The following steps are recommended prior to running a vulnerability scan ( such as Nessus, Qualys Rapid7, etc. ) against RSA Authentication Manager.

1. Ensure you are running the latest RSA Authentication Manager software version available. Authentication Manager software updates and patches are available for download from the RSA Community. Please follow the documented procedure for installing a software update or patch. Failure to follow a documented procedure could make the Authentication Manager unstable or break.
   
   
2. Secure shell (SSH) is disabled by default on Authentication Manager. Secure shell should only be enabled where it is required for maintenance or troubleshooting technical issues and disabled when these tasks are complete. Disable secure shell via the Operations Console > Administration > Operating System Access.
   
   
3. The Authentication Manager server is using a hardened operating system and is designed to have one Linux account to access the operating system. This Linux account is called 'rsaadmin'. RSA does not support adding additional Linux accounts to the operating system. 
   
   
4. Vulnerability scans can be resource intensive so consider running a vulnerability scan outside of peak business hours.
   
   
5. Please refer to your vulnerability scanner documentation on how to run a vulnerability scan of a Linux server using the 'rsaadmin' account.
   
   
6. Run the vulnerability scan and review the results.

For more information on security best practices and system hardening, please refer to the RSA Authentication Manager 8.x Security Configuration Guide.

The RSA Vulnerability Response Policy is available at URL https://www.rsa.com/vulnerability-response-policy/.

Where a customer is running the latest software version of an RSA Authentication Manager and there are further concerns on any vulnerabilities found in the vulnerability scan then this can be further investigated by RSA.

Please submit the list of CVEs and CVE descriptions to RSA Customer Support.

Submitted vulnerabilities should have a CVE number, where applicable.  Please include the vulnerability scan report, the make/model of vulnerability scanner used, and a list of the CVEs in CSV format.

For example: