Tenable One
onboarding portal

Important onboarding milestones

1. Set up tags

Tags are a critical component of Tenable One. The tags you create will determine the analysis that you can perform. When setting up tags consider how you want to visualize your assets. For example, tagging assets by geography, business unit and asset type allows for analysis on each of those groupings. All tags created in Tenable Vulnerability Management will automatically sync to Tenable One. This is how you will analyze data in Custom Exposure Cards within Tenable One.

2. Get comprehensive scan data

The more assets and asset types you scan, the more comprehensive your risk insight will be. We encourage you to also set up Tenable Identity Exposure, Tenable Cloud Security and Tenable Web App Scanning in your environment.

3. Scan frequently

We recommend you Scan frequently. The more you scan, the more often your data refreshes in Tenable One, making the data being presented more relevant.

4. Review the Asset Criticality Rating of your most critical assets

Most organizations know about their critical assets (ACR = 10). From there, work backwards to identify the next most important assets and validate/adjust their ACR as necessary (Note: Tenable will score only up to an ACR of 8, it is up to the customer to assign a 9 or 10 if an asset warrants that.)

Applying Tenable Vulnerability Management to Tenable One

• Review your assets in Asset Inventory once a Tenable Vulnerability Management scan has run. Here you will see a comprehensive inventory of your assets, including assets you may have otherwise overlooked.
• In Lumin Exposure View review your Exposure Cards. You can then create a custom exposure card based on business context. Each card allows you to customize your CES Target, Trending view, SLA timeframe and SLA efficiency.
• If an identity scan has successfully run, review Attack Path Analysis. This allows you to review findings and select a critical asset and query Blast Radius or Asset Exposure Graph. Note, the Attack Path Analysis feature is only available with Tenable One Enterprise Edition & will be covered in more depth later in this document.

Important onboarding milestones

1. Install and configure scans

Get started by installing Tenable Security Center and doing a quick setup, covering licenses, scanners, and user accounts. Set up email settings, define scan areas, and configure basic security options. Then, run scans using provided templates, ensuring smooth operations. Confirm accessibility and configure additional features as needed. Create dashboards, reports, and search for vulnerabilities by ID.

2. Set up tags

Tags are a critical component of Tenable One. The tags you create will determine the analysis that you can perform. When setting up tags consider how you want to visualize your assets. For example, tagging assets by geography, business unit and asset type allows for analysis on each of those groupings. All tags created in Tenable Security Center will automatically sync to Tenable One. This is how you will analyze data in Custom Exposure Cards within Tenable One.

3. Scan frequently

The more assets and asset types you scan, the more comprehensive your risk insight will be. We encourage you to also set up Tenable Identity Exposure, Tenable Cloud Security and Tenable Web App Scanning in your environment. We recommend you Scan frequently. The more you scan, the more often your data refreshes in Tenable One, making the data being presented more relevant.

4. Review the Asset Criticality Rating of your most critical assets

Most organizations know about their critical assets (ACR = 10). From there, work backwards to identify the next most important assets and validate/adjust their ACR as necessary (Note: Tenable will score only up to an ACR of 8, it is up to the customer to assign a 9 or 10 if an asset warrants that).

Applying Tenable Security Center to Tenable One

Use Tenable One for accurate assessment of your Cyber Exposure risk and compare your health and remediation performance with peers.

• You must configure your Tenable Lumin Exposure View application specifically for use with Tenable Security Center. Then you can set the synchronization of Tenable Security Center to send limited data to Tenable Vulnerability Management for analysis in Tenable One.
• Tenable Security Center communicates with Tenable Vulnerability Management using an encrypted connection, as described in Encryption Strength. When you send data to Tenable Vulnerability Management, the system does not remove the data from your Tenable Security Center. You can continue normal operation of Tenable Security Center.
• After you configure Tenable Security Center data synchronization to Tenable One in Tenable Vulnerability Management, you can view information about your Tenable One metrics. You can view your Cyber Exposure Score, Assessment Maturity grade, and Remediation Maturity grade as well as Asset Criticality Rating and Asset Exposure Score.
• In Lumin Exposure View, review your Exposure Cards. You can then create a custom exposure card based on business context. Each card allows you to customize your CES Target, Trending view, SLA timeframe and SLA efficiency.
• In Asset Inventory, review your assets to understand the strategic nature of the interface as compared to other cloud products. This should help set your expectations on what features to use within Asset Inventory, and when.

Important onboarding milestones

1. Review and secure Tenable Identity Exposure Administrators

Review and secure native admins and continuously monitor and alert on net new users added.

2. Connect Identity Exposure and Tenable One

Follow the steps below to connect the two products in the Tenable One console and view the new Exposure Cards.

3. Address AD and Entra ID exposures

Address common misconfigurations — i.e. Privileged Accounts with SPN attributes, Dangerous Delegations, DCSync rights and ensuring the MSOL ID is adequately secured through use of Group Managed Service Accounts, disabling and removing over-provisioned service accounts and user accounts that may be considered 'sleepy' to effectively reduce their attack surface.

Applying Tenable Identity Exposure to Tenable One

Key Steps to Connect Tenable Identity Exposure and Tenable One

• Preparation and planning
  1. Review Release Notes to understand new features and important changes.
  2. Select the appropriate architecture for deployment (on-premises).
  3. Check pre-deployment requirements, including resource planning.
• Install or upgrade Tenable Identity Exposure
  1. Install or upgrade Tenable Identity Exposure
  2. Install Secure Relay (mandatory form on–premises version 3,59 and SaaS) to forward data to Tenable Identity Exposure
• Post-deployment and maintenance:
  1. Restart Services and perform Post-deployment Tasks.
  2. Use Logs for troubleshooting any issues.
  3. Review licensing and ensure compliance.
  4. Begin using Tenable Identity Exposure as described in the documentation.
• Configure Tenable Identity Exposure to forward Data To Tenable One
  1. Log into Tenable one
  2. Click request on Tenable Identity Exposure Tile
  3. Generate and upload license file to Tenable One
  4. Configure Forests

Once connected, review these key capabilities:

• In Lumin Exposure View
  1. Review the Identity Exposure Card so you can set customized targets for analysis and remediation.
  2. Configure the exposure view settings to set a customized card target and configure remediation SLA and SLA efficiency based on company policy.
  3. Create a Custom Exposure Card for AD resources based on Business Context.
• Review AD assets in Asset Inventory. This will help identify AD assets and take appropriate actions to remediate
• For Tenable One Enterprise customers Only
  1. Once your Identity scan completes, review the findings in Attack Path Analysis. Select a critical AD asset and generate a Blast Radius or Asset Exposure Graph query so you can visualize an attack path and understand how assets can create a path into and through your environment that may have previously been hidden.

Important onboarding milestones

1. Set goals

Once you deploy Tenable Web App Scanning create some quick scans to get a high level assessment to establish your baseline. Then consider setting some goals, for example:

• Is there a remediation timeline for critical vulnerabilities?
• What are your most critical web applications? Pay particular attention to publicly facing web applications.
• What qualifies as acceptable for your organization?

2. Determine scanning frequency

More frequent scans ensure up to date data.

3. Understand your Web Application estate

Using previously run scans, find where potential web applications exist.

Applying Tenable Web App Scanning to Tenable One

• Review your web applications and identify those that require remediation, particularly those that are publicly available on the internet.
• Review the web application Exposure Card in Lumin Exposure View. Here you can:
  1. Set customized targets
  2. Set SLAs based on company policy
  3. Set SLA efficiency targets
• Create a custom Exposure Card based on business context such as
  1. Web application owner
  2. Asset criticality
  3. Application
  4. Internal or external web applications
  5. Ecommerce/supporting assets

Analytics check

Now is a good time to stop and investigate the data already in your platform. This helps you get a picture of what Tenable One is capable of doing so you can make more strategic decisions.

• Review your most critical vulnerabilities on your most critical assets using the VPR and ACR data. Take action to remediate if warranted.
• Think of how your remediation processes may need to be amended to take advantage of the information provided by Tenable Vulnerability Management, Tenable Identity Exposure and Tenable Web App Scanning.
• Review assets in Asset Inventory to understand the strategic nature of the Tenable One platform versus point products.

Tips for getting the most out of Tenable Attack Surface Management

• Configure Tenable Attack Surface Management with as many of your primary domains as possible. Let this "run" for a week or so, the product will ingest and scrape the internet to pull in relevant external data.
• Go through your suggested domains and add them to your inventory if they are relevant for your organization. This ensures all relevant, external data is within the platform.

Important onboarding milestones

Tenable suggests you complete the following milestones to ensure your success before proceeding with your Tenable One deployment process:

In Asset inventory

• Review your OT assets to understand the strategic nature of the interface compared to other cloud products. This should help you set expectations on what features to use within Asset Inventory and when.
• Create a new dynamic tag for your OT assets, where:

Operator = Host System Type

Value = PLC

In Lumin Exposure View

• Review the operational technology exposure card.
• Configure the exposure view settings to set customized card targets and to configure your Remediation SLA and SLA Efficiency based on your company policy.
• Create a custom exposure card based on business context, and include the new tag you created in Tenable Inventory.

Applying Tenable OT Security information within Tenable One

• Unified cyber exposure strategy:
  • Integrate Tenable OT Security with Tenable One to view Cyber Exposure risks comprehensively. This unified approach enhances cross-platform vulnerability identification and security management across IT, OT, and IoT environments.
• Real-time data synchronization:
  • Synchronize OT data in real-time into Tenable One to maintain an up-to-date security posture. Continuous data flow provides immediate insights into OT threats and vulnerabilities, enabling prompt risk management
• Targeted remediation strategies:
  • Utilize Tenable One's exposure analytics to prioritize remediation based on critical asset risk levels. This strategic focus ensures effective resource allocation to address the most significant threats to OT/IT networks.
• Custom exposure dashboards:
  • Create customized exposure dashboards in Tenable One that display tailored security metrics for OT, IT, and IoT. These dashboards offer strategic insights that help optimize security operations and compliance.
• Enhanced asset visibility and control:
  • Gain detailed insights into the security posture of assets through Tenable One's Asset Inventory. Initiate strategic asset protection planning across OT infrastructures, enhancing visibility and control over complex OT environments.
• Proactive security planning with Attack Path Analysis (APA):
  • Tenable One's Attack Path Analysis for OT enterprise environments preemptively identifies and mitigates vulnerabilities. This proactive approach allows for the simulation of attack scenarios relevant to OT, pinpointing potential exploits and enabling targeted defense strategies to protect critical OT assets and maintain operational continuity.

Important onboarding milestones

1. Discover

Gather an Inventory of your cloud accounts and cloud resources across cloud service providers.

2. Assess and Prioritize

Identify common cloud risks across your multi-cloud infrastructure including resource misconfigurations (e.g., Open S3 buckets, exposed databases, unrestricted ingress to administrative ports), risky privileges and vulnerabilities (e.g. malware, known exploits, CVEs). Prioritize based on true risk using identity and access insights.

3. Remediate and Achieve Compliance

Streamline remediation with resource ownership mapping and guided workflows. Maintain adherence to industry benchmarks and standards (e.g., CIS, SOC-2, PCI, NIST, HIPAA).

Integrating CNAPP into your Exposure Management Strategy

Tenable Cloud Security consolidates efforts to reduce cyber risk across your entire attack surface – without adding vendors or complexity. By integrating the Tenable Cloud Security CNAPP into your Exposure Management solution you get visibility across on-premises, hybrid and multi-cloud environments. This visibility allows you to focus on preventing likely attacks that can result from a toxic combination of vulnerabilities, misconfigurations and excess permissions.

Realize the Value of your Data

Once you deploy and configure all of the Tenable One point products you can use Asset Inventory, Lumin Exposure View and Attack Path Analysis to pull in data from the point products and get the most value out of that data.

Tips for getting the most out of Lumin Exposure View

• Understand your Cyber Exposure Score to assess your overall risk. View changes over time and identify which categories to prioritize.
• Create custom exposure cards to track and report exposure metrics based on specific business contexts. Setting up extensive tags in Asset Inventory based on important criteria (ex. geographies, business units, asset types) will speed up the process.
• Configure Exposure Card settings to set your sparkline time span, benchmark industry, card targets, and more.
• Understand how effective your program is via the Remediation Maturity metric.
• Customize SLAs for each tag in your Exposure Cards as SLAs can vary depending on the environment, regulations, etc.

Tips for getting the most out of Tenable Attack Path Analysis

• Review your Findings to determine the most critical attack paths and determine your next course of action.
• Explore and get specific contextual data when you explore the different nodes within an attack path visualization.
• Under ATT&CK, see where you are most at risk against the MITRE ATT&CK framework.