how to use nessus to protect the network

By default, Nessus will disable the use of insecure protocols like NTLMv1 and LM. It has several benefits over NTLM, including preventing relay attacks, and is relatively easy to implement. Kerberos is the authentication protocol of choice for modern Windows systems. Prioritize or force Kerberos authentication.While keeping up-to-date on patches is critical, you can make several proactive configuration changes to further secure this service:

It seems every few years, there’s a new critical vulnerability in the SMB protocol or the network services that live behind it. If your domain doesn’t support this functionality yet, try to implement the controls it provides individually where possible. The controls provided to this group are especially important if you can’t take advantage of all the other suggestions listed here. If your Active Directory (AD) domain supports it, the “Protected Users” group adds additional security to how credentials are treated when authenticating to a host.

Add the account to the “Protected Users” group.

This is not necessary for vulnerability scanning and should be disabled. Like interactive logon, Microsoft allows account privileges to be delegated under certain circumstances to enable specific functionality. To this end, enabling functionality that prevents unnecessary access like “ Deny log on locally ” or “ Deny log on through Remote Desktop Services” is a good idea. Usually, accounts used for remote administrative authentication, like Nessus performs, don’t need to behave like a standard user account. 5 tips for credentialed scanning of Windows hosts When configuring service account(s) for use in credentialed scanning, below are some key considerations unique to Windows hosts. Not all organizations will be able to implement all these settings.

Before you implement any of these changes, you should test all settings thoroughly to determine if they are appropriate for your environment. Please note that enabling some of these controls may affect other parts of your network and systems. When it comes to protecting credentials in a Microsoft Windows Active Directory environment, though, we have specific guidance. In my last post, I covered general best practices for protecting credentials when performing network assessments. Here, we provide specific guidance for Microsoft Windows systems. This is the second installment in our three-part series exploring how to use Tenable products to protect credentials used for network assessments.

How to use nessus to protect the network