Customer Reviews

Nessus Network Auditing: Jay Beale Open Source Security Series (Jay Beale's Open Source Security)

5 star:		(2)
4 star:		(9)
3 star:		(0)
2 star:		(1)
1 star:		(0)

 

 

'Nessus Network Auditing' (NNA) is the definitive (and only) guide to the Nessus open source vulnerability assessment tool. I recommend all security professionals read this book. You may start as a Nessus user, but the book will help you become part of the Nessus community.

NNA features twelve contributors, but it doesn't suffer the fate of other books with similar high author counts. NNA manages to present fairly original material in each chapter, without a lot of overlap. I credit the lead authors and editors for keeping the contributors on track. They could have reduced the number of crashing printer stories, however.

Several chapters stood out from the others. Ch 1 explains the need for conducting vulnerability assessment. Ch 3 makes a good case for always installing from source code and not trusting precompiled binaries. Chs 8 and 9 deliver real value with insights into Nessus internals, such as scanning architecture and the Nessus Knowledge Base. Ch 10 presents crude albeit workable ways to measure bandwidth to alleviate loads caused by scans. Ch 11 is an excellent rationale for the Nessus Attack Scripting Language (NASL) written by Nessus' creator. I would have liked to have seen an appendix based on an actual (perhaps sanitized) scan, showing how a security admin selected tests, ran the scan, and validated results.

NNA suffers a few problems. A few typos are present, but nothing that distracts from the book's content. I did find the ch 4 author's mention of the TCP "triple handshake" to be odd. While not wrong, this process is usually called the "three-way handshake." The screenshots in appendix B are of poor quality and should be replaced in future editions.

Note that the Nessus version used in NNA varies from 2.0.9 to 2.0.10a, and the current edition is 2.2.0. Version creep is part of every technical book, and did not make a big difference at this point. When Nessus 2.4 is released, watch for the adoption of the new BOSS GUI to clearly alter the face of the Nessus interface.

Overall, NNA is an excellent technical resource for anyone charged with auditing network security. I have a greater appreciation for the Nessus architecture and its ability to do more in-depth host checks. Motivated readers can use this book to learn how to write their own NASL scripts and effectively deploy a distributed scanning architecture.

If you are, or are considering, using Nessus in a wide-scale/enterprise scanning infrastructure you will likely find everything you need to know in this book. If you are, or are considering, using Nessus for ad-hoc assessments (or penetration tests), this book will indeed provide a lot of valuable information but at a price: you'll have to read the whole thing to glean all the useful tips and you'll end up spending a lot of time getting intimately familiar with what's probably going to be just one of very many tools in your toolbox, getting only a fraction of your attention in each assessment. If you're new to vulnerability assessment or penetration testing (not just to Nessus) you should really read a few other books first, even though this one does contain some useful info on testing in general, for example, how to identify false positives and negatives.

There's a lot of good content but it tends to be all over the place--numerous sidebars and tables throughout are usually in context but could also have been placed elsewhere. The style, however, seems fairly consistent considering the book had 10 contributing authors and three editors, one of which is the creator of the subject of the book. Unfortunately Jay Beale, whose name appears prominantly on the cover, is merely an editor--a shame since I typically find his articles in Information Security magazine well-written and informative.

There are a just a couple downsides to this book. Like several other current Syngress titles it suffers from poor quality printing and paper with some very tiny and/or fuzzy screen shots, large print, and lack of whitespace--making it a little hard on the eyes. It also really would have been nice if it had included a CD with the current version of Nessus on it, since that's what the book's about after all.

I must admit, as a Nessus user for many many years now, I was excited to hear that a publication was finally becoming available on Nessus (isn't one astonished of how many actual Cisco/Microsoft/Java books exist). However, I was "pensive at best" when it came to actually purchasing a book that "appeared" to simply convey how to install/configure/run this award-winning IT Security tool.

To my pleasant surprise, the very evening I purchased the book, I found myself unable to put this book down, and in fact, stayed up nearly all night reading the entire thing. My overall rating? The best investment I'd spent for an IT Security book in several years. Hands down!

Thankfully, only about 1/3 of the book is spent on install/configure/running the product, the other 2/3rds of the publication convey keen insights surrounding the ins and outs of vulnerability assessments.

I submit that all IT Security Engineers should spent the money and time gaining "keen insights and perspectives" of Renaud Deraison, unquestionably a pioneer in the history of IT Security. True, a vulnerability assessment is only one (yet key) piece of the entire "Security Puzzle", nevertheless, if your job carries the title CISSP/CISM, and you're involved with IT Security (regardless of whether or not your vulnerability assessment tool du jour is Nessus or not) your understanding surrounding vulnerability assessments isn't complete til you've peered into the "Mind's eye" of Mr. Deraison.

Clearly, in the annals of IT Security, history will render him a Pioneer in the journey of protecting an organizations IT assets.

This book is the only game in town when it comes to nessus. The information it contains should be regarded as mandatory knowledge for those running nessus in a professional environment. This book is about more than just nessus. It is about an approach to network auditing and vulnerability assessment.

The first few chapters are largely introductory and cover vulnerability assessment and nessus basics. The next few chapters cover more basics including running a scan, interpreting results, and vulnerability types.

The latter chapters cover areas of interest to an experienced nessus user. The chapter on false positives begs to be read. The authors offer a logical approach to dealing with false positives that most organizations lack. The remaining chapters detail the inner workings of nessus (knowledge base, nasl, plugin writing), enterprise scanning, and the nessus user community.

This book provides a through explanation of the tool. Enough information is given to start writing your own custom security checks. However, I did find myself wanting for a little more technical substance (especially in the plug-in writing/nasl area), but maybe that's just me. This book has a decent index that helps with reference. This book will benefit the beginner and experienced user alike.

For network security, there has been a proliferation of tools to aid the harassed sysadmin. Prominent amongst these is Nessus, which, given its origin in 1998, is somewhat of a veteran in this field.

The book's first chapter is a very articulate and concise overview of vulnerability assessment, and independent of specific tools like Nessus. But moving onto Nessus, you get a detailed user's manual. From running it to interpreting the results. The latter can be tricky. The book tries to give you some appreciation of the limitations of Nessus and of the assumptions that it might implicitly make about your network and machines. It turns out that to use it well, you need good familiarity with your network. Like its topology and any perculiarities of the machines. For example, do you have a program running on one machine that regularly probes the others, for whatever reason? And are you aware of the patch status of the machines? Nessus can help you with detecting such things. But it won't hurt to know as much, a priori.

Don't ignore the chapter on the world wide user community. It can be a vital resource if you end up using Nessus.

The purpose of Nessus is to provide an Open Source Solution for network auditing on all Unix like systems. This book not only details using Nessus but also comes with a CD containing the program, as well as Ethereal, Snort, and Newt (a port of the program to the Windows environment).

What is a network assessment? At its basic level it is an attempt to detect a live system and then identify the computing environment, services, applications, and vulnerabilities on that system. Basically there are two types of assessment - internal and external. An internal assessment is done over the local network and external is done from outside the LAN. Nessus will do both types and the book details how to do either, or both of them.

The authors do an excellent job of detailing installation, setup, and how to interpret the results of a scan as well as various factors that can affect the report. One of the parts not to be missed is the discussion of not only the benefits but also the potential problems of scanning your system. Some of the vulnerability types scanned for include buffer overflows, default passwords, backdoors, information leaks, and denial of service.

The Nessus scripting language is covered in detail in Appendix A instead of the main portion of the book; a choice I appreciated very much as it allowed the flow of the book to not be interrupted by such a highly technical section. With Open Source products there generally is no organized technical support phone number you can call of help. So, the authors include information on how to get help via the Nessus User Community, mailing lists, and archives.

Nessus Network Auditing is a highly recommended book for anyone interested in auditing their network to find potential problems before they become reality.

This is the third book in Jay Beale's Open Source Security Series from Syngress Publishing and it is every bit as good as the first two. It certainly doesn't hurt to have the founder of the Nessus Project be one of the leading contributors to the book.

The book begins with an overview of the basic concept of vulnerability assessment and how a scan can be used to proactively detect holes and protect the network. After a brief introduction to the founding of the Nessus Project and the birth of the Nessus software the book goes into comprehensive detail about how to install, configure, administer, and employ the full functionality of Nessus to secure and protect your network.

Some of the most valuable information is contained in the chapters describing how to interpret the results of a Nessus scan and how to handle false positives. The book also provides information about the Nessus Knowledge Base and the Nessus User Community - two valuable resources for further information. The enclosed CD contains full versions of Nessus, Ethereal and Snort as well as NeWT, a standalone security scanner for Windows based on Nessus.

Nessus is an excellent tool and this book is an invaluable resource in helping you get the most out of it.

(...)

Considering Nessus is one of the best free network monitoring tools on the market, this is a perfect book to get to start working with Network Systems Auditing. For people that have a decent working knowledge with multi-platforms and Networking, this book is a good way to get your feet wet with to start preparing for your CISA Cert.

A good source for experienced users and a must read for novices.

At times the syntax of this book leaves a bit to be desired (the editors could have done a better job at polishing the final product). You cannot, however get a better source for Nessus information than the creator himself, who is a contributor to the book.

I would highly reccomend this book.

First, it's old. Even if you're using the open source 2.x versions and not the commerical 3.x versions, you'll find the content to be a bit dated. Not a problem for the most part, as this book talks a lot about vuln scanning concepts and all that is still applicable. And the differences in GUI layout between the book and latest versions isn't hard to rectify just by clicking around a little. The age of the text is more of a problem in that it lacks discussions of current attacks.

Second, a lot of the book just covers basics about vuln scans and using nessus. Sorry, but for the money I paid for this book, I'm not seeing the value that other reviewers are referring to. IMHO lots of this basic usage and intro stuff is covered in numerous online articles (some of which are linked from Tenable's website on the Nessus documentation page). Even topics like dealing with false-positives are covered pretty well in those resources.

Granted, the reviews are generally from 2004 and 2005, and many of the articles I'm referring to were written after then. So maybe this book was really helpful at that time - but for anyone considering buying this book circa 2008 or later, save your money. Either wait for an updated edition or look at free resources online.

As for the "lack of meat", this book just doesn't go deep enough. Again, I'm not getting much insight beyond what I already found online. I've gleaned some good tips, but again, not enough to justify the length (and cost) of this book.