0

Is it possible to scan laptops of users who are not on your network (e.g., consultants) before giving them access to resources?

Can you also explain the reasoning behind why/why not?

schroeder
  • 123,438
  • 55
  • 284
  • 319
mks5251
  • 11
  • 1
  • Consider revising as to what you're scanning for. Are you just trying to scan with Nesuss like a normal vuln scan? Are you looking for a virus/AV scan? In either case, it's quite possible, provided they're willing. I would say any reasonable security consultant would understand your reasoning for this and comply rather quickly. – SomeGuy Jan 09 '19 at 20:41
  • Yes - I wanted to do a normal vuln scan using Nessus Pro. I was not sure since they were not on our domain/network if I would be able to reach them. I assumed I would also need local admin creds to their computers in order to get good results back? I hope that makes sense. Thanks for your input. – mks5251 Jan 29 '19 at 15:30

2 Answers2

1

This is obviously product dependent. Our team recently invested in Tenable, specifically their new .IO (it's kind of a work in progress...).

They provide an agent you can deploy to a machine (your owned asset or contractor machine). Anytime the workstation pops online it will receive scan parameters and report results up to the cloud (.IO instance) for you to review.

This is used for vulnerability management (port scans, CVE / CWE, software enumeration, local account enumeration etc.).

I'm sure other vendors provide very similar solutions.

schroeder
  • 123,438
  • 55
  • 284
  • 319
Mr.J
  • 23
  • 5
0

Nessus agents also work with on-prem Nessus Manager running on either Windows or their Tenable Core VM. The agent scans can also synch with Tenable.sc on -prem as well and import scan results for more advanced reporting and analytics in a single pane of glass.

Lee
  • 31
  • 1
  • 6
  • 1
    So, get the laptops to install a Nessus agent, scan locally and send in the report? So basically, what MrJ said 2.5 years ago? – schroeder Jul 08 '21 at 14:22