| name | scanning-infrastructure-with-nessus |
| description | Tenable Nessus is the industry-leading vulnerability scanner used to identify security weaknesses across network infrastructure including servers, workstations, network devices, and operating systems. |
| domain | cybersecurity |
| subdomain | vulnerability-management |
| tags | ["vulnerability-management","cve","nessus","tenable","infrastructure-scanning","risk"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"] |
Scanning Infrastructure with Nessus
Overview
Tenable Nessus is the industry-leading vulnerability scanner used to identify security weaknesses across network infrastructure including servers, workstations, network devices, and operating systems. This skill covers configuring scan policies, running authenticated and unauthenticated scans, interpreting results, and integrating Nessus into continuous vulnerability management workflows.
When to Use
- When conducting security assessments that involve scanning infrastructure with nessus
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing
Detection Gaps & Validation
- Unauthenticated-only scans — miss 45-60% of vulns. Validate credentials with plugin 19506 (Scan Information) showing authenticated checks ran.
- Host discovery gaps — hosts not answering the ping method are skipped. Validate the scanned-host count against the expected target range.
- Excluded fragile systems — SCADA/medical exclusions become blind spots; validate they're covered by a safe policy rather than dropped.
- Stale plugins — validate plugins updated before each scan so recent CVEs are tested.
- Plugin tuning false positives — validate critical findings manually before escalating.
- Network reachability — firewall rules between scanner and target cause silent misses; validate connectivity to management ports first.
Prerequisites
- Nessus Professional or Essentials license installed and activated
- Network access to target systems (firewall rules allowing scanner IP)
- Administrative credentials for authenticated scanning
- Understanding of TCP/IP networking and common services
- Written authorization for scanning target environments
Core Concepts
Nessus Architecture
Nessus operates as a client-server application where the Nessus scanner engine runs as a service (nessusd) on the host system. It uses a plugin-based architecture with over 200,000 plugins updated weekly by Tenable's research team. Each plugin tests for a specific vulnerability, misconfiguration, or compliance check.
Scan Types
- Host Discovery - Identifies live hosts using ICMP, TCP, UDP, and ARP
- Basic Network Scan - Default policy covering common vulnerabilities
- Advanced Scan - Custom policy with granular plugin selection
