Installed and configured Tenable Nessus to conduct vulnerability scanning on a Linux machine. Overall scan took 19 minutes. The scan yielded a total of 70 vulnerabilities across various severity levels, including Critical, High, Medium, and Informational vulnerabilities. Notably, Critical vulnerabilities with a CVSS score of 10.0 accounted for 11% of the total result, while High severity vulnerabilities with a CVSS score of 7.5 constituted 9%. Additionally, Medium severity vulnerabilities with a CVSS score ranging from 5.9 to 6.5 comprised another 11%. Following the vulnerability management life-cycle, I meticulously prioritized the top five vulnerabilities from the result. Subsequently, I created a comprehensive vulnerability report and provided actionable remediation recommendations for the identified vulnerabilities. This project exemplifies an enhanced approach to vulnerability management, leveraging Tenable Nessus for robust scanning and strategic remediation planning.
According to NIST, a vulnerability is defined as “A weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source”. As per the definition, it is crucial for the organizations to effectively identify, prioritize, mitigate, and report existing and potential vulnerabilities to reduce organizational risk level to an acceptance level that ensures the confidentiality, integrity, and availability of systems and data. One of the ways the CIA triad can be maintained is through Vulnerability Management, and vulnerability scanning is an essential part of this process. Through vulnerability scanning, this project identified existing vulnerabilities present in the target system. Demonstrated proficiency as a vulnerability analyst identifying and remediating vulnerabilities.
- Metasploitable 2 VM from Rapid7
- Tenable Nessus Essentials
- Kali Linux
- VMWare Player
Overall project followed a step-by-step process from setting up the lab environment to installing and scanning with Nessus. These steps are given below.
- Downloading and Launching Metasploitable 2 Linux Virtual Machine
- Downloading and Installing Tenable Nessus in Kali Linux
- Configuring Nessus for Vulnerability Scanning
- Analysing Results and Prioritized Vulnerabilities
- Remediation steps to selected vulnerabilities
In conclusion, any organization that wants to understand the security threats posed by the technology should implement a vulnerability management program. A vulnerability scanning is at the heart of this program. This project shows the importance of finding vulnerabilities present in the system. The project also demonstrates my ability to implement systems and perform vulnerability analysis to safeguard organization’s data and infrastructure.