Tenable Releases Database Auditing Capability

Tenable Network Security, Inc., the leader in Unified Security Monitoring and creator of the popular and award-winning Nessus^® vulnerability scanner, today announces a new capability for Nessus users to audit the configuration of many different SQL databases. These checks are only available to Security Center users and ProfessionalFeed subscribers. 

Originally designed as a network vulnerability scanner, Nessus already scans for known security vulnerabilities. Over the last five years, Tenable has continued to add additional capability to this widely used and cost effective tool. Nessus’ capabilities have been extended to conduct agent-less patch audits, system configuration analysis against industry best practices, auditing of applications such as web servers and anti-virus installations and being able to audit hard drives for personally identifiable information (such as credit card numbers and social security numbers), copy written content, and other financial or confidential information. 

The new database auditing capability continues to add value to Nessus for a wide variety of corporate enterprise auditors and security consultants. The ability to perform a full security audit of the underlying operating system as well as the SQL database configuration can ensure that applications have taken every measure to prevent data loss from SQL injection attacks, direct attacks on the database and inadvertent internal access to sensitive data. 

“Most organizations practice some sort of defense in depth to keep from being the next high-profile data loss headline,” says Ron Gula, CEO of Tenable Network Security. “Being able to audit your database servers for enhanced security settings allows you add one more layer to your defenses without increasing the cost or complexity of operating them.” 

The new capability of Nessus includes support for auditing Oracle, MS SQL, MySQL and many others, as well as SQL audit policies based on the Center for Internet Security and the Defense Information Systems Agency “STIGs.”