Windows XP Professional CIS Certified Configuration Audits
Tenable Network Security has received certification for the Nessus vulnerability scanner and Security Center to perform Center for Internet Security configuration audits of the Windows XP operating system. This blog entry discusses the new audit policies, an upcoming webinar on how to use these polices and making use of these with the Nessus Client and Security Center.
Certified Audit Policies for XP Pro
New audit files are available to all Direct Feed and Security Center customers at the Tenable Customer Portal. Four new audit polices are now available:
- XP Pro Enterprise Desktop
- XP Pro Enterprise Mobile
- XP Pro Specialized Security and Limited Functionality
- XP Pro Legacy
Each of these audit policies corresponds with a CIS profile for deploying Windows XP Pro. The 'Desktop' and 'Mobile' profiles correspond to a typical Windows XP Pro deployment on either a dedicated corporate desktop or a mobile laptop. For extra hardening, tighter security settings and offering the least amount of services, the Specialized Security and Limited Functionality profile can be used. This is an ideal setting to offer very limited and single purpose services. And lastly, for compatibility with Windows NT, the 'Legacy' profile is offered. This profile relaxes some encryption and authentication protocols to retain compatibility with older Microsoft protocols.
Upcoming Webinar
Tenable is offering an upcoming webinar which illustrates what these audit policies test for, how to use them for point auditing with Nessus and how to perform enterprise auditing with the Security Center. The webinar will be held December 12, 2007 between 2:00 PM and 3:00 PM EST.
Title: Nessus 3 agent-less Configuration and Patch Auditing Windows XP
Date: Wednesday, December 12, 2007
Space is limited. Reserve your Webinar seat now at: https://www.gotomeeting.com/register/340209530
Installing and Using these Audit Polices
Direct Feed and Security Center customers can immediately download these new polices.
Nessus users can save these audit polices to their scanning platform and make use of them when creating scan polices. With the Nessus Client, the audit polices can be specified when a scan policy is created.
Security Center users should download these polices and place them in the /opt/sc3/admin/nasl directory as owner 'tns'. These polices will then be available to any vulnerability policy.
For More Information
To see a list of all certified CIS configuration audit polices that can be performed by Nessus Direct Feed and Security Center users, please visit:
Related Articles
Cybersecurity Snapshot: Latest MITRE ATT&CK Update Offers Security Insights on GenAI, Identity, Cloud and CI/CD
April 26, 2024Check out what’s new in Version 15 of the MITRE ATT&CK knowledge base of adversary tactics, techniques and procedures. Plus, learn the latest details about the Change Healthcare breach, including the massive scope of the data exfiltration. In addition, why AI cyberthreats aren’t impacting CISOs’ budgets. And much more!
Cybersecurity Snapshot: Cyber Agencies Offer Secure AI Tips, while Stanford Issues In-Depth AI Trends Analysis, Including of AI Security
April 19, 2024Check out recommendations for securing AI systems from the Five Eyes cybersecurity agencies. Plus, Stanford University offers a comprehensive review of AI trends. Meanwhile, a new open-source tool aims to simplify SBOM usage. And don’t miss the latest CIS Benchmarks updates. And much more!
Cybersecurity Snapshot: CISA Says Midnight Blizzard Swiped U.S. Gov’t Emails During Microsoft Hack, Tells Fed Agencies To Take Immediate Action
April 12, 2024Check out CISA’s urgent call for federal agencies to protect themselves from Midnight Blizzard’s breach of Microsoft corporate emails. Plus, a new survey shows cybersecurity pros are guardedly optimistic about AI. Meanwhile, SANS pinpoints the four trends CISOs absolutely must focus on this year. And the NSA is sharing best practices for data security. And much more!
Cybersecurity Snapshot: Latest MITRE ATT&CK Update Offers Security Insights on GenAI, Identity, Cloud and CI/CD
April 26, 2024Check out what’s new in Version 15 of the MITRE ATT&CK knowledge base of adversary tactics, techniques and procedures. Plus, learn the latest details about the Change Healthcare breach, including the massive scope of the data exfiltration. In addition, why AI cyberthreats aren’t impacting CISOs’ budgets. And much more!
CVE-2024-20353, CVE-2024-20359: Frequently Asked Questions About ArcaneDoor
April 25, 2024Frequently asked questions about CVE-2024-20353 and CVE-2024-20359, two vulnerabilities associated with “ArcaneDoor,” the espionage-related campaign targeting Cisco Adaptive Security Appliances.
CVE-2024-4040: CrushFTP Virtual File System (VFS) Sandbox Escape Vulnerability Exploited
April 23, 2024A zero-day vulnerability in CrushFTP was exploited in the wild against multiple U.S. entities prior to fixed versions becoming available as the vendor recommends customers upgrade as soon as possible.
- Government
- Security Frameworks