Implementación de Nessus para el análisis de vulnerabilidades en un centro de datos

Abstract

A university’s data center hosts vital and sensitive information, making identification and correction of
vulnerabilities in its digital infrastructure crucial. The increasing complexity of digital infrastructures, especially
with the adoption of virtualization technologies and cloud services, has introduced new security challenges,
making vulnerability management essential. Given the large number of virtual servers and the diversity of
operating systems within them, manual security reviews are no longer viable, which motivated the need to
implement automated tools for vulnerability analysis. It was decided to implement and evaluate the Nessus
tool in a testing environment to identify and report potential security breaches in the virtualized infrastructure
of the Data Center of the Directorate General of Computing and Information and Communication Technologies
(DGTIC). The choice of Nessus was based on its broad recognition in the industry, as well as its successful use in
other academic institutions for proactive and automated vulnerability detection.
The methodology consisted of installing Nessus on a virtual machine within a test cluster running the Proxmox
hypervisor and several virtual machines with some security breaches. For the target IP addresses, basic
and credentialed scans were performed, and default port ranges were used. The analysis results provided
a total number of identified vulnerabilities and their distribution by severity level, allowing for specific
recommendations to improve the security of the test environment. The analysis demonstrated Nessus’s
effectiveness in identifying and classifying vulnerabilities in complex virtualized infrastructures, where multiple
physical resources such as servers, storage, and networks have been virtualized. This highlights the importance
of an ongoing vulnerability management program and the adoption of security best practices to improve the
digital infrastructure’s ability to withstand and recover from incidents.