Tenable Network Security Podcast Episode 183 - "Hardening Chrome, Measuring Patch Management"

Announcements

• We're hiring! - Visit the Tenable website for more information about open positions.
• Check out our video channel on YouTube which contains new Nessus and SecurityCenter tutorials.
• Tenable Tweets - You can find us on Twitter at http://twitter.com/tenablesecurity where we make product and company announcements, provide Nessus plugin statistics, and more!
• Want to ask questions about Nessus, SecurityCenter, LCE, and PVS and get answers from the experts at Tenable? Join Tenable's Discussion Forum for custom scripts, announcements, and more!
• You can subscribe to the Tenable Network Security Podcast on iTunes!

Discussion & Highlighted Plugins

• Devices, Devices, Devices - Plugins this week cover Cisco NAC devices, Cacti, iLO, and Apple Airport vulnerabilities. I think it's great that we're releasing plugins to cover these types of devices. We've talked about it before, and I can't stress it enough – you must scan, patch, and then scan again all of the devices in your your network. The SQL injection vulnerability in the Cisco NAC controller is interesting. To me, that screams "NAC bypass," and if your NAC is easy to bypass, why have one at all?
• Locking Down the Browser - Browser vulnerabilities seem to have patches come out almost every week, and the user is a huge target for attackers. We released a .audit file for Chrome browsers. This is a great strategy; I'm a big fan of hardening your systems and applications. So why not the browser?
• Measuring Patch Management - We recently released a SecurityCenter dashboard which tracks how successful your patch management strategy is in your environment. This is an important exercise: Constantly measure your patch management effectiveness, and constantly try to improve. What are some things we can do to improve patch management?

New & Notable Plugins

Nessus

Passive Vulnerability Scanner

• Cacti < 0.8.8b Command and SQL Injections

Tenable Compliance Checks

• Google Chrome v24 Windows STIG Audit
• CIS Red Hat Enterprise Linux 6 - Level 1 and 2 - v1.2.0 Audits

SecurityCenter Dashboards

• Mitigated Patch Rates

Security News Stories

1. Howto crawl web.xml with ruby to discover servlet urls for a pentest
2. Delete any Photo from Facebook by Exploiting Support Dashboard | Arul Kumar.V
3. Researchers: Oracle's Java Security Fails
4. NSA cracks HTTPS, SSL, 4G smartphone encryption | Digital Trends
5. The Router Review: From nmap to firmware | codeinsecurity
6. Russia's Cybercrime Market Reaches $1.9 Billion
7. 'Don't Travel Abroad' Russia warns Hackers
8. Red Hat CIO Takes an Open-Source Approach to Security and BYOD
9. People the weakest link in security
10. 5 Signs Of Trouble In Your Network
11. Android malware spotted hitching a ride on mobile botnet