Policies

In order to perform a Nessus scan, you will have to create a policy. A policy is a collection of various configurations, methods, and types of scans being performed. Multiple scans can use one policy, but only one policy applies per scan. A user can import a previously created policy, which is stored in the .nessus format, or click Create a new policy. Once a user chooses to create a policy, they are presented with various policy templates present in Nessus, based on the test cases to be performed on the hosts. The following are the lists of various policy templates provided by Nessus:

These templates consist of a range of configurations required to perform scans ranging from generic to attack specific. Out of the 21 displayed in the screenshot, we will look into a few templates to understand the composition and working of a policy.

We will look at the contents of a policy template in Chapter 4, Vulnerability Scanning.