Re: Automatic remediatio​n using Nexpose

[Curt Purdy <infosysec () gmail com>]

Agree with Altiris for patching, that is what we use, and it is not
just for Symantec houses as they were a kick-ass solution long before
Symantec bought them. But you do have to dedicate some resources as it
is a full IT management architecture / infrastructure if you deploy
the full system. And it looks like they are looking for the easy way
out / low-manpower automated system. Been looking for that for 25
years now, let me know if you find it...

Curt Purdy CISSP GSNA GSEC MCSE+I CCNA
infosysec () gmail com
purdy () tecman com



On Tue, Oct 4, 2011 at 1:04 PM, Todd Haverkos <infosec () haverkos com> wrote:
> coenemichel () gmail com writes:
>
> > Hello all,
> >
> >
> >
> > We arecurrently testing the Nexpose software. The main problem with
> > this software isthat there is no automatic remediation. Is there
> > anyone that uses/knowssoftware by which we can automatically deploy
> > patches to our workstations/server using the report coming from
> > Nexpose.
>
> If your focus is on remediation of missing patches both OS vendor and
> third party, you might be happier with broader scope systems
> management tools like BigFix or LANDesk products for vuln/patch, or if
> you're a Symantec shop, looking at the related Altiris branch of
> products.
>
> Pure vulnerability assessment/vulnerability management tools like
> Nexpose, Tenable Nessus and Security center,  Qualys and the like are
> more focused on detecting and reporting vulns, and don't do anything
> with respect to automated remediation.  At least not without glue that
> I'm not aware of or haven't seen.
>
> Best Regards,
> --
> Todd Haverkos, LPT MsCompE
> http://haverkos.com/
>
> ------------------------------------------------------------------------
> Securing Apache Web Server with thawte Digital Certificate
> In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, 
> how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, 
> purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for 
> set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital 
> certificates.
>
> http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
> ------------------------------------------------------------------------

------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------