So I thought I would give my perspective on the various vulnerability scanner technologies that are out there. I have experience with a few, including:
ISS Internet Scanner/Enterprise Scanner
Eeye Retina
STAT Guardian
Nessus
I have varied degrees of experience in these scanners, but I have my likes and dislikes in each one. So let start with ISS or now IBM Internet Security Systems.
IBM ISS: ISS comes with Internet Scanner. This is the original scanner that could be installed on a Windows XP box or greater. The scan can be run locally on the system itself or it can be a managed scanner by the console called Site Protector. From Site Protector you can create folders, discover assets scan assets, create scanning policies, credential sets and schedule scans as well. This worked rather well, however the scanner itsself required maintenance, especially being on a windows box. Patching troubleshooting problems and there was even an issue where Service Pack 2 for XP was not compatible with ISS Internet Scanner 7. The results were rather good, sure there was a false positive every now and then, but I was satisfied.
IBM ISS Enterprise Scanner: The newer ISS product is the Enterprise Scanner whose main difference is that it is an actual appliance linux based. This is a definite improvement, also that the ES1500 comes with 5 NICs for scanning different network subnets, such as networks behind different firewalls that may be present.
Both of these scanners are managed with Site Protector as the management console. You can set policies, groupings, scan schedules and more. I find the interface to be somewhat problematic as policies have to inherit and it can get complicated. This interface has changed since the newest version of Site Protector 7 and seems to be even more hard to get functioning correctly. Another negative is that the checks are mostly for vulnerabilities and not much on the security settings for security best practice configuration.
eEye Retina is a scanner that is a bit different from ISS in that it is a web interface. I dont have the in depth experience with Retina as I do with the other scanners but it has been selected by DoD as a scanner of choice. It does seem to have better vulnerability coverage than ISS but not by much. It has a install that can run on a XP system and I believe has an agent deployment as well. They do have an appliance so this review may not do eEye Justice. I would take a closer look at this scanner if you have a chance.
STAT Guardian, now Lumension, is another alternative which in the configuration I am familiar with can be run on a windows server and have vuln info stored on a 2005 MSsql database. The scanner client is somewhat useful and is a thick client. It generates different reports and can even send scan data to a repor server for enterprise wide reporting. This scanner has issues however with reporting vulnerabilities even when it could not get admin access on a system to fully verify. This has caused 400 page reports to kick out at times. Recently an issue with MS08-062 showing unpatched and all recent patches not reporting up to MS09-001. SAs verified SCCM report the patch to be applied. Investigation is still undergoing, but this would not be my scanner of choice.
Last is Nessus, which is my preference. I have used the Nessus Client and find it to work very well. It is accurate in reporting findings and even is open to show the details of the vuln check to see exactly what the scanner is looking for. This is located at the Tenable website. There is a forum for support, a mailing list as well and then the paying customers get typical privliedged support.
The best part of Nessus is the Security Center, which can is a management server for Unified log management. It will take your scan results and put it in a database for reporting, metrics, grouping of vulnerabilities and more. This is web based and can also be integrated with IDS data. In other words you can point your Snort instance to the Security Center for event correlation. Also there is a component called a Passive Vulnerability Scanner, which will sit on a span port and capture traffic and information of what is going across the wire and ad it to the data correlation. There is also a vmware appliance for easy deployment of Nessus as well as a soon to be released Security Center VMWare appliance running on Fedora.
Nessus plus Security Center gets my recomendation.
betoftw