Tenable Blog

Announcements

• The Nessus HTML5 beta interface is now available! Try it out and send us your feedback.
• Debate: Flame, Stuxnet and other APTs are hype, but still be wary
• Check out our video channel on YouTube which contains new Nessus and SecurityCenter 4 tutorials. The "#1 Nessus is an Enterprise Tool - Top Ten Things You Didn't Know About Nessus" video is now available.
• We're hiring! - Visit the Tenable website for more information about open positions.
• Tenable Tweets - You can find us on Twitter at http://twitter.com/tenablesecurity where we make product and company announcements, provide Nessus plugin statistics, and more!
• Want to ask questions about Nessus, SecurityCenter, LCE, and PVS and get answers from the experts at Tenable? Join Tenable's Discussion Forum for custom scripts, announcements, and more!
• You can subscribe to the Tenable Network Security Podcast on iTunes!

Nessus 5.0.2 has been released and is available at http://www.nessus.org/download/. This update is largely a bugfix release, however a new build for Solaris 10 is now available. 

DerbyCon 2.0 - The Reunion

While I'll do my best not to get "all sentimental," it seems you just can't help it when you're writing about the DerbyCon security conference. DerbyCon takes place each September in Louisville, KY, and has grown to house over 1500 hackers and security professionals in a relaxed and fun environment. There was plenty to do, including visit the lock pick village, be transformed into a zombie by a professional make-up artist, attend a wide array of talks, and much more.

The conference truly feels like you're getting together with your friends and family. Throughout the entire conference, even through the wee hours of the morning, folks were gathered in the hallways and lobbies talking about security, educating each other, and sharing ideas. The presentations received excellent reviews, and ran the gamut from big-name speakers, such as Jeff Moss and Kevin Mitnick, to lesser-known folks sharing some cutting-edge research.

If you want to read more about DerbyCon, you can visit their web page and view videos of all the talks on Irongeek's website.

Tenable Network Security announced today it has established a strategic partnership and technology development agreement with In-Q-Tel. In-Q-Tel is the not-for-profit, strategic investment firm that works to identify, adapt, and deliver innovative technology solutions to support the missions of the U.S. Intelligence Community. Under the terms of the agreement, Tenable will develop secure audit and remediation capabilities that will assist intelligence agencies in continuously outpacing emerging cyber threats.

Passwords are Like Underwear, and It's Laundry Day

Perhaps one of the most easily overlooked security problems in the industry is password security. I'm not referring to the stored end-user password problems (discussed here), but the default (or weak) usernames and password combinations used to protect common administrative interfaces to applications and systems.

The problem stares us in the face every day, each time we log into a router, database management system, or remote access console and enter a password. Often we put a lot of time and effort into securing the end user-facing passwords, such as implementing account lockout password policies and forcing them to change their passwords at a regular interval. I find it ironic that the applications and devices used to run the organization often do not implement the same controls. Hundreds of applications and/or devices are known to be deployed with default passwords, and if not changed before or immediately after they are plugged into the network, can present serious risk to the organization.

Default credentials are considered "low-hanging fruit" for two reasons. First, they are easily exploitable by an attacker and can often lead to a serious security breach. Second, once you've identified the problem, it is easy to fix by setting a more secure password.