward ... I never criticize anyone's typing as long as the words can ... Cisco ISL VLANS are history. ... Newer Cisco switches don't even support ISL ...
      (microsoft.public.win2000.dns)
    • Re: FCC now planning "all-IP" phone transition [Telecom]
      ... With VOIP, the customer understands that he/she must provide the power, including battery backup power if desired. ... > copper is capacity. ... to the network also provides operating power. ... > surplus dozens of backbone ESS switches and probably hundreds ...
      (comp.dcom.telecom)
    • Re: abnormal (excessive) number of arp requests on subnet?
      ... The title also applies to network design/operation. ... Though with the switches, you'll have to do some thinking about where ... A separate box attached to the monitor port on ... and how does that traffic get from Host A to Host N or what-ever. ...
      (comp.os.linux.networking)
    • Re: new switching technologies
      ... mixed with stackable switches. ... i havent used these kit versions, but this is maybe the 5th or 6th iteration ... of a fix looking for a problem for L2 network resilience / load balancing. ... optimal one is what routing protocols were designed for and what they are ...
      (comp.dcom.lans.ethernet)