Tenable Vulnerability Management FAQ

Vulnerability Management is a risk-based vulnerability management solution that gives you full network visibility to predict attacks and quickly respond to critical vulnerabilities. Continuous, always-on discovery and assessment provide the visibility you need to find all assets on your network, as well as hidden vulnerabilities on those assets. Built-in prioritization, threat intelligence and real-time reporting help you understand your risk and proactively disrupt attack paths. Built on leading Tenable Nessus technology and managed in the cloud, you get complete visibility of the assets and vulnerabilities on your network so you can quickly and accurately understand your risk and know which vulnerabilities to fix first.

Tenable Vulnerability Management is an integral component of Tenable One, Tenable's Exposure Management Platform. Tenable One builds off of Tenable Vulnerability Management and provides actionable insight into your entire infrastructure's security risks- including cloud instances, web applications, Active Directory (AD) and more, even highly dynamic assets like mobile devices, virtual machines and containers. To elevate cyber risk management even further, you get additional prioritization metrics and capabilities, such as attack surface visualizations, asset criticality ratings, risk-based exposure scoring and peer benchmarking, as well as the ability to track risk reduction over time.

To learn more about Tenable Vulnerability Management, please visit the Tenable Vulnerability Management product page, attend an upcoming webinar or contact your Tenable certified partner or Tenable representative for more information.

Please register for a free evaluation of Tenable Vulnerability Management by visiting https://www.tenable.com/try.

You can purchase Tenable Vulnerability Management applications by working with your local Tenable certified partner, contacting your Tenable representative or visiting tenable.com.

Yes. You can license Tenable applications individually. For example, Tenable Web App Scanning can be licensed on its own, without the vulnerability management capabilities of Tenable Vulnerability Management.

A Tenable Vulnerability Managemento is licensed by annual subscription and priced by asset, rather than by IP address. This enables customers to embrace new technologies like cloud without fear of double-counting.

For more information on pricing and licensing, please see the section below.

The primary benefits of Elastic Asset Licensing are:

• Customers purchase the right amount of licenses, based on asset quantities, not inflated IP counts.
• Customers avoid time-consuming and often inaccurate projects needed to reclaim licenses from decommissioned and/or inadvertently scanned assets.
• Vulnerability management metrics are not corrupted by double and triple counting vulnerabilities for assets that have multiple IP addresses.

The primary benefits of Elastic Asset Licensing are:

• Customers purchase the right amount of licenses, based on asset quantities, not inflated IP counts.
• Customers avoid time-consuming and often inaccurate projects needed to reclaim licenses from decommissioned and/or inadvertently scanned assets.
• Vulnerability management metrics are not corrupted by double and triple counting vulnerabilities for assets that have multiple IP addresses.

Yes, on a temporary basis, customers can exceed the licensed number of assets. Of course, customers need to true-up when license counts continue to be exceeded.

Yes, on a temporary basis, customers can exceed the licensed number of assets. Of course, customers need to true-up when license counts continue to be exceeded.

An asset is an entity that can be analyzed. Examples include desktops, laptops, servers, storage devices, network devices, phones, tablets, VMs, hypervisors and containers.

When Tenable Vulnerability Management first discovers an asset, it gathers multiple identification attributes, which may include a BIOS UUID, the system's MAC Address, NetBIOS name, FQDN, and/or other attributes that can be used to reliably identify an asset. Additionally, authenticated scanning and Nessus agents assign a Tenable UUID to the device. When Tenable Vulnerability Management subsequently scans an asset, it compares it to previously discovered assets. If the newly discovered asset does not match a previously discovered asset, the asset is added to the Tenable Vulnerability Management asset inventory.

PCI ASV refers to requirement 11.2.2 of the Payment Card Industry (PCI) Data Security Standard (DSS) Requirements and Security Assessment Procedures that requires quarterly external vulnerability scans, which must be performed (or attested to) by an Approved Scanning Vendor (ASV). An ASV is an organization with a set of services and tools ("ASV Scanning Solution") to validate adherence to the external scanning requirement of PCI DSS Requirement 11.2.2.

The PCI DSS requires vulnerability scanning of all externally accessible (internet-facing) system components owned or utilized by the scan customer that are part of the cardholder data environment, as well as any externally facing system component that provides a path to the cardholder data environment.

The main phases of ASV scanning consist of:

• Scoping: Performed by the customer to include all internet-facing system components that are part of the cardholder data environment.
• Scanning: Using the Tenable Vulnerability Management PCI Quarterly External Scan template
• Reporting/remediation: Results from interim reports are remediated.
• Dispute resolution: Customer and ASV work together to document and resolve disputed scan results.
• Rescan (as needed): Until a passing scan that resolves disputes and exceptions is generated.
• Final reporting: Submitted and delivered in a secure fashion.

ASV vulnerability scans are required at least quarterly and after any significant change in the network, such as new system component installations, changes in network topology, firewall-rule modifications or product upgrades.

An approved scanning vendor (ASV) specifically performs only the external vulnerability scans described in PCI DSS 11.2. A qualified security assessor (QSA) refers to an assessor company the PCI Security Standards Council (SSC) has qualified and trained to perform general PCI DSS on-site assessments.

Yes. Tenable is qualified as an approved scanning vendor (ASV) to validate external vulnerability scans of internet-facing environments (used to store, process or transmit cardholder data) of merchants and service providers. The ASV qualification process consists of three parts: the first involves the qualification of Tenable Network Security as a vendor. The second relates to the qualification of Tenable employees responsible for the remote PCI scanning services. The third consists of the security testing of the Tenable remote scanning solution (Tenable Vulnerability Management and Tenable PCI ASV).