Guide: "How To Use OpenVAS to Audit the Security of Remote Systems on Ubuntu 12.04" (Digital Ocean) Guide: "Getting Started with OpenVAS" (Backtrack Linux) Guide: "Setup and Start OpenVAS" (OpenVAS) Video Guide: "Setting up OpenVAS on Kali Linux" (YouTube) ListServ: "OpenVAS Discussion ListServ" (OpenVAS) Comparison: "Nessus, OpenVAS and Nexpose VS Metasploitable" (HackerTarget) ACTIVITIES VULNERABILITY SCANNING Summary While much of SAFETAG focuses on digital security challenges within and around the office, remote attacks on the organization's website, extranets, and unintended information available from "open sources" all pose real threats and deserve significant attention. SAFETAG takes great care to take a very passive approach to this work, especially when done off-site, so as not to have unintended consequences on the organization's infrastructure or undermine operational security concerns. This activity uses active research and scanning to detect known vulnerabilities in external and key internal services. Usually penetration tests exploit possible vulnerabilities to confirm their existence. 62 But, the use of exploits puts the organization's systems at a level of increased risk 63 that is unacceptable when neither the organization nor the auditor has the time or finances to address the issue. The SAFETAG methodology only uses relatively safe exploitation of vulnerabilities for targeted outcomes. For instance, cracking the wireless access point password allows us to demonstrate the importance of good passwords without singling out any individual's passwords. 64 Overview Identify services being hosted or used by an organization Research externally-facing organization services (websites, services hosted from the office, etc.) Research information about identified services (e.g current versions of those services.) Page 93 of 240