A Closed Nessus Still Appeals to Users

For Tenable Network Security, developers of the popular Nessus security scanner, moving to a non-open source license has apparently been the right decision.

This week Tenable released Nessus 3.2, the second point release of Nessus since moving away from the open source GPL in Nessus 3.0 in December 2005.

"We've seen more Nessus users, both new users and repeat users, since Nessus 3 was announced than there ever were before," Ron Gula CEO of Tenable Network Security told InternetNews.com. "Most users are more interested in how Nessus can help them and if it works than looking at source code. And we still maintain the older Nessus 2 code base, which is still available."

Among the many improvements in Nessus 3.2 is the ability to audit IPv6-based network traffic. Gula noted that the IPv6 (define) protocol may have its own set of security issues and enhancements, but the focus of Nessus 3.2 is to be able to communicate with a host using IPv6.

"In other words, networks may have hosts that only use IPv6," Gula added. "Without being able to speak IPv6, a network auditing tool such as Nessus won't be able to communicate with it. The vulnerabilities tested by Nessus over IPv6 are the same as over IPv4."

The changes in Nessus 3.2 were based on user feedback, according to Gula, and deal with many different uses. Gula noted that his personal favorite is the new Nessus client and common report format.

"Previously, Nessus users on Windows, OS X and Linux all had slightly different experiences, and if someone from the community wanted to work with Nessus data, there was no standard," Gula explained. "With the new client and the new reporting format, which combines scan polices, targets and scan results, it will be much easier to build on this common experience."

The Nessus experience is one that Tenable is hoping to expand into further adoption by enterprise users. Gula does not see any particular challenges or barriers to adoption at this point either.

In addition to the freely available (but not open source) version of Nessus, Tenable also offers Nessus commercial support and additional enterprise functionality with its Direct Feed subscription service.

Gula noted that Tenable also offers an enterprise management console, which makes it easier for organizations to manage multiple Nessus scanners, perform scans, patch audits and configuration audits and share and analyze the data securely.

"Nessus has been available for almost a decade, and many people know about it," Gula said. "We measure Nessus downloads in units of millions, and these come from all over the world, including enterprise users."

Article courtesy of InternetNews.com