Tenable Network Security Podcast - Episode 200
Announcements
- We're hiring! - Visit the Tenable website for more information about open positions.
- Want to ask questions about Nessus, SecurityCenter, LCE, and PVS and get answers from the experts at Tenable? Join Tenable's Discussion Forum for custom scripts, announcements, and more!
- You can find links to subscribe to Tenable's Podcast feed, YouTube Channel, Twitter and Facebook accounts at http://www.tenable.com/podcast!
Discussion
- SCADA Device Vulnerability Detection - How do we do it? Scan, Sniff, Log, "Real-time" all these words come into play, but what do they really mean and how do they help you solve problems and reduce risk? How do we deal with XP in this environment? How do we deal with XP in general? Read More
- Why Isn't My Host Vulnerable?- Lots of questions like this, in the past week, welcome to our world. Three things: 1) Use the audit trail to find out why a plugin did not run (e.g. Your host is not running SSL) 2) Use the knowledge base to find which plugins did fire (e.g. Did you enable a port scanner on all ports?) 3) Monitor Logs/Packets - Fire up tcpdump/wireshark, see if traffic is getting there, look in the logs on the target and see what is happening.
- Looking For The Right Stuff - Like this
- Query to find active vulnerabilities 30 days old or more. When you are collecting all the stuff, you can ask questions like this and get answers. Such as "which hosts are running SSL?" or "Which hosts have SSL certificates older than a week?".
Nessus
- Flash Player for Mac <= 11.7.700.272 / 12.0.0.77 Multiple Vulnerabilities (APSB14-09) (Mac OS X)
- Cisco IOS XR ICMPv6 Redirect Denial of Service
- WMI EMET Configuration Enumeration
- BlackBerry < 10.2.0.1055 qconnDoor Buffer Overflow
- Amazon Linux AMI : openssl Information Disclosure Vulnerability (ALAS-2014-320)
- SSL Certificate Chain Contains RSA Keys Less Than 2048 bits (PCI DSS)
- Adobe AIR for Mac <= 4.0.0.1628 Multiple Vulnerabilities (APSB14-09)
- BACnet Protocol Detection
- MediaWiki Unsupported Version Detection
- Amazon Linux AMI Update: kernel / openssh Denial of Service (ALAS-2014-319)
Passive Vulnerability Scanner
Vulnerability Detection
- CUPS < 1.7.2 Reflected Cross-Site Scripting Vulnerability
- Mac OS X : Safari < 6.1.3 / 7.0.3 Multiple Vulnerabilities
- Google Chrome < 34.0.1847.116 Multiple Vulnerabilities
- TLSv1 Traffic Negotiation Detection
- DTLS Heartbeat Negotiation Detection
- DTLS v1.2 Traffic Negotiation Detection
- DTLS v1.0 Traffic Negotiation Detection
- SSL Content-Type Heartbeat Detection
- OpenSSL 1.0.1 < 1.0.1g Multiple Vulnerabilities
- Windows RDP / Terminal Services Detection
- UDP Protocol Detection
- Generic TCP Protocol Detection
- DNSSEC Client Query Detection
- MediaWiki Password Reset Cross-site Request Forgery Vulnerability
- MailStation Server Detection
- TLS v1.1 Traffic Negotiation Detection
- Fortinet Security Device Detection
- AirMail OSX Client Detection
SecurityCenter Apps
Dashboards
Reports
Security News Stories
- Notorious troll and hacker Weev has conviction overturned
- OpenSSL: The single line of code that broke online security
- How To Securely Erase Your SSD Without Destroying It
- The security of the most popular programming languages
- Google Might Reward Secure Websites With Better Ranking
- Galaxy S5 Fingerprint Scanner Hacked With Glue Mould
- Organizations suffer SQL Injection attacks, but do little to prevent them
- HD Manufacturer LaCie Admits Yearlong Data Breach
- Windows XP Alive & Well in ICS/SCADA Networks
- Black Hat USA 2014: Pentesting? Thought You'd Never Ask
Related Articles
CVE-2022-3786 and CVE-2022-3602: OpenSSL Patches Two High Severity Vulnerabilities
November 1, 2022OpenSSL has patched two vulnerabilities, pivoting from its earlier announcement, in version 3.0.7.
Tenable Responds to CVE-2015-0204: FREAK Vulnerability
March 4, 2015It seems that in recent history, the SSL library continues to give security teams plenty of opportunities to interface with systems/application administrators and vendors to upgrade SSL in their envir...
PCI SSC Announces the End of SSL Usage for the Payment Card Industry
February 16, 2015The Payment Card Industry Security Standards Council (PCI SSC) released a special bulletin on February 13, 2015 announcing impending revisions to the Payment Card Industry Data Security Standard (PCI ...
Operational Technology in the DoD: Ensuring a Secure and Efficient Power Grid
April 19, 2024In an evolving threat landscape, the DoD must make sure that its mission-critical operations don’t experience power outages.
Cybersecurity Snapshot: Cyber Agencies Offer Secure AI Tips, while Stanford Issues In-Depth AI Trends Analysis, Including of AI Security
April 19, 2024Check out recommendations for securing AI systems from the Five Eyes cybersecurity agencies. Plus, Stanford University offers a comprehensive review of AI trends. Meanwhile, a new open-source tool aims to simplify SBOM usage. And don’t miss the latest CIS Benchmarks updates. And much more!
Tenable and Thales Collaborate to Provide Cyber Defense Simulations to Better Secure Operational Technology Environments
April 18, 2024The heart of the Welsh Valleys is home to the Thales Ebbw Vale campus, a world-class facility jointly funded by the Welsh government as part of its regeneration program for the region. At the core of the facility is the Cyber Range, a simulation and virtualization platform for training, testing, exercising and R&D. Tenable has joined the lineup of solutions used to run real world simulations in this controlled environment.
- OpenSSL
- Podcast
- SCADA