-: Scanning sensitivity.
So, when we talk about the scanning sensitivity level,
we're really gonna talk about choosing
what the appropriate level is for our objectives.
You can see here this is a Nessus scan,
and you see where I have it circled in red,
it says, "Safe Checks."
Now, what Safe Checks does is if it is checked,
it will not allow an unsafe check to occur on a server.
Now, what is an unsafe check?
Well, sometimes when you're scanning
for these vulnerabilities, you have the chance
of knocking a service or a server offline,
because it probes that vulnerability
and that can actually cause it to fail.
So, if that happens, you'd lose,
your production server would go down,
and that would cause a loss of business.
So, you don't want to do that on production servers,
and therefore, we can do a safe scan
where it doesn't choose those particular dangerous
vulnerability scans, and it'll only scan the safe ones.
So, that's a sensitivity level.
We're talking about how much risk,
again, are you willing to accept?
If it's midnight and you don't need 24 hour operations,
maybe you'll turn that off, but again,
it's something you're gonna have to choose
based on your organizational policy.
We can also look at the plug-ins.
The plug-ins are what provide the scan functionality
for those different functions, and each of those
plug-ins contains hundreds of vulnerabilities
that it's gonna scan for.
You can enable them or disable them based on your needs,
and if it's a Linux system,
you're gonna disable the Windows plug-ins.
If it's a Windows system,
you're gonna disable the Linux plug-in,
because there's no sense in wasting the time and effort
of scanning for something that can't
possibly exist on that system.
So, some scans will disrupt your systems,
and they can cause loss of data,
or loss of the server itself, like we talked about.
But if you use that safe scan, it's gonna protect you
from that, so you need to ensure that you are doing it
safely and with permission if you're gonna
uncheck your safe scan option.
Now, when we look at plug-ins,
here's another example from Nessus.
You can see I have highlighted the Windows,
and they're green.
All of those plug-ins,
all of those vulnerabilities, are gonna be tested.
I can then click the disabled plug-in button,
and those would turn off if I don't want those
Windows plug-ins to be scanned.
Again, I'll show you this in a walkthrough
in a couple of videos, once we finish talking about
the specifics of this tool as we walk through this,
in live action, of how to use the Nessus scanner.
You can also create a template for scans.
So, it's very common that we run the same scans
over and over and over again.
For instance, if you have to do PCI-DSS compliance,
you might create a template for that,
and that is gonna be the scan
that you do every quarter, right?
Vendors can provide you templates for the scans,
or you can create your own.
For instance, in Nessus, it comes, by default,
with an internal scan, an external scan, a PCI-DSS scan.
Admins can create their own template
and then other admins can use those as well.
This is gonna prevent errors
and save you time in the long run.
So, I highly recommend using templates,
because most of the time, you're scanning
the exact same systems the same way
every single week, and that's the whole benefit
of doing this vulnerability management.
Here's an example of what the templates look like.
As you can see here, I have a web app test one,
I have a PCI-DSS one, an internal scan,
and an external scan.
These were all created by Tenable,
the owner of Nessus, and I can use them on my systems
just by clicking them and then telling them to run.
That's the idea here, with scanning sensitivity.
It's a quick overview.
I'll see you in the next lesson.
(logo buzzes)