I've been a Nessus user for quite some time now, likely as far back as version 1. I've liked the product up till the most recent release of 4.2.0. I began having all sorts of problems. Audits not completing, when they did complete the report either would not generate or if it did generate it would present large black boxes sporadically throughout the report, the console would crash or restart without warning...
After contacting Tenable support, I was told some of the most outrageous excuses such as "We don't support scans through firewall", "We don't support scanning that large of a network segment", "You report is to large, you need to add this filter to remove some of the entries to have the report generate".
With that said, Tenable all I can offer you is this. Before your next product release, I suggest you download NeXpose from Rapid7 and seriously reconsider how your product functions and what the end-user security community actually needs.
Installation and SetupBoth products were easy to install, Nessus required no dependencies and installed after about 5 minutes. NeXpose required one dependency which took approximately 2 minutes to locate and install. After which the install process was approximately 5 minutes.
FunctionalityIf you download Nessus, you're restricted to only auditing for Windows vulnerabilities. If you want more, you need to buy the professional feed for $1200.00 a year.
NeXpose is fully functional with the only restriction on the "Community" version being that you cannot have more tha 32 IP's in the UI at a given time and regulatory audits are disabled. NeXpose also integrated directly with Metasploit. This makes the actual testing portion of the audit process far easier as you can just hop down to the console and test for the reported vulnerabilities rather than hunting for the source to actually verify a reported issue.
Front-EndNessus has the very sexy front-end UI, while NeXpose has the php front-end. I honestly prefer the php front end, it loads faster and doesn't chew up a large chunk of memory. If you like flashy stuff though, the Nessus UI would likely hook you.
Audit PoliciesNessus comes with no pre-configured audit policies and while there is some user documentation, once you configure your first policy and it fails you`ll learn most of the options they`ve described in the User Guide are neither support or recommended by Tenable.
NeXpose - comes with several preconfigured policies to test for not only regulatory regulations such as PCI, SARBOX, HIPAA, web application audit, "full" and "exhaustive" audits or a full blown penetration test.
This of course makes the auditors jobs much easier as they do not need to spend 20 minutes trying to develop a working audit policy, run it then work out the bugs by reconfiguring the policy as with Nessus.
Audit Function and ReportingWith Nessus, after you've created your policy and finally executed the scan, you are offered a single technical report. Within the report provided by Tenable you'll have cursory overviews of the detected vulnerabilities along with the occasional CVSS score assigned to a vulnerability. From there, you have no other option but to generate your report and start the process or going to your external vulnerability management system, adding all the issues, then beginning the process of addressing the individual vulnerabilities. The actual report are only available to be generated in HTML or the Nessus specific file formats. Nessus used to have a PDF option but they removed it with version 4.x.x.
With Nessus; if you want to re-audit the system(s), you need to repeat the processing of entering the IP or netblock to rescan and assign the policy. Time consuming and slightly annoying.
NeXpose on the other hand, once you enter the IP or netblock information into the UI. The information is stored and you can setup an automated schedule process. With this you can say every 3 months for example, for those PCI-DSS folks out there, re-audit this specific asset. Yes, with NeXpose you can create an asset object.
Once the audit has been completed, the NeXpose console will list out all vulnerabilities discovered. It will also provide you with an overall CVSS score for the entire asset as well as Risk score per system within the asset group. Unlike Nessus you have two reporting options, Technical and Executive. The Executive report offer the high level overview along with graphs, charts and risk levels. The technical reports provides a complete list of all discovered issues, how the issues were discovered along with a step by step on how to resolve the issues.
NeXpose reports are also able ot be customized to the type of vulnerabilities you wish to report, such as "All Vulnerabilities", "Critical Vulnerabilities" or "Critical and Severe Vulnerabilities". Reports are able to be generated in PDF, XML or HTML.
In additional to the exhaustive reporting NeXpose provides, it also gives you the ability to track the issue directly through the NeXpose console. Once an issue has been resolved, you click on the "exclude" image and you are requested to enter why you are excluding the vulnerability. This integrated vulnerability management system makes the analysts life easier as all of the information he/she needs it contained within the single system. The entire life cycle from discovery, verification and resolution all resides on a single webpage.
The other added bonus, NeXpose runs off an integrated postgresql database. If an analyst should so desire, custom reporting can be retrieved from the database as needed.
In closing, if you are a Nessus user. I would strongly urge you to go to the rapid7 website and download NeXpose..kick the wheels and give it a spin. I promise you that you will not be disappointed.
NeXposeNessus
