RoadMap in the Cloud (2011)
3 likes•1,063 views
The document outlines QualysGuard's roadmap to transition to a new platform and interface while expanding its suite of security and compliance products and virtual scanning capabilities. It details plans to release new versions of modules like vulnerability management, policy compliance, and malware detection in 2011 along with an enhanced JavaScript interface and tag-based organization. The roadmap also includes virtual scanner appliances for different environments and expanded configuration content for policy compliance.
RoadMap in the Cloud (2011)
- 1. QualysGuard RoadMap in the Cloud … Marek Skalicky, CISM, CRISC June 15, 2011 Regional Account Manager for Central & Adriatic Eastern Europe
- 2. QualysGuard Suite IT Security Risk & Compliance Platform and Applications New definition of QG Security & Compliance Suite QualysGuard On Demand Portal Analyze Comply Protect Vulnerability Management Policy Compliance / FDCC Web Application Firewall* Web Application Scan PCI Compliance IDS/IPS Signatures* Malware Detection Qualys Seal Self-Service Scan* Compliance Management* QualysGuard SaaS Technology Platform Scanners & Sensors Open APIs & Integrations
- 3. Migration Plan to new platform Web 2.0 UI (EXT) Application Optimized & Integrated JSON API Web Services API (Qualys Platform Services) Q2/Q3 Current PHP Q3/Q4 Next Generation Platform Java Platform Q4/Q1 New Scanner Interface Virtual Scanner Existing & New Scanners platform 2011 2
- 4. Major Enhancements: JavaScript Interface with Web Services for Actions & Data Highly Dynamic Interface − ExtJS Library Based Widgets − JS Compression and Compilation − Separated Display-and-Service Architecture Single Service / Any UI / Export − Allows Easy Re-Use − Easily Scriptable & Highly Accessible − Wide Range of Outputs (doc, xls, pdf, xml, ppt) Easily Leveraged in Other Applications − QualysGuard-accessible − Customer-accessible − Partner-accessible 3
- 5. Major Enhancements: Tag-Based Organization & Security Dynamic Tags − Many Rule Engines & Customization Options − Fast Re-Evaluation − Manual and Scan-Based Updates Hierarchical Tags − Allow for Inheritance in Security − Allows Easy Roll-Up Grouping − Works in all Modules (Reporting, etc…) Security-by-Tag − Allow Access Based on one or More Tags − Dynamic & Static Security, Easier Maintenance 4
- 6. First Public Implementations: Qualys SECURE Seal & Malware Detection Services 5
- 7. Next Implementations: Web Application Scanning & Policy Compliance 6
- 8. Roadmap Summary Products H1 2011 H2 2011 2012 + • WAS 2.0 beta • WAS 2.0 GA • VM on new platform Analyze • MAL 1.0 GA • PC on new platform • New discovery wizard VM, WAS, MAL • Exploit integrations ✓ • Reporting enhancements • New ticketing integration • Template library ✓ • Web app fingerprinting Compliance • Secure Seal GA • POL on new platform • Compliance Manager beta POL, FDCC • PCI ASV 1.2 support ✓ • UCF support PCI, Seal • Policy locking • IT GRC Integrations Protect • WAF beta WAF • IDS Signatures beta IDS • New scheduler (JobD) • vScanner for Amazon • vScanner for Data Center Platform • CyberArk auth records ✓ • vScanner for Consultant • Scheduled reporting • Verisign VIP 2-facto ✓ • New remediation engine • Dynamic asset tagging 7
- 9. Qualys + Cyber-Ark PIM Integration Cyber-Ark Privileged Identity Management For GQ authenticated scanning Using Cyber-Ark Password Vault Local encrypted credentials storage Very easy to implement 1 day project including C-A implementation References: Rabobank, Discover, CNB Very low costs of integration Zero costs for existing Cyber-Ark customers Special discount for Qualys customers
- 10. VeriSign VIP Two-factor Authentication 1) Download free SW Token 2) Edit user settings in QG https://vipmobile.verisign.com/supportedphones.v 3) Login with VeriSign VIP
- 11. Virtualization Roadmap Purpose: develop software-based scanner appliances which run under irtualization engines (VMware, Xen, HyperV) Multiple versions: − Consultant & Express: based on VMware Workstation/Player, to be run on laptops and SMB servers; − Enterprise versions: Intended for data centers, integrated with centralized management systems as VMware vSphere, Xen, HyperV − Amazon EC/2 version: Intended for scanning EC/2 targets − Amazon VPC version: Intended for scanning VPC targets 10
- 12. Screenshot vScanner Console 11 COMPANY CONFIDENTIAL
- 13. QG Vulnerability Management Module
- 14. Exploits Knowledgebase Information added for Exploit Availability Following resources used: − Exploit-DB − Metasploit − Core Security − Immunity − Others…
- 15. Malware Knowledgebase Information added for Malware Code Availability Following resources used: Trend Micro Malware Knowledgebase Others malware resources coming…
- 16. 3 Solution categories Solution description categories: Vendor Patch available Workaround available Virtual Patch available Trend Micro Deep Inspection signatures Other IDS/IPS vendors coming…
- 17. VM Report Templates Map Reports: Remediation Reports: Map Result (list / graphical map) • Tickets per Asset Group / Business Unit Unknown Device Report • Tickets per User Asset Reports: • Tickets per Vulnerability Assets for selected OS / SW / Port / Service • Executive Remediation Report Assets at risk of Malware v.1 • Patchable High-priority Vulnerabilities v.1 Assets at risk of Exploits v.1 • Disabled/Ignored Vulnerabilities v.1 Assets with Obsolete Software v.1 • Patchable High-priority Vulnerabilities v.1 Virtually Patchable Assets v.1 • Remediated Vulnerabilities Last 30 Days v.1 Scan Reports: • Qualys Patch Report per IP / Asset Group / BU Scan Result (full technical report) • Critical Patches Required v.1 Executive Scan Report • Tickets ScoreCard Reports Technical Scan Report • The Most Prevalent Vulnerabilities Report High Severity Report • The Most Vulnerable Hosts Payment Card Industry Executive Report Payment Card Industry Technical Report Additional Qualys Reports Vulnerability ScoreCard Reports • Qualys TOP 20 Benchmark report • SANS TOP 20 Benchmark report • Authentication Verification Report
- 18. Asset Tagging Organize assets via multiple hierarchies − By technology (Windows, Unix) − By business unit (Consumer Products, Commercial, etc.) − By business processes (Accounting, Controlling, Clearing.. Assets can have multiple tags − 10.1.1.1 is “NY SOC”, “Unix Servers”, and “Finance Servers”, Accounting process, Controlling process, … Both static and dynamic tags − Rules-based engine for assigning tags on attributes User access is defined by tags − Permissions can be grouped into user-defined Roles 17
- 19. QG Policy Compliance Module
- 20. QualysGuard Policy Compliance Content Growth Policy Compliance Content 8000 7000 6000 5000 Controls 4000 Configuration Checks 3000 2000 1000 0 Q1 09 Q2 09 Q3 09 Q4 09 Q1 10 Q2 10 Q3 10 Q4 10 Q1 11
- 21. POL Report Templates Policy Compliance Reports Summary Compliance report with trends Technical Compliance report with control description and evidence Compliance status by Hosts (Pass / Fail / Exceptions / All) Compliance status by Policy and Controls (Pass / Fail / Exceptions / All) Individual Policy & Control status over company Individual Host compliance status Other Compliance Reports Authentication Verification Report Payment Card Industry Executive Report Payment Card Industry Technical Report
- 22. QualysGuard Policy Compliance 3.0 Roadmap: Configuration Content Configuration Content Importable Policies Q2 2011 Q2 2011 − Oracle 9i/10g/11g (updates) − CIS Windows 2008 v.1.1.0 − MS SQL 2000/2005/2008 − CIS Windows 7 v.1.1.0 (updates) Q3/Q4 2011 − DB2 9.x LUW − CIS Solaris 2.5.1-9 v1.3.0 Q3/Q4 2011 − CIS Solaris 10 v.2.1.3 − VMWare ESX 4.x − CIS AIX 4.3.2/4.3.3/5L/5.1 − SharePoint 2007/2010 v.1.0.1 − Sybase ASE 15.x − CIS AIX 5.3-6.1 v1.0.0 21 COMPANY CONFIDENTIAL
- 23. QG PCI Compliance Module
- 24. QG PCI Compliance Workflow Qualys provide full ASV service: Network mapping & Vulnerability scanning attestation ASV Scan Final Certification report (Executive and Technical) PCI Self Assessment Questionnaire ASV insurance ASV support
- 25. QualysGuard PCI 2011 Roadmap PCI 5.4 − PCI Mobile app (iPhone, iPAD, Android) − Consolidated Action Plan Updates PCI 5.x − User Roles / Permissions − Scan Progress Indicator − General Comments in Certified Reports 24 COMPANY CONFIDENTIAL
- 26. PCI Mobile Screenshots 25 Company Confidential
- 27. QG WAS Module
- 28. Roadmap 2011 Cross-Site Request Forgery (CSRF) detection − Identify forms with a security context Improved crawling capabilities − XmlHttpRequest object and "AJAX" to better handle asynchronous requests and DOM updates − Web service interfaces Cross-Site Scripting (XSS) improvements − Better analysis of "DOM verification failed" results Improved reporting − Click paths to reproduce vulnerabilities − Screenshots of landing pages, vulnerabilities 27
- 29. QualysGuard WAS 2.0 Application New User Interface New interface style – new platform technology − Clarity for WAS interactions − New functions: Web Application Dashboard Web Application Catalog Web Application View Enhanced user experience − Interactive views to meet user expectations − Direct access to meaningful information − New Wizards to guide application creation & management 28
- 30. QualysGuard WAS 2.0 Application WAS Dashboard Dedicated dashboard for WAS application − Offers graph, chart and grid widgets for all WAS data points − Provides direct and global overview of Web Application inventory − Modular architecture allows seemless introduction of new widgets 29
- 31. QualysGuard WAS 2.0 Application Web Application Catalog Web Application Discovery and Management − Automatically discover web applications, using existing VM scan and map results − Management workflows guide users to gather additional information and comments and associate them with the web application 30
- 32. QualysGuard WAS 2.0 Application Web Application View Web application full overview − Web application summary and current security exposure − Web application current vulnerabilities, sensitive contents and information gathered − Associated scan results and schedules All web application workflows directly available − Edit Settings − Launch Scan − Schedule scan… 31
- 33. QualysGuard WAS 2.0 Application Enhanced scan results Interactive scan results − Vulnerabilities, Sensitive Contents and Information Gathered can be dynamically searched and filtered − Better user experience to prevent long results to be scrolled 32
- 34. QualysGuard WAS 2.0 Application New Features & Enhancements Management − User-Defined Password Bruteforcing Lists − Full-text search in all datalists Scan Workflows − Relaunch scan workflow − Include vulnerability count in scan summary emails Scan Results − Authentication status available immediately − Integration of OWASP, WASC and CWE Ids − Highlight proof in scan results 33
- 35. QG Malware Detection Service
- 36. QualysGuard Malware Detection Introducing New FREE Malware Detection Service - Daily scans that provide immediate insight into malware issues - Automated alerts - Identifying vulnerable code snippets for quick and easy removal of malware 35 COMPANY CONFIDENTIAL
- 37. QualysGuard Malware Detection Static and Behavioral Detection Two-pronged approach for detecting malware: - Static Analysis – using a “signature-based” approach, the service identifies potential source code that is typically used in malicious attacks. - Behavioral Analysis – the service visits the web site with a vulnerable browser and operating system and runs tests to determine if the web site behaves outside of normal operating guidelines. 36 COMPANY CONFIDENTIAL
- 38. QualysGuard Malware Detection Identification of Malicious Code 37 COMPANY CONFIDENTIAL
- 39. QualysGuard Malware Detection Pricing and Availability Pricing FREE for ALL (up to 10 domains per user account) Availability Available today in Beta: http://www.qualys.com/STOPMALWARE 38 COMPANY CONFIDENTIAL
- 40. QG Secure GO Service
- 41. Qualys GO SECURE Service and Seal Introducing 40 COMPANY CONFIDENTIAL
- 42. Qualys GO SECURE Service and Seal Types of Scans ① Malware Detection (Daily) Detects malicious software that could be hosted by the web site and infect visitors ② Perimeter Scanning (Weekly) Identifies externally facing vulnerabilities of the web server that could give attackers access to information stored on the host ③ Web Application Scanning (Weekly) Crawls and injects HTTP requests to the web application to identify vulnerabilities such as SQL injection and Cross-Site Scripting (XSS) ④ SSL Certificate Validation (Weekly) Verifies the web site is using an up-to-date SSL certificate from a trusted certificate authority (CA) for encryption of sensitive information during online transactions 41 COMPANY CONFIDENTIAL
- 43. Qualys GO SECURE Service and Seal Review and Remediation of Malware & Vulns 42 COMPANY CONFIDENTIAL
- 44. Qualys GO SECURE Service and Seal Qualys SECURE Seal – How It Works? Merchant adds SECURE seal code to their web site to display seal to visitors Remediation and Removal Merchant schedules the scans to run automatically on web site on a recurring basis (daily for malware, weekly for vulns and SSL cert validation) - Merchant is notified once malware or vulnerabilities are identified, or SSL cert no longer valid Customer resolves the malware/vulnerabilities found to continually show the seal to customers - Seal is removed within 72 hrs if malware or a critical vulnerability is identified - Merchant can fix and rescan to revalidate the seal at any time 43 COMPANY CONFIDENTIAL
- 45. Qualys Freemium Services More than just “free” services … freescan.qualys.com www.qualys.com/stopmalware www.ssllabs.com https://browsercheck.qualys.com https://community.qualys.com/docs/DOC-1351
- 46. Q&A Thank you [email protected]