Tenable extends Nessus to perform SQL database configuration auditing

Tenable Network Security announced a new capability for Nessus users to audit the configuration of many different SQL databases. These checks are only available to Security Center users and ProfessionalFeed subscribers.

Originally designed as a network vulnerability scanner, Nessus already scans for known security vulnerabilities. Nessus’ capabilities have been extended to conduct agent-less patch audits, system configuration analysis against industry best practices, auditing of applications such as web servers and anti-virus installations and being able to audit hard drives for personally identifiable information (such as credit card numbers and social security numbers), copy written content, and other financial or confidential information.

The new database auditing capability continues to add value to Nessus for a wide variety of corporate enterprise auditors and security consultants. The ability to perform a full security audit of the underlying operating system as well as the SQL database configuration can ensure that applications have taken every measure to prevent data loss from SQL injection attacks, direct attacks on the database and inadvertent internal access to sensitive data.

The new capability of Nessus includes support for auditing Oracle, MS SQL, MySQL and many others, as well as SQL audit polices based on the Center for Internet Security and the Defense Information Systems Agency “STIGs.”