Renaud Deraison The Nessus Project Reducing the Costs of Vulnerability Assessment
0Nessus checks both hardware and software for known vulnerabilities. It watches running processes for abnormal behavior and it also monitors network traffic patterns. Nessus is a sort of firewall/antivirus system, but not quite. Although it has remediation procedures, it isn’t as comprehensive in the solutions section as a typical endpoint protection system would be.
Tenable, Inc began operations in 2002, but Nessus is much older than that. How can a product be older than the company that developed it? The Nessus system was developed by an individual, Renaud Deraison and first released in 1998. At the time, Deraison was 17. He set Nessus up as an open-source project and lead the community development of the software part-time while pursuing a career in IT during the day.
Controversially, Deraison set up Tenable Network Security to manage the commercial possibility of the Nessus software. Although the development project was community-driven, Deraison owned the copyright of the software. When Nessus 3 was released, the open-source project closed down, taking Nessus fully into the business as a proprietary system. Earlier versions are still available under GNU General Public licenses.
The availability of the source code for Nessus 2 led to the creation of forks, providing rivals to the Nessus system. However, with Nessus, Deraison invented the concept of ‘remote vulnerability scanners’. It went from being the only vulnerability scanner in the world to the leading vulnerability scanner. The move to proprietary ownership prevented Nessus from being completely crowded out by re-labeled copies of its own code.
Tenable is relaxed about the continued existence of the Nessus 2 code and the presence of near copies in the market. Under the GNU licensing system, those copies can’t be sold commercially, only given away. By investing in developing Nessus privately, Tenable has ensured that it keeps ahead of its rivals, both free and paid.
Nessus 3 is a considerable advancement to the previous versions and the hobbyists that produced forks of the code don’t have the resources to fully compete with Tenable.
Black Hat - USA - 2001 Hacking conference
#hacking, #hackers, #infosec, #opsec, #IT, #nessus