WIXLIB

ON DEMAND VULNERABILITY MANAGEMENTSecurity Demands Drive Shiftto Vulnerability Management“Enterprises that implement a vulnerabilitymanagement process will experience90 percent fewer successful attacks thanthose that make an equal investment onlyin intrusion detection systems.” (1)Gartner, Inc.

“Enterprises that practice soundvulnerability management, ratherthan only intrusion detection, willexperience fewer cyberattacks andsuffer less damage from them.”M. Nicolett and J. PescatoreGartner, Inc.On Demand Business: Global Opportunities, Increased RisksAddressing On Demand Security RequirementsTechnology has transformed the way we all do business. With on-demand technology,today’s companies enjoy huge opportunities for improving productivity and reapingthe benefits of data sharing with customers, suppliers and business partners. Asa business enabler and operational necessity, open systems are flexible, responsiveand global. Without proper management, however, this same technology bringsassociated security risks.IT departments can reduce threats and prevent intrusions with frequentassessments of their rapidly changing network infrastructure, quickly locatingcritical asset risks, accurately identifying security issues, and implementingcorrective actions. Sounds simple, yet implementation is difficult, evenimpossible with typical software tools that generate volumes of unmanageabledata with questionable integrity.The key challenge is data security—safeguarding the company’s information assets.Data such as strategic plans, customer information and R&D results are both crucialto operational success and lucrative targets for attackers. Even generic securitythreats such as worms and viruses can interrupt business continuity and significantlylower profitability.Qualys meets the security requirements of business by supplying on demand,continuous network security audits and vulnerability management. CalledQualysGuard, it is delivered as an independent, third-party service. QualysGuardresolves traditional barriers and transcends the limitations of software tools andprovides an end-to-end process for vulnerability management.Network Security – A Critical Business Success FactorThe most recent CSI/FBI survey discovered that the average financial loss from securityviolations was 380,000. Losses for theft of proprietary information averaged 2.7 millionper company. Civil liabilities for violations of consumer privacy and security regulationscan be much higher. Loss of customer confidence is incalculable. Because of its financialimpact, network security has become a critical success factor for businesses and canmake or break organizations of any size.“We use QualysGuard to auditbusiness-critical assets toprotect our brand and ourshareholders against potentialfinancial loss. As an on demandservice, QualysGuard Enterpriseallows us to align our informationsecurity with our core businessstrategies.”“The window between vulnerabilitydiscovery and time to exploitationis narrowing rapidly. Today’snetworking environment requirescontinuous auditing with real-timevulnerability and patch updates.”Dozens of new vulnerabilities are found daily in operating systems, applications andcritical network assets. Left undetected or improperly corrected, these vulnerabilitiesprovide an open door for 99% of all network attacks. Despite firewalls, virus detectionsoftware and intrusion detectors, today’s attacks bypass these layers of protection anddirectly target network weaknesses. By exploiting these known issues, worms, hackersand thieves cause billions of dollars in damage each year.Howard A. Schmidt, FormerSecurity Advisor to the WhiteHouse, CISO of eBayTo compound these risks, sophisticated worms are appearing faster with nearly instantpropagation. As a result, security teams have an ever shrinking time frame to identify andfix issues before they can be compromised by an attack.Compression of The Discovery/Attack Life CycleSelectiveAdvisory ReleaseAwareness of VulnerabilityTime to Exploitation of VulnerabilityDan Klinger, Manager ofInformation SecurityHershey FoodsDiscovery: Network Understanding and ControlThe Discovery phase provides an understanding of the constantly changingnetwork topology and identifies which critical assets may be at risk andwarrant assessment.Assessment: Detect Network WeaknessesAccurately and comprehensively testing the network for any potential weaknessthat could be exploited is the foundation of vulnerability assessment.of use, and deployability ofQualysGuard, it yielded avery cost-effective solutionfor our network.”Peter Albert, Director of OperationsiPass Inc.Remediation: Prioritizing and Managing Corrective ActionsThe final stage of the vulnerability management process involves prioritizingwhat assets are most valuable and remediating the vulnerabilities that pose thegreatest risk to your network via links to verified fixes.frequent, more reliable security“The increasing frequency of cyberattacks requires us to perform moreaudits in order to stay ahead ofvulnerabilities and ensure thatour network is protected. Qualysallows us to conduct daily securityaudits while significantly reducingWEEKSMONTHSYEARSDiscovery ofVulnerability1performance, accuracy, easeAnalysis: Reviewing and Interpreting Audit ResultsSecurity professionals and corporate executives alike need instant access toreliable reports that can provide unbiased answers concerning the security ofthe network and actions required to effectively reduce risks.DAYS2004“When we considered the20032002QualysGuard automates the vulnerability management process, saving time, money,and providing the comprehensive network security testing required for today’s ondemand businesses.our costs.”Robert Noakes, Security SpecialistCalifornia State Lottery20012

Architecture Enables Security On DemandQualys has architected its service from the ground up to automatenetwork security auditing and vulnerability management. Qualys’on demand technology gives companies an automated system toaudit network security from any Internet browser. Since the Qualyssolution is delivered over the Web, customers can run networksecurity audits anytime, without the cost or manpower requirementsassociated with software-based solutions. This unique architectureis the first of its kind.Qualys’ architecture enables security on demand. The architecture consists of:– Web User Interface for anytime, anywhere access– Secure Operations Centers to redundantly store encrypted customer data– KnowledgeBase of vulnerability signatures, updated daily with new audits,patches, and fixes– Internet Remote Scanners to conduct network perimeter audits– QualysGuard Scanner Appliances to conduct internal network auditsQualysGuard’sarchitecture enablesaccurate vulnerabilityscanning, data integrity,and ease of use whiledelivering the lowesttotal cost of ownership.34

The QualysGuard Advantage“Ensuring maximum protectionagainst the latest security threatsof the day is a growing concernwithin our organization. The Qualyson demand technology allowsHighly AccurateAccuracy of the scanner is a primary requirement in choosing a network securityauditing solution. Components of accuracy involve the depth and quality of the auditsin combination with a vendor’s ability to eliminate false-positives.us to audit our security status atany moment and manage networkvulnerabilities on a centralized,enterprise-wide level with a fractionof the resourcesand cost.”Mark Iovinelli, Enterprise Designand Implementation Team ManagerRR DonnelleyQualysGuard leads the industry in scanning accuracy, delivering:– 99.997% overall accuracy (.003% false-positive rate)*— certified by independentauditors and based on over 1 million customer-performed scans each quarter– Nearly 4000 unique vulnerability signatures — 2x nearest competitor– Fingerprints over 500 unique applications, operating systems and protocols —3x nearest competitor– New audits added daily and available in real-time to customers– Disciplined audits only check applicable systems — no unnecessary scans– Non-intrusive audits“QualysGuard enables us toperform security audits as oftenas necessary, sort vulnerabilitiesimmediately as they are added tothe QualysGuard database, andwork proactively to remediate them.This helps us secure all of ourEasy to Use / Robust Management ConsoleThe QualysGuard Web User Interface was designed by business users and securityexperts. This makes using QualysGuard intuitive, yet sophisticated enough to bothanswer high-level business security questions and provide asset-level data for detailedneeds of administrators.network entry points, enforce ICIInstantly DeployableQualysGuard requires no software, existing hardware or software infrastructure,or specific technical expertise. Implementing QualysGuard is simple, fast, andimmediately effective. Whether you scan the network perimeter or test the entireinfrastructure of remote offices, QualysGuard can be up and running in minutes,and be used instantly from any location via a Web browser.“The privacy and security ofour patients’ information is afundamental requirement at CedarsSinai. Qualys provides us with athird-party capability to audit ournetworks for vulnerabilities andprovide verified fixes immediately.With an automated process, wehave significantly reduced ourcosts for network security audits.”Ray Duncan, Director ofTechnology and ArchitectureCedars-Sinai Medical CenterQualysGuard Scanner Appliances can be added effortlessly to securely audit internal networks.“The ease-of-use, its automatedTrusted, Third Party ResultsBecause QualysGuard is Web-based, Qualys maintains the operational integrity,KnowledgeBase, and security architecture of the complete network auditing andvulnerability management system. Unlike user-owned and operated softwaretools, QualysGuard security audit data is tamper-resistant and satisfies regulatoryrequirements of mandates such as Gramm-Leach-Bliley, Sarbanes-Oxley, SB1386,and HIPAA.security policies and assists us inscanning capability, and theoverall value combine to makeQualysGuard an important toolfor us in securely protecting ournetwork and its data.”Stephan Mueller, Sr. Securityand Business SystemsContinuity ManagerFujitsu Siemens Computersmeeting federal requirements.”QualysGuard Benefits vs. Software SolutionsPaul Simmonds, Director ofGlobal Information SecurityBENEFITSImperial Chemical IndustriesQUALYSGUARDSOFTWARE SOLUTIONSDeploymentImmediate, automatedManual, time-consumingScalabilityIncrease scale with noadditional overheadRaises management costQualityFewer bugs, fastresponse on issuesand new threatsMany bugs, slow to fix,manual threat updatesReportingCentralized, dynamic,customizedStatic, hard to customize,not centralizedSecurityEncrypted storage,transit encryptionNo encrypted storageManagementAutomated process,no system managementMaintain hardware, software,database, securityTCOLowest TCO, proven ROIHigher TCO*Average reported false-positives across Qualys customer base, per survey of over one million scans.56