Slide 1: Getting a Handle on Your EOL Software; the Overlooked Aspect of Cybersecurity
Getting a Handle on Your EOL Software; the Overlooked Aspect of Cybersecurity Ed Rossi Vice President Asset Inventory & Discovery
Slide 2: Agenda
➢ Overview ▪ EOL Challenges & Examples ▪ Qualys Solution ➢ Demo Agenda ➢ Client Session Experiences in managing EOL Assets ➢ Q/A
Slide 3: End of…Sale/Marketing, Life, Service
End of…Sale/Marketing, Life, Service • End of Sale/Marketing (EOM) – When a company stops selling a product • End of Life (EOL) – When a company limits support for a product • End of Service (EOS) – When a company completely stops supporting a product Note: Not every vendor uses the same terms or pu
Slide 4: End of Life Is the Beginning of Life For Hackers!
End of Life Is the Beginning of Life For Hackers! * IBM Security; Cost of a Data Breach Report 2020
Slide 5: Use Case: EOS Software is no longer actively managed or patched by the vendors
Use Case: EOS Software is no longer actively managed or patched by the vendors • Increases the chance that a vulnerability will be identified and exploited
Slide 6: Adobe Flash Shutdown Halts Chinese Railroad
SS SSS Adobe Flash Shutdown Halts Chinese Railroad for Over 16 Hours] - Before Pirated Copy Restores Ops & 11 NN Fp Ee! ’ sal f I} % i tor a a A j if, r i AY r ii ; yee tk ia! dy al A Ay ‘ - > ; s* = . = . : él) PAY Wilts 1 Pan 4
Slide 7: Adobe Flash Trends at a Glance
Adobe Flash Trends at a Glance (Qualys Customer Summary) 7 Million Assets with Adobe Flash Server 7% Instances Cloud Instance Notebooks 25% 15% 35% 29% Virtual Machines 17% Desktop Impacted Impacted 23% Clients Assets 21% Clients with Flash on a Server
Slide 8: Use Case: Running afoul of Regulatory & Compliance rules and Security Audits
Use Case: Running afoul of Regulatory & Compliance rules and Security Audits Entities must “implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level." - Section 164.308(a)(1)(ii)(B) All organizations must "Ensure that all system components and
Slide 9: Additional Use Cases
Additional Use Cases • Harder to support; increases costs • Paying for maintenance with no benefit • Lack of Compatibility • Limited Performance & Scalability
Slide 10: Solution – How to Manage EOL/EOS Software
Solution – How to Manage EOL/EOS Software Inventory & Identify Visualize Remediate Categorize Automate
Slide 11: Challenges – Volume, Velocity, Variance
Challenges – Volume, Velocity, Variance High Volume High Variance Acquisitions Skype → Microsoft Product Communicator → Lync → rebranding Skpe for Business → Teams Specs HW/OS Apps Config “A” means “B” lync.exe = Skype for Business MSFT, Microsoft Corporation, Changing at High Velocity Name variance
Slide 12: Inventory - Always up-to-date, real-time view of your Global IT Assets in a Hybrid IT
Inventory - Always up-to-date, real-time view of your Global IT Assets in a Hybrid IT On-Premises Clouds NETWORKS VMs DB BARE METAL STORAGE Mobile OT/IoT Work Workforce Stations
Slide 13: Qualys Global IT Asset Inventory
Qualys Global IT Asset Inventory Not your ordinary inventory tool. Unlimited, continuous Normalization & Detailed asset discovery categorization information Powerful Advanced asset Dynamic tagging search information
Slide 14: Building a Comprehensive Asset Inventory
Building a Comprehensive Asset Inventory Cloud Agent, Mobile Device Agent Network Scanner Cloud Connectors & Container Sensors Passive Sensor
Slide 15: Identify - Qualys EOL/EOS Content & Process
Identify - Qualys EOL/EOS Content & Process Content Sources Processes Continuous Content update via Seamless updates via Cloud Based Automated Gap fill Process EOL/EOS Platform Content Proactive Content update via Complex vendor analysis via Key Vendor based Research Expert Team of Researchers Autom
Slide 16: Visualize - Dashboards
Visualize - Dashboards ▪ Dynamic and customizable dashboards ▪ Pre-Defined views of EOL/EOS data
Slide 17: Remediate – Update or remove the software
Remediate – Update or remove the software Qualys Patch Management • Update to a supported version A single solution to patch operating • When still needed systems (OS) and third-party applications • When under maintenance Cloud-based solution that …using Qualys Patch Management is easy to deploy and
Slide 18: Extend your EOL Data Use With Qualys CMDB Synch for ServiceNow
Extend your EOL Data Use With Qualys CMDB Synch for ServiceNow Qualys 2- way CMDB • Brings in EOL data for use by CMDB Users Sync • Up-to-date, complete, structured, and enriched ServiceNow CMDB • Automatically maps to Configuration Item (CI) Classes
Slide 19: Quick Demo
Quick Demo
Slide 20: Client Session
Client Session Newburyport AS Bank My
Slide 21: Thanks for joining us!
Thanks for joining us! What’s Next? Ask your TAM About Global Asset Inventory and our Enrichment Module or email Product Management at: erossi@qualys.com pquiroga@qualys.com