Vulnerability scanning tools (Nessus, OpenVAS) in Cybersecurity - Mini Project: Build & Apply

Understanding Vulnerability Scanning Tools: Nessus and OpenVAS

📖 Scenario: You are a cybersecurity analyst preparing to scan a small network for security weaknesses. You want to organize information about two popular vulnerability scanning tools: Nessus and OpenVAS.

🎯 Goal: Create a simple Python dictionary to store details about Nessus and OpenVAS, add a configuration setting for scan depth, filter tools based on scan depth capability, and finalize the data structure for reporting.

📋 What You'll Learn

Create a dictionary named tools with exact entries for Nessus and OpenVAS

Add a variable min_scan_depth to set the minimum scan depth threshold

Use a dictionary comprehension to select tools with scan depth greater than or equal to min_scan_depth

Add a final key selected_tools to the dictionary with the filtered tools

💡 Why This Matters

🌍 Real World

Cybersecurity analysts use vulnerability scanning tools like Nessus and OpenVAS to find security weaknesses in networks. Organizing tool information helps in choosing the right scanner for specific needs.

💼 Career

Understanding how to manage and filter tool data is useful for cybersecurity roles that involve vulnerability assessment and tool selection.

1

Create the initial tools dictionary

Create a dictionary called tools with these exact entries: 'Nessus': {'scan_depth': 5, 'license': 'commercial'} and 'OpenVAS': {'scan_depth': 4, 'license': 'open-source'}.

Cybersecurity

# Create the tools dictionary with Nessus and OpenVAS details
# Your code here

Hint

Use a dictionary with tool names as keys and another dictionary for their properties.

2

Add a minimum scan depth configuration

Add a variable called min_scan_depth and set it to 5 to represent the minimum scan depth required for selecting tools.

Cybersecurity

tools = {
    'Nessus': {'scan_depth': 5, 'license': 'commercial'},
    'OpenVAS': {'scan_depth': 4, 'license': 'open-source'}
}
# Set the minimum scan depth threshold
# Your code here

Hint

Just create a variable with the exact name and value.

3

Filter tools by minimum scan depth

Create a dictionary called filtered_tools using dictionary comprehension that includes only tools from tools where the scan_depth is greater than or equal to min_scan_depth.

Cybersecurity

tools = {
    'Nessus': {'scan_depth': 5, 'license': 'commercial'},
    'OpenVAS': {'scan_depth': 4, 'license': 'open-source'}
}
min_scan_depth = 5
# Filter tools by scan depth
# Your code here

Hint

Use dictionary comprehension with for name, info in tools.items() and a condition on info['scan_depth'].

4

Add filtered tools to the main dictionary

Add a new key 'selected_tools' to the tools dictionary and assign it the value of filtered_tools.

Cybersecurity

tools = {
    'Nessus': {'scan_depth': 5, 'license': 'commercial'},
    'OpenVAS': {'scan_depth': 4, 'license': 'open-source'}
}
min_scan_depth = 5
filtered_tools = {name: info for name, info in tools.items() if info['scan_depth'] >= min_scan_depth}
# Add selected_tools key to tools dictionary
# Your code here

Hint

Assign filtered_tools to tools['selected_tools'].

Practice

1. What is the main purpose of vulnerability scanning tools like Nessus and OpenVAS?

easy

A. To create new software applications

B. To automatically find security weaknesses in systems

C. To manage user accounts and passwords

D. To encrypt data for secure communication

Solution

1. Step 1: Understand the role of vulnerability scanning tools

   These tools scan computer systems to find security weaknesses automatically.

2. Step 2: Compare options with the tool's purpose

   Only To automatically find security weaknesses in systems describes finding security weaknesses, which matches the tool's main function.

3. Final Answer:

   To automatically find security weaknesses in systems -> Option B

4. Quick Check:

   Vulnerability scanning = find security weaknesses [OK]

Hint: Remember: scanning tools find weaknesses automatically [OK]

Common Mistakes:

• Confusing scanning tools with software development tools
• Thinking they manage user accounts
• Assuming they encrypt data

2. Which of the following commands correctly starts a scan using Nessus from the command line?

easy

A. nessuscli scan start

B. openvas --launch

C. scan nessus begin

D. nessus --start-scan

Solution

1. Step 1: Identify correct command syntax for Nessus CLI

   Nessus uses the command line tool nessuscli with subcommands like scan start to begin scans.

2. Step 2: Check each option

   nessuscli scan start matches the correct syntax. Options A, B, and C are incorrect commands. openvas --launch is for OpenVAS, not Nessus.

3. Final Answer:

   nessuscli scan start -> Option A

4. Quick Check:

   Nessus CLI uses 'nessuscli scan start' [OK]

Hint: Nessus CLI commands start with 'nessuscli' [OK]

Common Mistakes:

• Mixing OpenVAS commands with Nessus
• Using incorrect command order
• Assuming simple flags like '--start-scan' work

3. Consider this simplified output snippet from an OpenVAS scan report:

Host: 192.168.1.10
Vulnerabilities found: 3
 - CVE-2021-1234: High
 - CVE-2020-5678: Medium
 - CVE-2019-0001: Low

What does this output tell you?

medium

A. The scan failed to complete on the host

B. The scan found no vulnerabilities on the host

C. The host is fully secure with no risks

D. The host has three security issues with different severity levels

Solution

1. Step 1: Read the scan report details

   The report lists three vulnerabilities found on the host with severity levels High, Medium, and Low.

2. Step 2: Interpret the meaning of vulnerabilities found

   Since vulnerabilities are listed, the host has security issues. It is not fully secure or failed scan.

3. Final Answer:

   The host has three security issues with different severity levels -> Option D

4. Quick Check:

   Vulnerabilities listed = security issues found [OK]

Hint: Vulnerabilities listed means issues found [OK]

Common Mistakes:

• Ignoring the vulnerability count
• Assuming no vulnerabilities means secure
• Confusing scan failure with vulnerabilities

4. You run an OpenVAS scan but get no results even though you know vulnerabilities exist. Which of these is the most likely cause?

medium

A. The target system is offline

B. OpenVAS does not detect vulnerabilities

C. The scan was run without proper credentials or permissions

D. The scan tool is outdated but still shows results

Solution

1. Step 1: Analyze why no results appear despite known vulnerabilities

   Without proper credentials or permissions, OpenVAS cannot access detailed info to find vulnerabilities.

2. Step 2: Evaluate other options

   OpenVAS does not detect vulnerabilities is false; OpenVAS detects vulnerabilities. The target system is offline would cause scan failure, not empty results. The scan tool is outdated but still shows results contradicts showing results.

3. Final Answer:

   The scan was run without proper credentials or permissions -> Option C

4. Quick Check:

   Missing credentials = no vulnerability data [OK]

Hint: No results often mean missing permissions [OK]

Common Mistakes:

• Assuming OpenVAS never detects vulnerabilities
• Confusing offline system with empty results
• Ignoring credential requirements

5. You want to schedule regular vulnerability scans on your network using Nessus. Which approach best ensures continuous security monitoring?

hard

A. Set up automated scheduled scans with email alerts for new vulnerabilities

B. Run manual scans only when a security breach is suspected

C. Disable scans to avoid network slowdowns

D. Scan only once a year during audits

Solution

1. Step 1: Understand best practices for vulnerability scanning

   Regular automated scans with alerts help detect new issues early and maintain security.

2. Step 2: Compare options for continuous monitoring

   Set up automated scheduled scans with email alerts for new vulnerabilities supports continuous monitoring. Options B, C, and D delay detection or reduce security.

3. Final Answer:

   Set up automated scheduled scans with email alerts for new vulnerabilities -> Option A

4. Quick Check:

   Automated scheduled scans = continuous security [OK]

Hint: Automate scans with alerts for best security [OK]

Common Mistakes:

• Waiting for breaches before scanning
• Disabling scans to save resources
• Scanning only during audits