How would I configure a PC scan to find unencrypted sensitive data (for example, social security and credit card numbers)?
Nessus is doing the same thing using regex to look for a pattern in a file. My point is that this is not an effective way to address Credit Card and sensitive data loss or scanning. There are more appropriate commercial and even freeware to do this for your client.
We do the same thing Nessus does only for Unix & windows is coming up later on. But apart from some very rudimentary checks this should not and can not be used to address data loss or sensitive data scanning. That uses case and requirements needs a more comprehensive scanning capability of data at rest and transit.
I hope this helps.
I would say this is more a Data Loss Prevention technology use cases than a Secure Configuration Assessment solution, Policy Compliance
Having said that, the only way I can think of using Q-PC for such use case is through UDC File Content Checking (currently available only for Unix & in roadmap to be available for windows in future) & utilizing regex looking for a particular pattern (i.e. Credit Card).
RPM & SME for APJ
So nessus can do this "out of the box" but qualys cannot? Very disappointing.
Saeed is right we should be using other tools like DLP, let Qualys do what it's good at.
Retrieving data ...