Wanted to make a couple of notes/comments as well:Quote:
Originally posted here by ric-o
Aspman:
I use Retina at work and it's a great vulnerability auditor. It works best against Windows systems but does check others as well as network devices. They won many awards a few years back and rightfully so.
Some pros:
* Pretty thorough
* Good point-and-click type of tool for folks who dont have tons of time to do auditing
Some cons:
* Reports are weak, very little customization can be done.
* Not an enterprise-class type of tool in the way of managing it.
If you couldn't tell already - I recommend it!
<edit>
Good note Lv4 on the yearly maintenance: without it the product starts becoming useless at the time of expiration because you'll stop getting exploit/audit updates. You gotta have the maintenance for new vuln testing.
One other comment is that we use Retina in a layered audit architecture - it's just one of many tools we use. Others include Nessus, Metasploit Framework, N-Stealth, and other smaller tools.
</edit>
I've used Retina before and when it runs ok, it is pretty good, but I have had some flakiness problems from it (more on that later). Do want to mention that I do remember seeing something about the enterprise management side for it, but I never really paid that much attention to it, since it wasn't really applicable for anything that I did at that moment. I've run many tools, from Nessus to ISS to cybercop to Retina, and overall, Retina seems to be ok, but here were some of my beefs with it:
1) Piss poor reporting. There just weren't alot of options there, especially remediation. That is one of the things I always liked about ISS (and to some degree nessus), is there were pretty reliable steps to do something about the problem that was discovered. There also were not alot of options as far as how to break out the report. Now I will say there was a possibility that the version I had was nerfed in that respect, but based on earlier comments I suspect it isn't... I will add that it did have the capability in some cases to actually do the remediation itself, but I never had enough guts to turn it on :) (not really my job anyway)
2) Engine quirkiness. Let me preface this by saying this was about a year ago and the issue may be fixed, but Retina basically runs as a System service...you tell it to scan, it adds a job, then the service runs the scan... Well...I had a scan that crapped out totally...and had no way whatosever to get it out of the service...it tried but could never get rid of it...so it kept trying to scan this test system over and over again (even when not connected tot he network)...Like I said, bug may be fixed now, but it was very frustrating to not be able to get rid of that scan gone wrong...
3) Scan quirkiness. There were a couple of the checks that it ran that were kind of braindead...basically there were things out there that would reset a few of the vulnerability checks (tcp reset on the connection), but Retina would totally miss that the connection reset and would basically get stuck in an infinite loop on that vulnerability check, testing, getting reset, and retesting...
Overall, I think it had promise and I certainly have seen worse vulnerability checkers, but I think there is also plenty of room for improvement. We had the cash laying around and had a license for ISS Internet Scanner (and have been using it for yeares), and I have seen nothing in Retina that would make me move away from ISS, though with ISS's pricing schema, it certainly is tempting...
EDIT: Thought of some other things to consider after posting:
1) The composition of your network. Ie, % of windows systems to unix to network devices...things like Retina work really well in Windows environments...whereas things like ISS/Nessus can handle Unix environments pretty smoothly.
2) Number of systems that you are likely to scan at one time. Nessus is quite good at smaller scans (ie, class C or less), but I wouldn't want to try to do a large network with it (class B for example)...whereas something like ISS is a little easier to scan larger networks with (though you do have to be careful not to DOS the network with too much scanning traffic)....
3) Reporting/Remediation. This is after all why you are running the scan. The ability to clearly show trends, common vulnerabilities, and good reports that you are able to use to either fix the systems directly, or make a case to make a change are from my experience important...the easier it is for pointy-hair bosses to understand, the better (but then on top have the capability to then generate a very detailed techincal report)...to me I guess this was the biggest thing I didn't like about Retina...but at the same time, I wouldn't dismiss the possibility that lack of time using it contributed to that frustration...
