Tenable announces the end of the Nessus Registered Feed

Tenable has announced(PDF) that their Registered Feed for Nessus users will be discontinued. Organizations that relied on the plugin feed, despite the delay from their commercial Direct Feed will no longer receive updates for free. The Direct Feed subscription remains reasonably priced at $1200 a year, and Tenable is offering a discount during the transition.

Tenable also notes in their release that they will support teaching and training organizations, as well as charity with free Direct Feeds, which should mean that at least some of the groups that were using the registered feed will not lose their access. For most others, it means a yearly cost to continue using Nessus.

Interestingly, home users using Nessus for personal, non-commercial use will get access to a new "HomeFeed" service with no delay for plugin availability. That leaves Tenable a gateway for users to learn how to use Nessus, while forcing organizations that relied on the free feed to pay for a license.

A FAQ is available with more detail.

Freebie: Qualys FreeScan

Qualys offers a free sample scan of a single public facing IP using their QualysGuard software as a service vulnerability scanner. It's worth a try if you're looking at vulnerability scanning products, and is an easy way to take a look at a machine using a commercial scanner.

You can sign up here for a 14 day trial - they'll want to sell you their product, of course:

http://www.qualys.com/forms/?lsid=7

An alternate option is their single IP Freescan:

http://www.qualys.com/forms/?lsid=7002

Qualys provides two related, and quite useful products - PCI scanning, and general vulnerability scanning. Their software as a service approach is different than many, although more companies are adopting it, and it is useful, as it cuts out system and software maintenance costs, and makes scaling easy by simply adding small appliances. You can literally throw a scanner in your briefcase, plug it into a network with outbound network access, and use it. That's pretty neat, particularly for auditors. I really like the ability to have a scanner that doesn't require system hardware and software maintenance. The entirety of the support for the devices is either the Dogbert solution (shut up and reboot!), or having Qualys drop ship you a new one if something fails.

The current implementation does have limitations as you scale up - their hierarchical user and system management definitely needs work, but in my experience, it is one of the best vulnerability scanner systems I've used. Better, system administrators and security operations staffers that I work with have generally found it easier to use, and of course easier to maintain than open source products.

The real gotcha? Qualys prices their product at the high end of the range. That's a hard pill to swallow in small and mid-size environments, but may be justifiable in larger organizations. If you are already using Qualys, their PCI compliance scans are quite reasonable, and may help to allay the cost.