The Security Feed for both versions differs in four main areas: Content, quantity, quality and availability.
| Features | Greenbone Security Feed | Greenbone Community Feed |
|---|---|---|
| NVTs included | Every NVT | Only basic NVTs |
| Quality Assurance (QA) | Consistent | Variable |
| Availability | Assured with SLA | No promise |
| Fixes / Improvements | Assured with SLA | No promise |
| Support | Assured with SLA | Via community on voluntary basis |
| Updates | Constantly / daily | Constantly / daily, but without enterprise features |
| Transfer | Encrypted | Unencrypted |
| NVT Signatures | SLA for QA / Fixes | Transfer Integrity |
Greenbone includes every self-developed Network Vulnerability Test (NVT) into its professional Greenbone Security Feed (GSF), but not into the Community Feed (GCF).
These NVTs can be grouped as:
| Group | GSF | GCF |
|---|---|---|
| HOT NVTs | Y | Y |
| NVTs for Home Products | Y | Y |
| German "Grundschutz" | Y | Y |
| NVTs for Enterprise Products | Y | N |
| Compliance (i.e. PCI, ISO27001) | Y | N |
| Operational Technology (ICS / SCADA) | Y | N |
| Signed NVTs | Y | N |
The following list gives some examples of those professional enterprise-grade products which are only part of the professional Greenbone Security Feed:
- Generally, all Enterprise-grade products and all OT (i.e. ICS/SCADA) products
- MS Windows Server and back office solutions (e.g. SharePoint, SQL Server, etc.)
- Products from Palo Alto Networks, Cisco, Juniper Networks and Fortinet
- Oracle Solaris IBM WebSphere products (i.e. IBM WebSphere Application Server)
- Lotus Notes or SAP products
- VMWare paid products
All in all, the Community Feed encompasses about 30% less NVTs than those included in our professional feed.
Greenbone features a permanent stream of over 76,000 Network Vulnerability Tests (NVT) – and more are being added every day. The scan engine is capable of recognizing known and potential security problems thanks to this daily update, regardless of what devices are connected to your network.
- Content
- Tests according to CVE alerts
- Tests according to Bugtraq alerts
- Aggregate compliance rulesets
- Controls for scan agents
- Embedded Nmap NSE test routines
- Coverage: MS Windows, GNU/Linux (Debian, Fedora, Mandriva, Redhat, SUSE, Ubuntu), Solaris, HP-UX, Cisco and various active networks components
- Features
- Globally networked development team: North-America, Europe and Asia
- Multi-tier quality assurance process
- Multiple daily updates
- Encrypted transfer
- Test routines are digitally signed
- Vulnerability tests via remote network access
- Vulnerability tests via credentials
- The core content of the Greenbone Security Feed consists of
- NVTs (Network Vulnerability Tests)
- SCAP (Security Content Automation Protocol) and
- CERT (Computer Emergency Respone Team) data.
- The content of the Greenbone Security Feed undergoes a distinct process before it arrives at their customers' sites.
- Screening (validity)
- Research (type, correlation, priority)
- Implementation
- Quality Assurance
- Release (into feed service)
