TOC & Recently Viewed

Recently Viewed Topics

Credentials

You can use credentials to grant the Tenable.io scanner local access to scan the target system without requiring an agent.

Credentialed scans can perform a wider variety of checks than non-credentialed scans, which can result in more accurate scan results. This facilitates scanning of a very large network to determine local exposures or compliance violations.

Credentialed scans can perform any operation that a local user can perform. The level of scanning depends on the privileges granted to the user account. The more privileges the scanner has via the login account (e.g., root or administrator access), the more thorough the scan results.

In Tenable.io, you can create credentials for use in scans in the following ways:

Category

Description

Permissions

Scan-specific
  • You configure and store these credentials in an individual scan.
  • If you delete the scan, you also delete the credentials.
  • If you want to use the credentials in a different scan, you must either convert the scan-specific credential to a managed credential or recreate the scan-specific credential settings in the other scan.
User Permissions in Basic settings in the scan
Policy-specific
  • You configure and store these credentials in a scan policy. You can then use the policy to create individual scans.
  • If you delete the policy, you also delete the policy-specific credentials. However, Tenable.io retains the credentials in any scans you used the policy to create before deletion.
  • If you want to use the credentials in a different policy, you must recreate the policy-specific credentials in the other policy.
User Permissions in Basic settings in the policy
Managed
  • Tenable.io stores managed credentials centrally in the credential manager. You can configure managed credentials directly in the credential manager or during scan configuration. You can also convert a scan-specific credential to a managed credential during scan configuration.
  • You can use managed credentials in multiple scans. You can also grant other users permissions to use managed credentials in scans.
  • You cannot use managed credentials in policies.

Configure User Permissions for a Credential

The settings you configure for a credential vary based on the credential type. Credential types include:

Note: Tenable.io opens several concurrent authenticated connections. Ensure that the host being audited does not have a strict account lockout policy based on concurrent sessions.

Note: By default, when creating credentialed scans or polices, hosts are identified and marked with a Tenable Asset Identifier (TAI). This globally unique identifier is written to the host's registry or file system, and subsequent scans can retrieve and use the TAI.

This option is enabled (by default) or disabled in the Advanced -> General Settings of a scan or policy's configuration settings: Create unique identifier on hosts scanned using credentials.

Copyright © 2019 Tenable, Inc. All rights reserved. Tenable, Tenable.io, Tenable Network Security, Nessus, SecurityCenter, SecurityCenter Continuous View and Log Correlation Engine are registered trademarks of Tenable, Inc.. Tenable.sc, Lumin, Assure, and the Cyber Exposure Company are trademarks of Tenable, Inc. All other products or services are trademarks of their respective owners.