If Nessus provides a pointer in the vulnerability assessment scan report to look up CVE-2009-3555 when using the CVE search listing, specify what this CVE is, what the potential exploits are, and assess the severity of the vulnerability.ĬVE is a list of information security vulnerabilities and exposures that provides common names for publicity known problems.
This is a classification system for the exploitability of software vulnerabilities and exposures.ġ1. When you identify a known software vulnerability, where can you go to assess the risk impact of the software vulnerability?Ĭommon Vulnerability Scoring System (CVSS) is a place where we can go to assess the risk impact of the software vulnerability. Of course open ports are a risk, because the attacker can use these ports to exploit the vulnerabilities such as use Trojan to make a screenshot and then send a screenshot back to the attacker.ġ0. Are open ports necessarily a risk? Why or why not? While Nessus provides suggestions for remediation steps, what else does Nessus provide that can help you assess the risk impact of the identified software vulnerability?īeside remediation steps, Nessus also provides devices and software on the network that are not authorized or indicate a network compromise.ĩ. How many IP hosts were identified in the Nessus® vulnerability scan? List them.Ĩ. What is the source IP address of the Cisco Security Appliance device (refer to page 6 of the PDF report)?ħ. Port 443 and ssl/http service are enabled on the Cisco Security Appliance device.Ħ. From the ZenMap GUI pdf report page 6, what ports and services are enabled on the Cisco Security Appliance device? There are 36 scripts loaded for scanning.ĥ. How many total scripts (i.e., test scans) does the Intense Scan using ZenMap GUI perform? Nessus is better for performing a software vulnerability assessment.Ĥ. Which scanning application is better for performing a software vulnerability assessment with suggested remediation steps? Nmap is better for performing a network discovery reconnaissance probing of an IP network infrastructure.ģ. Which scanning application is better for performing a network discovery reconnaissance probing of an IP network infrastructure? Nessus scans ports just like Nmap, however it will notify if the open ports have potential security vulnerabilities attached to them.Ģ. Nmap discovers active IP hosts and gathers information about the open ports. Nessus is a vulnerability scanner whereas Nmap is used for mapping a network’s hosts and the hosts’ open ports. What are the differences between ZeNmap GUI (Nmap) and Nessus?
0 kommentar(er)
