Vulnerability Assesment

Sydney Backups vulnerability, configuration and compliance, network and systems assessment, identifies the vulnerabilities and configuration issues that hackers use to penetrate your network.

Sydney Backups Nessus Vulnerability Scanner

Nessus®, the industry’s most widely deployed vulnerability assessment solution helps you reduce your organisation’s attack surface and ensure compliance. Nessus features high-speed asset discovery, configuration auditing, target profiling, malware detection, sensitive data discovery and more.
Nessus supports more technologies than competitive solutions, scanning operating systems, network devices, next generation firewalls, hypervisors, databases, web servers and critical infrastructure for vulnerabilities, threats and compliance violations.
With the world’s largest continuously updated library of vulnerability and configuration checks, and the support of Tenable’s expert vulnerability research team, Nessus sets the standard for vulnerability scanning speed and accuracy.

Scanning Capabilities

♦ Discovery: Accurate, high-speed asset discovery

♦ Scanning: Vulnerability scanning (including IPv4/IPv6/hybrid networks)

  • Un-credentialed vulnerability discovery
  • Credentialed scanning for system hardening and missing patches
  • Meets PCI DSS requirements for internal vulnerability scanning

♦ Coverage: Broad asset coverage and profiling

  • Network devices: firewalls/routers/switches (Juniper, Check Point, Cisco, Palo Alto Networks), printers, storage
  • Offline configuration auditing of network devices
  • Virtualisation VMware ESX, ESXi, vSphere, vCenter, Microsoft, Hyper-V, Citrix Xen Server
  • Operating systems: Windows, OS X, Linux, Solaris, FreeBSD, Cisco iOS, IBM iSeries
  • Databases: Oracle, SQL Server, MySQL, DB2, Informix/DRDA, PostgreSQL, MongoDB
  • Web applications: Web servers, web services, OWASP vulnerabilities
  • Cloud: Scans the configuration of cloud applications like Salesforce and cloud instances like Amazon Web Services, Microsoft Azure
    and Rackspace
  • Compliance: Helps meet government, regulatory and corporate requirements
  • Helps to enforce PCI DSS requirements for secure configuration, system hardening, malware detection, web application scanning and
    access controls

♦ Threats: Botnet/malicious, process/anti-virus auditing

  • Detect viruses, malware, backdoors, hosts communicating with botnet-infected systems, known/unknown processes, web services linking to malicious content
  • Compliance auditing: FFIEC, FISMA, CyberScope, GLBA, HIPAA/ HITECH, NERC, SCAP, SOX
  • Configuration auditing: CERT, CIS, COBIT/ITIL, DISA STIGs, FDCC, ISO, NIST, NSA, PCI
Sample Assessment Reports

♦ Network-based Scans (Uncredentialed)
Exploitable Vulnerabilities:
Using result filtering, Nessus can generate a report that lists only vulnerabilities for which there is an associated exploit. The following reports are from network scans showing exploitable vulnerabilities grouped by plugin and by host:
→ By plugin, with suggested remediations
→ By host
→ Hosts Summary, Executive/Management Summary
Summary of a network scan showing host status and vulnerabilities sorted by severity with suggested remediations

♦ Credentialed Vulnerability Scans
→ Linux Hosts Summary, Executive/Management Summary
Summary of a Linux host scan showing status and vulnerabilities sorted by severity with suggested remediations

→ Credentialed Windows Hosts Summary, Executive/Management Summary
Summary of a credentialed Windows host scan showing vulnerabilities sorted by severity

♦ Compliance Audits
MySQL CIS Compliance Audits:
Reports from a single host using both Level 1 and Level 2 CIS MySQL checks (.audit)
→ Executive/management summary showing compliance test pass/fail/warning status
→ By compliance status, detailed findings
Windows CIS Compliance Audits:
Reports from a single host using the Windows CIS audit (.audit)
→ Executive/management summary showing compliance test pass/fail/warning status
→ By compliance status, detailed findings

♦ Web Application Testing
Web Application Fuzz Testing: Finding previously-unknown web application vulnerabilities using fuzzing techniques.
Results of fuzz testing a web application
→ Hosts summary, executive/management summary
→ Vulnerabilities by plugin, detailed findings