Nessus Manager ( nessusadmin | 28 hours )

Basic Knowledge of common protocols such as HTTP,HTTPS, SSH, SSL, Telnet SFTP etc

Basic knowledge of the OSI layers

Basic knowledge of IP addressing

The Nessus vulnerability scanner is a very versatile platform for detecting and managing vulnerabilities. They can even do so much more than vulnerability detection. They can also do baseline auditing. In which case you system configuration is being compared with the best hardening standard

In this Instructor led course, we will introduce the components of the solution and the different t functionalities, each module in the application will be explained and its use case laid out.

At the end of the course, participants will be able to carry out vulnerability (authenticated and unauthenticated) scans on almost all IP based systems and analyze the results of the scan to eliminate false positives. The participants will learn to carry out risk based prioritization of findings and recommend compensating controls. This course will help the participants determine the security posture of their systems using Nessus and decide on the best course of action for remediation.

Audience:

• Infrastructure managers
• System administrators
• System Auditors
• System compliance officers
• vulnerability managers
• cybersecurity managers

Format:

Part Lecture, part discussion and hands on practice

Overview of Nessus Interface and navigations

1. Installing Nessus Server and License
2. Checking plugins and updating plugins
3. Scanning windows
4. Using preloaded scan profiles
5. Walk through of preinstalled configuration standards
6. Navigating the interface
7. Setting up notification

Scanning:

1. Running simple scans
2. Running scans from predefined templates
3. Creating templates from preloaded plugins
4. Asset discovery scans

Understanding Nessus output:

1. Understanding Nessus output file
2. Understanding risk rating and scoring
3. Eliminating useless data and reducing output
4. Validating findings
5. Nessus reporting

Detailed review of Plugins:

1. Data discovery plugins
2. System specific plugins
3. Compliance plugins