Printable View
We've just been given the opportunity to get a bit more cash and we were thinking about buying Retina as a Vuln scanner.
We're going to download a trial and try to review it but we're short on time. Got to apply for the funding within 2 weeks.
Does anyone have any experience of this product that they can share (good and bad).
TIA
What is Retina? (Well, some part of the eye, of course, but what else?) Do you have some useful link?
Have you tried Google and Wiki for more information about this product?
Retina is a network vulnerability scanning tool from eEye .
It's a well known tool and reasonably well regarded. I can google for reviews easily enough but I'd rather get some comment from actual users rather than reviewers. Some issues with complex products suchas this only crop up after an extended period of use. I don't have time to learn the tool as well as I would like so I'm looking for as much information as possible to speed up the process.
We've been told of an underspend in our service budget so we're looking to grab £5k for Retina but we only have 2 weeks to justify getting the money (plus all our other work).
You certainly have a very polite way of saying http://just****inggoogleit.com/ :D
Retina is the tool prefered by DISA for vuln scanning. Retina has a good number of high end features that I know about but haven't used yet. I have used it as a stand alone scanner and it does that very well. The features I haven't used are its ability to store the results into a database, compare those results, and to assign the tasks needed to mitigate those findings all through the software GUI.
Hope this was helpful.
When I was evaluating for packet inspection / asset tracking and vulnerability scanning, I tried Eeye suite including Retina.
My thoughts were Eeye products had too much overhead, the API's constantly babbled across the network.
Good product - does what it says. The learning curve is high so you, or the retina admin, will need a few months to get a handle on all the "Features"
In the end I went with Websense. I already had a Cisco PIX and Concentrator, So the Websense PIX integration fit my needs best.
If you already have IDS - Check out Websense if you have time. Usually folks want comparison stuff anyway.
I've always learned to be polite, yes. :D But I always advise people to try http://www.wikipedia.org/ too. These Wiki pages are getting better and better and chances are that someone did write an article about this kind of software there. Now, you've probably looked at Google but have you also wiki'd it? :D
To be honest, when people ask me what the best thing in network security is, I always tend to reply with "common sense". Relying on third-party tools does make your system more secure in many cases, true. But what if those third-party applications introduce their own weaknesses? Besides, keep in mind that you will have additional costs. Someone will have to spend time learning to use this tool in the proper way, which could end up becoming more expensive than the product itself. This person will need to have good knowledge about security risks and how to identify them, helped by this tool. He has to know how to make things more secure and above all, he must have proper authorities to take action against any weak point in your network.
As you say, you're trying to learn as much as possible to learn about this tool. But as dinowolf already says, the learning curve is pretty high so there will be an additional cost of you or someone else just learning to use it instead of doing your normal job. I don't know if you could justify that in your budget, though...
Good points but...it IS my job to learn, evaluate and use these tools and I'm expected to do so.
Common sense is always good but I can't check 300 servers (MS, Unix, Linux, Citrix and Sun) manually for the thousands of patches that should be applied plus all the possible misconfigurations that could occur and keep up to date with all the new exploits.
Your thinking is sound its just different in reality here. We are also recommended (recommended with a big or else in the background) to have software carrying out these scans by some of the regulatory guidelines we have to operate under. Plus the cost, in enterprise terms, is small beer but we don't have sufficient funds in the infosec budget to get it this year.
No I haven't wiki'd for info :rolleyes:
Dinowuff - we've got Enterasys Dragon going in right now for IDS but it's semi-functional right now so I'll check out websense too.
you might want to think about the company's stability, they just laid off 80% of their workforce INCLUDING the COO. They don't seem all that stable at the moment
http://comments.****edcompany.com/fc...hp?search=eeye
I currently use Retina at my work. It is a pretty decent system, and if there are problems (like we had recently with scanning UNIX boxes) they are fast and quick to respond. I had a senior tech on the phone within 10 minutes of submitting a ticket.
As far as how good it is. Well no single tool will be the end all solution. They do a great job with updating their signatures/vulnerabilities, but I still use nMap to verify the ports that Retina finds, and I use Nessus in conjunction to cover all the bases. You can easily set up scheduled jobs to scan for you... this is what I do and I scan about 250ish servers every month and constantly check out single/new ones as they come on line.
Give them a try, you can download a full evaluation from them. Let them know that you need something more than the regular evaluation copy though, tell them you need a 32 IP license so you can scan a bunch of boxes.
Also it is going to be costly, I think the 32 IP license is around $1200 and it scales from there. Don't forget to write in the yearly maintenece costs in your justification as there is a recurring charge.
cobain_attacks that is the first I have heard of that bit of news. I was just working with their folks last Thursday/Friday and I have a concall with them tomorrow. Even with these layoffs they responded very fast to my ticket.
If you have more specific questions feel free to ask. I'll answer them as I can.
Aspman:
I use Retina at work and it's a great vulnerability auditor. It works best against Windows systems but does check others as well as network devices. They won many awards a few years back and rightfully so.
Some pros:
* Pretty thorough
* Good point-and-click type of tool for folks who dont have tons of time to do auditing
Some cons:
* Reports are weak, very little customization can be done.
* Not an enterprise-class type of tool in the way of managing it.
If you couldn't tell already - I recommend it!
<edit>
Good note Lv4 on the yearly maintenance: without it the product starts becoming useless at the time of expiration because you'll stop getting exploit/audit updates. You gotta have the maintenance for new vuln testing.
One other comment is that we use Retina in a layered audit architecture - it's just one of many tools we use. Others include Nessus, Metasploit Framework, N-Stealth, and other smaller tools.
</edit>
Wanted to make a couple of notes/comments as well:Quote:
Originally posted here by ric-o
Aspman:
I use Retina at work and it's a great vulnerability auditor. It works best against Windows systems but does check others as well as network devices. They won many awards a few years back and rightfully so.
Some pros:
* Pretty thorough
* Good point-and-click type of tool for folks who dont have tons of time to do auditing
Some cons:
* Reports are weak, very little customization can be done.
* Not an enterprise-class type of tool in the way of managing it.
If you couldn't tell already - I recommend it!
<edit>
Good note Lv4 on the yearly maintenance: without it the product starts becoming useless at the time of expiration because you'll stop getting exploit/audit updates. You gotta have the maintenance for new vuln testing.
One other comment is that we use Retina in a layered audit architecture - it's just one of many tools we use. Others include Nessus, Metasploit Framework, N-Stealth, and other smaller tools.
</edit>
I've used Retina before and when it runs ok, it is pretty good, but I have had some flakiness problems from it (more on that later). Do want to mention that I do remember seeing something about the enterprise management side for it, but I never really paid that much attention to it, since it wasn't really applicable for anything that I did at that moment. I've run many tools, from Nessus to ISS to cybercop to Retina, and overall, Retina seems to be ok, but here were some of my beefs with it:
1) Piss poor reporting. There just weren't alot of options there, especially remediation. That is one of the things I always liked about ISS (and to some degree nessus), is there were pretty reliable steps to do something about the problem that was discovered. There also were not alot of options as far as how to break out the report. Now I will say there was a possibility that the version I had was nerfed in that respect, but based on earlier comments I suspect it isn't... I will add that it did have the capability in some cases to actually do the remediation itself, but I never had enough guts to turn it on :) (not really my job anyway)
2) Engine quirkiness. Let me preface this by saying this was about a year ago and the issue may be fixed, but Retina basically runs as a System service...you tell it to scan, it adds a job, then the service runs the scan... Well...I had a scan that crapped out totally...and had no way whatosever to get it out of the service...it tried but could never get rid of it...so it kept trying to scan this test system over and over again (even when not connected tot he network)...Like I said, bug may be fixed now, but it was very frustrating to not be able to get rid of that scan gone wrong...
3) Scan quirkiness. There were a couple of the checks that it ran that were kind of braindead...basically there were things out there that would reset a few of the vulnerability checks (tcp reset on the connection), but Retina would totally miss that the connection reset and would basically get stuck in an infinite loop on that vulnerability check, testing, getting reset, and retesting...
Overall, I think it had promise and I certainly have seen worse vulnerability checkers, but I think there is also plenty of room for improvement. We had the cash laying around and had a license for ISS Internet Scanner (and have been using it for yeares), and I have seen nothing in Retina that would make me move away from ISS, though with ISS's pricing schema, it certainly is tempting...
EDIT: Thought of some other things to consider after posting:
1) The composition of your network. Ie, % of windows systems to unix to network devices...things like Retina work really well in Windows environments...whereas things like ISS/Nessus can handle Unix environments pretty smoothly.
2) Number of systems that you are likely to scan at one time. Nessus is quite good at smaller scans (ie, class C or less), but I wouldn't want to try to do a large network with it (class B for example)...whereas something like ISS is a little easier to scan larger networks with (though you do have to be careful not to DOS the network with too much scanning traffic)....
3) Reporting/Remediation. This is after all why you are running the scan. The ability to clearly show trends, common vulnerabilities, and good reports that you are able to use to either fix the systems directly, or make a case to make a change are from my experience important...the easier it is for pointy-hair bosses to understand, the better (but then on top have the capability to then generate a very detailed techincal report)...to me I guess this was the biggest thing I didn't like about Retina...but at the same time, I wouldn't dismiss the possibility that lack of time using it contributed to that frustration...
I can say this....I have used Retina before and it works great. The cost was something that I always had an issue with, but it does do the job well. As mentioned previously, it does require some "getting used to" to actually know what all the features are available. I don't care for the reports too much. They need to be more robust to say the least.
I DO however like SNSI (Sunbelt Network Security Inspector)...it scans Windows/Unix/Linix etc.
I like the fact that portions of the database come from Harris STAT and that the SANS Top vulnerabilities are present. The reports are nice. They use a Crystal Reports backend so it makes it easy to use and to print out a neat "boss friendly" report to turn in. Link to the product is here: http://sunbelt-software.com/SunbeltN...yInspector.cfm
The other cool thing is its licensed per admin, so regardless of how many machines you have, you can use this tool freely.
Thats just my opinion though :)
I`ve used (and use) Retina, its ok, although I do agree with Nebulus that it has some flaws and i have seen it as being very flakey at times. You could of course look at one of the other (hundreds) f tools out there - Sunbelt, ISS, Nessus (in all its many versions - NeWT, Outpost 24 etc..).
They all do the same thing so a key point is to pick one that is kept up to date. Several of the tools are supported by research groups who write new exploits etc.. so you can be sure of being up to date.
Although I think at the end of the day a vulnerability scanner is only going to get you so far and then its back to manual procedures.
I've used retina religiously for many years now... I've never had a single problem with it. Its reporting functionality is exactly what I look for and its CHAP technology has actually discovered new vulnerabilities.
If I was stuck with one COTS vulnerability I'd choose retina. (as it is, I supplment with nessus and a custom product)
cheers,
catch
Many thanks for all replies, most useful. Greens on the way.
Also thanks for the suggestions of other scanners to look at, time willing I'll try them but our time scale to access this extra cash is really tight. The boss likes the reputation of Retina so that probably means unless we find it to be trash we'll probably get it.
It's a rush job, not ideal but I'm sure many of you have been in the same situation.
'll probably add to this thread as I'm using it or pm those of you who've offered.
Seems very slow compaired to nessus.
Some bugs appearing already. Aborted scans never dying.
It's superficially easy to use but the manual is pants for using it in more depth.
The funny thing is I think they just reintroduced this bug. I haven't had this problem for a long while now (a couple of months after 5.0 came out) but I /just/ ran in to the problem again a couple of weeks ago after running auto update.Quote:
Some bugs appearing already. Aborted scans never dying.
I put in another ticket with them about it, so hopefully it will go away. I'm not real sure why it is back though.
Just did the same:
I've managed to crash it a couple of times too and I'm only scanning a single machine.Quote:
For whatever reason, the status on these jobs were never updated. To remove them, please do the following...
1. Stop the Retina UI and eEye Retina Engine service
2. Browse to 'Retina 5\Scans' on the filesystem and remove the RTD file associated (named after) the bad scan 3. Start Retina back up and the job should be cleared
Hmm, I confused this with the Packet sniffer Iris :s no wonder it wasnt making much sence to me. I'd go with Nessus if I were you. Cant truly justify it beyond the fact that its nessus and it rocks....but thats enough for me :)
Quote:
Originally posted here by Aspman
Just did the same:
I've managed to crash it a couple of times too and I'm only scanning a single machine.
What build number are you using? I just got a response back from Eeye and they are looking in to the issue. The guy said they have had a "number of reports about this issue" so it isn't isolated. I'm just curious as to what builds are affected by it now.
I'm on 5.3.4.1324.
Its a full evaluation of v7.x
I'm away from the office now. I'll check tomorrow.
Nope totally wrong it's Version 5.3.4.1325
But it is an evaluation copy on a 2 week 16 IP licence.
It's runnign a lot better now. I think I'd configured some of the scans badly and that was causing the lag.
It scanned an XP workstation in 9 minutes and the same box running Knoppix with some random services in 2 minutes.
I wouldn't take these as representative I'm still playing around with the settings but I keep getting distracted. Such is life.
I've used it a few times ( The trial version) when Cheyenne, Myself, zombiemann and Jarrod changed our AO CS clan website. Ran a few tests on the website for the hell of it...very interesting and detailed report. Retina defenitely makes a nice addition to any audit toolbox.Quote:
We're going to download a trial and try to review it but we're short on time. Got to apply for the funding within 2 weeks.
Does anyone have any experience of this product that they can share (good and bad).
Retina seems ok, can't say more really it's all been so rushed.
I've downloaded ISS today to get a comparison with something else at least. Now running the sales gauntlet to get a licence key with getting phoned to death. Chap seemed quite hurt when I wouldn't give him my number.
Retina is great...but a bit on the pricey side. The reports are lacking to say the least. I agree with Ric-O...a layered approach is the best.
First impressions of ISS Vs retina
ISS seems a lot more flexable but Retina seems to be much easier to use in the short term.
ISS used to, and I assume still does, let you run a scan against localhost. You should be able to register and account with them (free) and download, without the marketing crap...although I am wanting to say I do remember getting a phone call doing it and just laughing at them (we've had it for quite a while), but they were quickly dispatched. I think if you spend the time to hunt down a few things (they aren't always obvious), you'll see what I meant by more in depth reporting and organizational stuff, which for my particular job is invaluable and what was my biggest knock against retina.Quote:
Originally posted here by Aspman
Retina seems ok, can't say more really it's all been so rushed.
I've downloaded ISS today to get a comparison with something else at least. Now running the sales gauntlet to get a licence key with getting phoned to death. Chap seemed quite hurt when I wouldn't give him my number.
Kinda funny seeing you guys come up with the same stuff I mentioned after poo-pooing my initial reply to some degree ;)