RE: Need Vulnerability Management Tool Review

Nessus is very cheap when comparing it to other tools, but it tends to be a little more difficult to configure. If you are looking at this tool seriously, take a look at http://pauldotcom.com/. He has written a few blog posts on configuring Nessus. You can also configure Nessus to also use nmap or nikto, but this is something you have to add. Nessus only comes as a software download, so you have to build and configure the infrastructure on your own.

NeXpose is also a great tool that comes in software or a hardware device format. You still have to do much of the management and maintenance of the hardware devices. Scanning, site setup, and report configuration is very easy to do, and can only take a day or two depending on the size of your infrastructure. If you are looking at Metasploit Pro as well, it incorporates the two together very seamlessly. I have noticed one thing with NeXpose that it can duplicate vulnerabilities found depending on how you set things up and run your scans. If you have an asset in multiple sites, when you scan it, you can get duplicate results. This can be annoying to say the least. There are ways around it, but you have to run your scans via command line scripts, and use cron to schedule things, so if you have a large environment, or if you do not have much Ruby experience it can be a hassle.

Qualys is a quality tool, that allows you to not worry about the infrastructure management. This can be a plus if you have a small staff. The reports for Qualys look very professional and are very easy to reconfigure to suit your needs. It is quite easy to set up multiple scanning profiles or groups and then run scans against any combination of those. Qualys generally tends to be more expensive of the ones that I have seen. You also need to consider whether or not you are OK with your vulnerability data being stored by a third party, "in the cloud".

Support for Qualys and NeXpose tend to be very good, and they are both generally easier to use. I have not used the other programs before so I cannot speak about them.

Hope this helps.

Matthew Ulm

-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of [email protected]
Sent: Wednesday, October 10, 2012 8:10 AM
To: [email protected]
Subject: Need Vulnerability Management Tool Review

Hi Team,

     We are evaluating Vulnerability Management Tool,  I need your help review or rate these tool on the base of below listed points or any, If you have any recommendation of tool its most except able 

Tool Are-NeXpose ,NESSUS, Retina,GFI LanGurd  
*	Features
*	Ease of Use
*	Performance
*	Documentation
*	Support
*	Value for Money
*	Effectiveness in finding Vulnerability Finding 

------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------


------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------