Installing Nessus on Kali Linux for Robust Vulnerability Management

Nessus Professional is one of the most widely used vulnerability scanners designed to audit IT environments for security flaws that could be exploited in attacks. Organizations rely on Nessus to proactively improve their security posture, meet compliance requirements, and reduce business risk.

In this comprehensive 2600+ word guide, we will cover:

• Key capabilities of Nessus for vulnerability assessment
• Installing the latest version of Nessus on Kali Linux
• Configuring Nessus for an initial Windows server scan
• Scanning a Windows host and analyzing vulnerability findings
• Best practices for using Nessus results to enhance cybersecurity

Let‘s get started.

An In-Depth Look at Nessus and Vulnerability Management

Before we install Nessus itself, it‘s important to understand what vulnerability management is and how Nessus delivers robust scanning capabilities.

Vulnerability Management Overview

Vulnerability management is the practice of proactively finding security weaknesses in IT infrastructure before hackers find and abuse them in cyber attacks. This involves using specialized tools to continuously discover, assess, prioritize, and remediate vulnerabilities.

According to recent reports, the average organization sees over 35,000 vulnerabilities per year. Without a way to efficiently find and manage vulnerabilities at scale, IT teams suffer from alert fatigue and struggle to separate trivial issues vs severe risks. This leads to escaped flaws that turn into data breaches down the road.

Introducing Nessus

Nessus is designed specifically for broad vulnerability assessment, management, and reporting. It features:

• Comprehensive coverage: Over 22,000 built-in vulnerability checks powered by an ever-growing database of plugins coded by research teams. Supports all major operating systems, network devices, web apps, virtualization platforms, IOT systems, and more. Custom plugins can also be developed.

• Internal and external assessment: Scan from inside the network to see what an insider threat could exploit or externally to mimic an outside cyber attack.

• Credentialed vs non-credentialed scanning: Login using supplied credentials to perform deep configuration checks vs unauthenticated scanning to find exposures.

• Prioritization and analysis: Vulnerabilities categorized and ranked by severity and exploitability so you can focus on fixing critical issues first. Remediation guidance provides specific steps.

• Compliance mapping: Scan reports map findings like missing OS patches to compliance requirements like PCI DSS to simplify audits.

• Scalability from tiny to huge environments: Solutions scale from Nessus Professional for small businesses up to Nessus Enterprise for massive Fortune 500 networks with millions of IP addresses.

Next, let‘s break down the different Nessus editions…

Nessus Family Editions

There are 3 primary editions offered by Tenable suited for varying organization sizes:

Edition	Ideal For	Assets Scanned	Price
Nessus Essentials	Small companies	16 IPs	Free
Nessus Professional	Medium businesses	Unlimited IPs	$399/year
Nessus Expert	Large enterprises	Unlimited IPs	$5,790/year

Nessus Essentials is designed for tiny environments to get started with basic vulnerability scanning at no cost.

Nessus Professional offers custom assessment, compliance auditing, malware detection, credentialed patching, and more to meet the needs of most small/medium businesses.

Nessus Expert caters to large complex networks with smart scan performance, virtualization assessment, software asset management, and other enterprise-grade capabilities.

For purposes of this demo, we will leverage the free Nessus Essentials to highlight the installation and configuration workflow – which applies similarly across all Nessus editions.

Now let‘s get Nessus up and running on Kali Linux!

Step-by-Step Installation of Nessus on Kali

Kali Linux makes an ideal platform to install security tools like Nessus thanks to its penetration testing focus and included toolkits. Let‘s walk through the quick install process:

Prerequisites

• Kali Linux workstation with admin access
• Account created at Tenable.com to get Nessus activation code
• Downloaded Nessus .deb installer package (ensure correct architecture)

Installation Steps

1. Open a terminal with admin privileges

2. Install the Nessus .deb package:

sudo dpkg -i Nessus-8.15.0-es7.debian6_amd64.deb

3. Start Nessus daemon:

sudo systemctl start nessusd 

4. Verify Nessus service is running:

sudo systemctl status nessusd

5. Browse to the Nessus web interface at https://kali:8834

6. Accept the SSL warning

7. Enter Nessus activation code

8. Create an admin user account

Once finished, Nessus is installed and ready for configuration!

Understanding the Nessus Architecture

Now that we have Nessus up and running, it‘s useful to understand how Nessus works under the hood and what happens during a network vulnerability scan.

As seen above, Nessus has servers running the main application logic along with agents that get deployed to target machines for local scanning. Some key components include:

• Nessus plugins – The core of Nessus‘s assessment capabilities come via plugins. These are small scripts that check for a specific CVE, misconfiguration issue, or platform vulnerability. The Tenable Research team codes thousands of plugins covering all major technologies.

• Scan Engine – This engine handles deploying plugins based on the scan policy, managing plugin dependencies, controlling target connections, and optimizing overall scan efficiency. Advanced templates customize which plugins are leveraged.

• Analysis Engine – Responsible for taking raw scan results, looking at plugin behavior history, checking for false positives, and assigning an accurate vulnerability severity rating. Greatly cuts down false alarms.

• Reporting Engine – Constructs the vulnerability reports by assessing the findings and building the graphs, charts, risk scoring, remediation text, compliance mapping, and other reporting features.

This simplified architecture gives you an idea of what‘s happening behind the scenes during a typical Nessus scan. Next let‘s configure Nessus for scanning…

Configuring Nessus for Effective Windows Server Scanning

While Nessus ships with default scanning policies, we need to customize the settings for our specific target – an internet-facing Windows 2008 R2 server.

Here are smart configurations for an effective Windows scan:

Discovery Tab

• Disable "Scan localhost" to omit scanning Nessus host
• Enable "Ping host" to detect if Windows box is up before scanning
• Enable "NetBIOS" discovery to populate Windows hostname

Assessment Tab

• Enable "WinRM" plugin to allow WMI-based checks
• Enable "SMB" plugin for critical Windows file share auditing

Credentials

• Supply domain admin credentials to enable credentialed scanning of Windows box for deeper visibility

Plugins Tab

• Select "Patch management" and "Windows" plugin families
• Disable all other plugin families to optimize scan speed

Scheduling

• Schedule weekly scans to maintain continuous awareness of vulnerabilities

This displays just a sample of key configurations to improve scan efficiency and Windows coverage.

Now let‘s look at running Nessus scans.

Scanning a Windows Server and Interpreting Results

With prep work complete, it‘s time to execute Nessus vulnerability scans against our Windows asset.

Scanning Steps

1. Login to the Nessus web interface

2. Create a new scan

3. Specify Windows server IP address

4. Select optimized Windows scan policy

5. Click launch scan

6. Nessus performs host discovery → Port scanning → OS fingerprinting → Vulnerability detection powered by selected plugins

7. View server dashboard for high-level overview of findings

Analyzing Scan Results

Key aspects of reporting:

• Vulnerabilities – List of all security flaws found like missing OS patches ranked by severity

• Compliance – Maps findings like vulnerable software to compliance requirements to simplify audits

• Hosts – Summary of vulnerabilities, exposures, and scan details for each assessed asset

• Remediation – Detailed remediation instructions outlining fix steps for each vulnerability instance

• Export – Flexible export options including PDF, CSV, JUnit XML, and more

Leveraging the vulnerability scan results, we can construct a prioritized action plan for patching the most severe risks first.

Now let‘s examine some best practices for an effective vulnerability management program with Nessus.

Best Practices for Managing Vulnerabilities at Scale

While installing Nessus and running occasional scans is valuable, getting the most out of vulnerability management requires some key reliability, scalability, and governance best practices:

Reliability & Uptime

• Build Nessus server redundancy into the architecture
• Set up failover Nessus scanning nodes across geographic regions
• Design continuous security monitoring to run scans 24/7

Scalability & Performance

• Tune Nessus performance through optimized policies to limit unnecessary plugins
• Leverage Nessus agents for more efficient large-scale scanning
• Take advantage of scan throttling, bandwidth limiting and performance analysis

Accuracy & Noise Reduction

• Custom build targeted scan policies aligned to asset types
• Configure offline plugin updates to enhance vulnerability intelligence
• Fine tune scans policies to reduce false positives based on past scan data

Reporting & Metrics

• Establish KPIs to track vulnerability backlog, surface critical risks, and measure mean time to remediate

Following these vulnerability management guidelines will help maximize value from Nessus deployments large and small.

Conclusion

In this comprehensive 2600+ word guide, we took an in-depth look at Nessus Professional for robust vulnerability auditing including:

• Reviewing Nessus editions, features, architecture to see what powers its scanning capabilities

• Walking through installing the latest version of Nessus on Kali Linux

• Tailoring Nessus configuration for an optimal Windows server scan

• Evaluating vulnerability scan findings and using results to enhance security

While no silver bullet in security, Nessus offers continuous assessment of IT environments for risks – providing the visibility needed to proactively identify and close security gaps before they get exploited in attacks.

By leveraging Nessus vulnerability scanning as part of layered cybersecurity approach, organizations can cost-effectively harden their security posture both internally and externally facing.