conversations.from: human
conversations.value: Do you know a description for a book titled Learning Nessus for Penetration Testing about Information, Security, Vulnerability with the genre: Computers & Technology, Networking & Cloud Computing?
conversations.from: assistant
conversations.value: the author the author is a very passionate security specialist with multiple years of experience as a security researcher. He has handson experience in almost all domains of Information Security specializing in Vulnerability Assessment and penetration testing. He enjoys writing scripts to exploit vulnerabilities. He is active on different security forums, such as webappsec and security focus where he loves responding to different security problems.
conversations.from: human
conversations.value: Do you know the first paragraph for this book?
conversations.from: assistant
conversations.value: Learning Nessus for Penetration Testing
  Penetration Testing has an additional step for vulnerability assessment, exploiting the vulnerabilities. Penetration Testing is an intrusive test, where the personnel doing the penetration test will first do a vulnerability assessment to identify the vulnerabilities, and as a next step, will try to penetrate the system by exploiting the identified vulnerabilities.
conversations.from: human
conversations.value: Do you know three more paragraphs?
conversations.from: assistant
conversations.value: These settings can be chosen by the person creating the scan policy depending on the target system's requirement. For example, if you plan to scan a database then while creating the policy, select **Database Settings** from the **Preferences** drop-down menu. This particular setting allows you to key in database details with the database credentials to probe the database further. This will allow your Nessus scan to discover more vulnerability.
  I recommend the Nessus website, <http://www.tenable.com>, for the latest settings and their explanations.
  A sequential reading of this chapter is required for readers before jumping into this section. In the previous sections, we have explained the prerequisites one should take care of before running a scan. Also, it has been discussed how a scan policy should be configured and customized as per the target organizations security policy and what the differences are between a credential and a noncredential scan.
conversations.from: human
conversations.value: Do you know the last five paragraphs? End with the sentence ' Appropriate credentials of the underlying infrastructure on which a compliance audit is being performed need to be updated in the tool.'.
conversations.from: assistant
conversations.value: Nessus can also check compliance of the different databases against security policies. Databases that are supported include MS SQL, Oracle, MySQL PostgreSQL, IBM DB2, and Informix/DRDA. To ensure the completeness of a report, the account used to log in to the database should have an SYSDBA or SA permission. Database compliance check plugins typically use `SELECT` queries to fetch security configurations from the database. Following are few examples:
  The VMware vCenter/vSphere Compliance Check plugin uses the VMware SOAP API to audit ESX VMware, ESXi, and vCenter/vSphere virtualization software. Credential information to conduct an audit can be added to **VMware vCenter SOAP API Settings** in the **Advanced** section of a policy. Examples include the following:
  Some other platforms that are included in Nessus's compliance check options include the following (please cross-check the updated documentation on Tenable's official website, <https://support.tenable.com/>) A few sections of this chapter has been referenced from learning material available on Nessus website <http://www.tenable.com>:
  Nessus provides options of doing automated compliance checks using the tool, apart from vulnerability scanning. Using this option, it can be cross-checked whether the secure configuration settings of the infrastructure such as servers, network devices, and databases are in compliance with the defined policy or best practices an organization is following. A compliance requirement is also derived from different compliance standards adhered to by an organization. This feature is available to professional feed subscribers.
  The **Policy Compliance** plugin family is available for compliance check scanning. The plugin family includes, but is not limited to, servers, network devices, and standards such as PCI DSS. The Nessus **Results** tab also offers a **Compliance** option while saving the output to specifically generate a compliance report. These compliance checks can be modified by using the`.audit` files. Appropriate credentials of the underlying infrastructure on which a compliance audit is being performed need to be updated in the tool.