Perimeter
6/1/2017
10:05 AM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Tenable Delivers Vulnerability Management Platform to Unify IT and OT Security

Expanded Tenable.io platform incorporates Nessus Network Monitor alongside new container and web application security products for discovery and vulnerability management of operational technology assets, including ICS/SCADA.

COLUMBIA, Md. (June 1, 2017) — Tenable Network Security®, Inc., a global leader in cybersecurity, today announced the latest release of its cloud-based Tenable.io™ platform, delivering new and enhanced capabilities to empower organizations to understand and reduce their cyber risk across the full range of traditional and modern assets.

Modern computing and software development practices are driving the adoption of a new set of dynamic IT assets, including cloud, microservices and containers. The rapid pace of innovation has created a rapidly changing attack surface, with DevOps teams in the driver’s seat and security as an afterthought. On the other end of the spectrum are Operational Technology (OT) assets, including industrial control systems (ICS) and supervisory control and data acquisition (SCADA). These safety-critical systems were designed for precision and reliability, not built with security in mind.

OT assets, coupled with the rise of the internet of things (IoT) where everything from pacemakers to automobiles are now connected devices, have exploded the attack surface to a point beyond control. Organizations need a way to discover all of these assets and manage vulnerabilities holistically, yet have been forced to use legacy scanning and agent-based tools designed for the world of traditional IT. These old approaches do not fit in the modern world of IT, or the world of OT and IoT where a non-intrusive approach to asset discovery and vulnerability detection is required.

“Massive shifts in computing have left enterprises struggling to gain visibility into their exposure areas. The rise of IoT and the convergence of IT and OT are only compounding the issue,” said Dave Cole, chief product officer at Tenable. “The vulnerability management tools of yesterday are falling short in providing CISOs with a complete and reliable view of the entire modern attack surface so they can take a proactive approach to managing the security challenges of today and tomorrow.”

With Tenable.io, for the first time organizations have complete and centralized visibility over the full range of traditional and modern assets. Powered by Nessus sensors and third party data collection technologies, Tenable.io provides the industry’s greatest breadth and sophistication of asset discovery and vulnerability identification across the entire elastic attack surface - spanning IT, cloud, OT and IoT - all within a single platform. Only Tenable.io arms security teams and chief information security officers (CISOs) with the visibility required to understand cyber risk across the entire attack surface at the pace of innovation and digital transformation.

New and Enhanced Capabilities of the Tenable.io Platform:

General Availability of Tenable.io Container Security

Tenable.io Container Security seamlessly and securely enables DevOps processes by providing visibility into the security of container images as they are created. Through integration with the container build process, it provides vulnerability assessment, malware detection and policy enforcement prior to container deployment — enabling security teams to turn a blind spot into a strength. Request a free trial of Tenable.io Container Security.

Nessus Network Monitor Support for IT, OT and IoT Assets

Nessus Network Monitor (formerly Passive Vulnerability Scanner or PVS) passively analyzes network traffic to provide continuous visibility into managed and unmanaged assets on the network, including IT, OT and IoT assets.It includes new capabilities for asset discovery and vulnerability identification on critical infrastructure and embedded systems, such as ICS and SCADA systems, which require a non-intrusive approach to vulnerability management. Nessus Network Monitor provides coverage for operational technologies in a variety of safety-critical infrastructure industries, including oil and gas, energy, utilities, public infrastructure, manufacturing, and medical/healthcare. Supported protocols include Bacnet, CIP, DNP3, Ethernet/IP, Modbus/TCP, Siemens S7, ICCP, IEC 60870-5-104, IEEE C37.118, OpenSCADA, and more. Request a free trial of Nessus Network Monitor.

Shadow Brokers, WannaCry and Intel AMT Scan Policy Templates

Tenable.io includes pre-built scan templates for identifying systems exposed to all Shadow Brokers exploits, including WannaCry, EternalRocks and any new versions of these attacks, as well as a check for the recent Intel AMT vulnerability (INTEL-SA-00075). Take control of your network and protect against these and future threats with a free 60-day trial of Tenable.io Vulnerability Management at https://www.tenable.com/products/tenable-io/vulnerability-management/evaluate.

Tenable.io Web Application Scanning

Tenable.io Web Application Scanning, a new product within the Tenable.io platform that safely and automatically scans web applications to accurately identify vulnerabilities, will be generally available on July 14, 2017. To learn more, visit tenable.com/products/tenable-io/web-application-scanning.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
5 Reasons the Cybersecurity Labor Shortfall Won't End Soon
Steve Morgan, Founder & CEO, Cybersecurity Ventures,  12/11/2017
Oracle Product Rollout Underscores Need for Trust in the Cloud
Kelly Sheridan, Associate Editor, Dark Reading,  12/11/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Gee, these virtual reality goggles work great!!! 
Current Issue
The Year in Security: 2017
A look at the biggest news stories (so far) of 2017 that shaped the cybersecurity landscape -- from Russian hacking, ransomware's coming-out party, and voting machine vulnerabilities to the massive data breach of credit-monitoring firm Equifax.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.