cyber-security-nessus's Introduction

Cyber Security Nessus

This repo holds the infrastructure to support cyber security's Nessus instance. Nessus is a vulnerability scanner which we have set up to scan specified government domains on a daily schedule.

Architecture

This infrastructure can broadly be broken down into the following steps:

Nessus is set up on an EC2 instance, and scans the specified domains daily.
Each day, a lambda will take the generated scans from Nessus and send them forward to cloudwatch
Using the centralised-security-logging-service, these cloudwatch logs are then forwarded onto splunk, where they can be queried under index nessus_scans

See below for a diagram of the architecture.

Deployment details

Merges to master will trigger a deploy in Concourse.

This deploys to account 676218256630 in region eu-west-2

Prerequisites

Before contributing to this project for the first time, you will need to install pipenv and create an environment for this repo:

pip install pipenv
pipenv install --dev
cd cyber-security-nessus
pipenv shell

This will install all dev dependencies listed in Pipfile.

Tests

Tests are run as part of the concourse deployment, however if you want to run the tests manually, you need to use AWS credentials. The easiest was to do this is with aws-vault:

run the tests in the root of the project with

aws-vault exec {vulnerability-account} -- pipenv run pytest

Adding a new scan

In order to schedule a new scan, you will need to add the scan details to scan.toml. Here you can configure scan schedule and domain. Information on how to do this can be found in this file.

This change is deployed by the Concourse pipeline on a merge to master.

Resources

Documentation for the Nessus API can be found on the Nessus server itself: https://nessus.gds-cyber-security.digital/api#/overview (Must connect over VPN)
tests are mocked with vcrpy

cyber-security-nessus's People