Qualys, Inc. · NASDAQ:QLYS
Qualys — Investor Day (August 2019)
153 slides from Qualys's investor day presentation, Aug 7, 2019
Slide 1: Security at a Crossroads
MAKING THE WORLD SAFER – ONE APP AT A TIME Security at a Crossroads A significant opportunity for Qualys Melissa Fisher, CFO Philippe Courtot, Chairman & CEO Sumedh Thakar, Chief Product Officer Dilip Bachwani, SVP Cloud Platform I N V E S T O R & A N A L Y S T P R O D U C T L U N C H E O N - B L A
Slide 2: Agenda
Agenda Security at a Crossroads What makes Qualys Unique Ubiquity Play Cloud Platform Expansion Blending Data Lake, SOAR, SIEMs, EDR and EPP into our Cloud Platform Summary Designed from the Ground Up for the Digital Transformation
Slide 3: Security at a Crossroads
Security at a Crossroads Fueled by cloud technologies, the The digital transformation has security industry is on the verge of a created an explosion of new massive and accelerated consolidation. technology and opportunities. We believe the market will coalesce into four distinct segments It has lef
Slide 4: Going Back to our Origins – 1999
Going Back to our 72% F50, 61% F100, Origins – 1999 46% F500 and 25% Global 2000 Our Original Mission and Vision DAIMLER Apply nascent Internet Technologies (called now SaaS or Cloud) to automate Vulnerability Assessment making it accurate, continuous and scalable. 12,200+ customers and active users
Slide 5: Where Are We Now?
Where Are We Now? Today’s Mission and Vision Unifying IT, Security and Compliance in a single-pane-of- glass-view with 2-second visibility across on-premises, endpoints, cloud(s), containers, web apps, API, mobile and OT/IoT environments Designed from the Ground Up for the Digital Transformation
Slide 6: Extensible Cloud Platform
Extensible Cloud Platform Serves as a Scalable and Cost-Effective Distribution Channel
Slide 7: State-of-the-Art Microservices Architecture
State-of-the-Art Microservices Architecture Sensors, Data Platform, Microservices, DevOps 3+ Billion scans/year 3+ Trillion data points indexed on our Elasticsearch clusters 3+ Billion messages per day on our Kafka bus
Slide 8: Scalable Go-to-market Strategy
Scalable Go-to-market Strategy The Platform is the Distribution Channel Try & Buy Model - Fully Automated Lead-Gen Campaigns
Slide 9: Ubiquity Play
Ubiquity Play Launch at Black Hat of our Groundbreaking Global IT Discovery and Asset Inventory Apps Our Global IT Asset Discovery and Inventory are two of the many apps we have running native on our Cloud Platform. It will come in two versions: free and paid. What makes it unique: - Our Cloud Agent
Slide 10: Highly Leveraged Business Model
Highly Leveraged Business Model We currently have almost 24 million Cloud Agents installed across on- premises, endpoints, cloud(s), containers and mobile. Our lightweight Cloud Agents (3Mb) currently spawn seven services with more to come. Once the Cloud Agent is deployed, all the additional servic
Slide 11: 1307 Sign-ups in 3 Days
Ubiquity Play Early Results – Early Success 1307 SIGN-UPS IN 3 DAYS 1159 SIGN-UPS 148 SIGN-UPS New Users Existing Users
Slide 12: 2020 New Services and Platform Expansion
2020 New Services and Platform Expansion Launch of Global IT Asset Inventory, Passive Scanning and IOC 2.0 at Black Hat Uniquely positioned to blend Data Lake, SIEMs, EDR and EPP on the top of our Cloud Platform - Q1/Q2 2020 (Beta)
Slide 13: A New Prescription for Cyber Security
A New Prescription for Cyber Security Qualys Global IT Asset Inventory Black Hat Conference August 2019
Slide 14: If we can't see seamlessly across all systems
Unknown user Critical vulnerability Rogue device Malware Zero-day If we can’t see seamlessly Unauthorized software across all systems Suspicious traffic Unpatched software
Slide 15: We made a promise to the world of security…
Quarantined Remediated Patched Mitigated Patched We made a promise to Remediated the world of security… Remediated Quarantined
Slide 16: We made a promise to the world of security…
Quarantined Remediated Patched Mitigated Patched We made a promise to Remediated the world of security… Remediated Quarantined
Slide 17: Today's dynamic environment calls for a
Today’s dynamic environment calls for a
Slide 18: Qualys Global IT Asset Inventory
Qualys Global IT Asset Inventory IT’S NOT FOR EVERYONE.
Slide 19: Slide 19
Slide 20: Side Effects May Include
Side Effects May Include Knowing what’s on your global hybrid-IT environment Providing a single source of truth for all your teams Better decision making using enriched data Improving your security and compliance posture Getting that promotion you always wanted
Slide 21: Global IT Asset Inventory
DEMO Global IT Asset Inventory
Slide 22: Asset Inventory dashboard
@ Qualys. Enterprise Asset Inventory ¥ DASHBOARD INVENTORY de ) W Global IT Assets v @ 01 Jan 20190... CATEGORY BREAKDOWN I Computers [| Virtualized [| Networking Device J Others ll Storage Devices Desktop Server Other Cloud Instance Virtual Machine Other Other ‘Switch Network ServerLoad Remote Othe
Slide 23: Asset Inventory dashboard
@ Qualys. Enterprise Asset Inventory ¥ DASHBOARD INVENTORY 20 Global IT Assets v ® 01 Jan 20190... C+) Fed CATEGORY BREAKDOWN I Computers [| Virtualized [| Networking Device J Others ll Storage Devices Cloud Instanc Virtual Machine: 24 ‘Switch: 7 | urity and Firewall Devices: 6 Other Cloud Instance
Slide 24: Asset Inventory dashboard
@ Qualys. Enterprise Asset Inventory ¥ Global IT Assets v @ 01Jan20190.. ¥ INVENTORY 1] CATEGORY BREAKDOWN I Computers [| Virtualized [| Networking Device J Others ll Storage Devices Network Security and Firewall Devices: 6 |_ ad Desktop = Server . Wing Notebook Other Cloud Instance Virtual Machine
Slide 25: Software type distribution
@ Qualys. Enterprise Asset Inventory v DASHBOARD — INVENTORY 20 Global IT Assets v @ 01Jan 20190... ¥ (+) a SOFTWARE TYPE DISTRIBUTION TOP PUBLISHERS ‘Application “gl - a Microsoft Qualys Apple ‘Adobe Oracle VMware Google 18M Mozilla Python TOP SERVER APPLICATION CATEGORIES I Commercial License [lj
Slide 26: Software type distribution
@ Qualys. Enterprise Asset Inventory v DASHBOARD INVENTORY 20m Global IT Assets v ®@ 01 Jan 20190... ¥ + ee: SOFTWARE TYPE DISTRIBUTION TOP PUBLISHERS Unknown >, 7 \ Microsoft Qualys Apple ‘Adobe Oracle VMware Google 18M Mozilla Python TOP SERVER APPLICATION CATEGORIES I Commercial License [lj Open
Slide 27: ServiceNow Service Automation
SErVICENWOW"™ service Automation fees Welcome: Pablo Quiroga 52, “fy (0) < | 08 Distribution @ ‘Switch to new UI + Run Self-Service @ This record is in the Qualys ITAM App application, but Global is the current application. To edit this record click here. Benchmarks h to new Table Qualys Assets [x_q
Slide 28: ServiceNow Service Automation
WOW" Service Automation tem Run YY | computer Configuration Y Data Center ‘Computer Room Y Base Items we Computers ‘Computer Peripherals ‘System Web Service: ¥ Inbound Computer < == Computer Extended - catcentos73s_QA_REN ¢f Name BIOS Description BIOS Asset Tag CPU Count Processor speed Memory Asset
Slide 29: Obtain in-depth visibility of your assets
Obtain in-depth visibility of your assets
Slide 30: Enterprise IT Infrastructure
@ Qualys. Enterprise Asset Inventory v DASHBOARD INVENTORY 2eu Enterprise IT Infrastructure v ® 01 Jan20190.. ¥ + ee: TOP SERVER HARDWARE SERVER OPERATING SYSTEM PRODUCT MODELS ASSETS © Windows: 239 \ © Linux: 44 Dall Powerkige 6 a « Hows @ Unix: 12 Unidentified 1 | | 2 l \ HPE ProLiant ML310 G2 1 ;
Slide 31: Enterprise IT Infrastructure
@ Qualys. Enterprise Asset Inventory ¥ Enterprise IT Infrastructure v @® 01 Jan20190.. ¥ DASHBOARD INVENTORY e 1] HPE ProLiant DL320eG8v2_ 1 TOP SERVER HARDWARE PRODUC MODELS Dell PowerEdge 6 a Unidentified 1 2 HPE ProLiant ML310 G2 1 2 HPE ProLiant DL320eG8 1 18 SERVER OPERATING SYSTEM > Windows HY
Slide 32: Managed assets view
@ Qualys. Enterprise Asset Inventory ¥ DASHBOARD INVENTORY Managed v Assets [Ruri operatingSystem.category2: ‘Server’ and operatingSystem. category! : ‘Windows* 01 Jan 20190.. ¥| = TOP HARDWARE CATEGORIES TOP OPERATING SYSTEMS CATEGORIES | = —S computers Vinined Windows Group Assets by : OS Name Ma
Slide 33: Design note on the scroll bar
The scroll is good here, but we have to do something about the scroll bar. We may have to make that as a separate object since right now it doesn’t move the right way.
Slide 34: Solve important business problems
Solve important business problems
Slide 35: Java and database inventory
@ Qualys. Enterr Asset Inventory v DASHBOARD — INVENTORY Enterprise IT Infrastructure v > 01 Jan 20190... ¥ ORACLE JAVA JAVA SE VERSIONS EOL JAVA 10 6 Java Platform, Standard Edition (Ja... 1367 ° 4) 7:32 Java se Vevopment nu) 1829 a 303 Java SE Runtime Environment (JRE) 102 Paral ava Versione: 1.37
Slide 36: Java and database inventory
@ Qualys. Enterr Asset Inventory ¥ DASHBOARD — INVENTORY Enterprise IT Infrastructure v @ 01 Jan 20190... ¥ ORACLE JAVA JAVA SE VERSIONS EOL JAVA 10 \ Java Platform, Standard Edition (Ja... 1367 ° 4) 7:32 Java se Vevopment nu) 1829 a 303 Java SE Runtime Environment (JRE) 102 > va All Java Versions 1
Slide 37: Java and database inventory
@ Qualys. Enterr Asset Inventory v DASHBOARD — INVENTORY Enterprise IT Infrastructure v > 01 Jan 20190... ¥ ORACLE JAVA JAVA SE VERSIONS EOL JAVA Java Platform, Standard Edition (Ja... 1367 ° 4) Java SE Development Kit (JDK) 1325 Java SE Runtime Environment (JRE) 102 vs All Java Versions 1.37K (22%)
Slide 38: Software inventory
@ Qualys. Enterprise Asset Inventory v Managed v 37 Total Software LICENSE Commercial 37 PLATFORM 64-Bit 24 UFECYCLE EOL/EOS 21 Assets DASHBOARD INVENTORY ‘Type: Application ¥ | > operatingSystem.category2:*Server* and software: ((product: Java Platfoduc vu 01 Jan 2019 0... TOP SOFTWARE CATEGORIES T
Slide 39: Software inventory
@ Qualys. Enterprise Asset Inventory v Managed v 37 Total Software 21 Assets DASHBOARD INVENTORY ‘Type: Application ¥ operatingSystem.category2: ‘Server’ and software: ((product: Java Platfoduc © 1] 01 Jan 2019 0... TOP SOFTWARE CATEGORIES 40 TOP SOFTWARE PUBLISHERS 40 20 0 Oracle | Group Software b
Slide 40: Software inventory
@ Qualys. Enterprise Asset Inventory ¥ DASHBOARD INVENTORY De © id Managed v Assets ‘Type: Application ¥ | >< atfoduct: Java Platform) and marketVersion:*6") and tags.name: ‘Data Center’ u” | 01Jan20190.. ¥ WA TOP SOFTWARE CATEGORIES TOP SOFTWARE PUBLISHERS: 5 5 Total Software >) LLL ee . ——_ ‘Appli
Slide 41: Track hardware and software lifecycles and licenses
Track hardware and software lifecycles and licenses
Slide 42: End-of-life tracking
Qualys. & Asset Inventory ¥ DASHBOARD = INVENTORY Enterprise IT Infrastructure v @ 01Jan20190.. ¥ (+) EOL OPERATING SYSTEM Windows Server 2012 31 Windows Server 2003 7 Windows Server 2008 R2 24 Windows Server 2008 2 Windows Server 2012 R2 18 Windows Server 2003 R2 " SUSF Linux Fnternrise Server 4 EN
Slide 43: End-of-life tracking
Qualys. & Asset Inventory ¥ DASHBOARD = INVENTORY Enterprise IT Infrastructure v @ 01Jan20190.. ¥ (+) EOL OPERATING SYSTEM Windows Server 2012 31 Windows Server 2003 7 Windows Server 2008 R2 24 Windows Server 2008 2 Windows Server 2012 R2 18 Windows Server 2003 R2 " SUSF Linux Fnternrise Server 4 EN
Slide 44: End-of-life software
Qualys. Enter Asset Inventory ¥ DASHBOARD = INVENTORY Enterprise IT | structure v @ 01Jan20190.. ¥ (+) Windows Server 2003 7 Windows Server 2008 R2 24 Windows Server 2008 a Windows Server 2012 R2 18 Windows Server 2003 R2 " SUSF | inux Fnternrise Server 4 END-OF-LIFE SOFTWARE EOL within 3 months EOL
Slide 45: Find unauthorized software
Find unauthorized software
Slide 46: Software Management
@ Qualys. Enterprise Asset Inventory v DASHBOARD INVENTORY Software Management v @ 01Jan20190.. ¥ (+) LICENSE CATEGORY TOP SOFTWARE PUBLISHERS & Com. © Ope_ Open Source Commercial Qualys VMware Microsoft. Adobe -—=«Unknown Google Oracle Mozilla Apple Python TOP CLIENT APPLICATION CATEGORIES TOP SERV
Slide 47: Unauthorized software
@ Qualys. Enterprise Asset Inventory ¥ DASHBOARD — INVENTORY Software Management v ® 01Jan20190.. ¥ Qo Network Digital Content Productivity Application PRODUCTIVITY en a . Email and Calendar c \ Note Taking Office Suite CRCMECKORONO Application Databases Databases Networking Network Business Develop
Slide 48: Unauthorized software
@ Qualys. Enterprise Asset Inventory ¥ DASHBOARD — INVENTORY Software Management v ® 01Jan20190.. ¥ Qo Network Digital Content Productivity Application PRODUCTIVITY en a . Email and Calendar c \ Note Taking Office Suite CRCMECKORONO Application Databases Databases Networking Network Business Develop
Slide 49: Software search: Rhythmbox
@ Qualys. Enterprise Asset Inventory ¥ Managed v DASHBOARD INVENTORY de © i ‘Type: Application v | >< software: (product: Rhythmbox) 01 Jan 20190. ¥ | 5 TOP SOFTWARE CATEGORIES 5 Total Software 0 “| TOP SOFTWARE VERSIONS Hn ~ . ‘SQL Server Database Engine LICENSE | Group Software by... ¥ | 1-2of 2 +
Slide 50: Software search: Rhythmbox
@ Qualys. Enterprise Asset Inventory ¥ Managed v DASHBOARD INVENTORY de © i ‘Type: Application v | >< software: (product: Rhythmbox) 01 Jan 20190. ¥ | 5 TOP SOFTWARE CATEGORIES 5 Total Software 0 “| TOP SOFTWARE VERSIONS Hn ~ . ‘SQL Server Database Engine LICENSE | Group Software by... ¥ | 1-2of 2 +
Slide 51: Assets running selected software
@ Qualys. Enterprise Asset Inventory v Managed v 4 Total Assets MANUFACTURER HPE Unidentified TAGS Cloud Agent Software DASHBOARD INVENTORY < software: ((product: Rhythmbox) and fullName:*The GNOME Project Rhythmbox 2 2.96°) 01 Jan 20190... ¥ TOP HARDWARE CATEGORIES TOP OPERATING SYSTEMS CATEGORIES
Slide 52: Assets running selected software
@ Qualys. Enterprise Asset Inventory v Managed v 4 Total Assets MANUFACTURER HPE Unidentified TAGS Cloud Agent Software DASHBOARD INVENTORY < software: ((product: Rhythmbox) and fullName:*The GNOME Project Rhythmbox 2 2.96°) 01 Jan 20190... ¥ TOP HARDWARE CATEGORIES TOP OPERATING SYSTEMS CATEGORIES
Slide 53: Asset details
@ Qualys. Enterprise < Asset Details: srv00147 y INVENTORY Asset Summary Asset Summary ‘System Information stv00147 Rename Network Information ‘SUSE Linux Enterprise Server 12 11 SP3 Open Ports HP / ProLiant ML150 G2 Installed Software Traffic Summary Identification DNS Hostname: srv00147 y SECURITY
Slide 54: Identify unknown assets that connect to the network
Identify unknown assets that connect to the network
Slide 55: Unmanaged assets
@ Qualys. Enterprise Asset Inventory ¥ DASHBOARD — INVENTORY de © 1] Unmanaged Assets v @ 01Jan20190.. ¥ UNMANAGED (PASSIVE SCANNING) UNMANAGED ASSET CATEGORY OS TYPE CONFIDENCE Total Desktop ‘MEDIUM meet w~— 2.54K view : “| \| \\| © Mobile 629 © Windows 621 © Mac a7 © Linux 7 7 © Unidentifieds ‘Sma
Slide 56: Unmanaged assets
@ Qualys. Enterprise Asset Inventory ¥ DASHBOARD INVENTORY 20 Unmanaged Assets v ®@ 01Jan 20190... ¥ t+ es: OnePlus 101 44 39 a. “ Apple 90 Lenovo 70 ‘Samsung s7 Unidentified 52 Huawei 30 WINDOWS OS MAC OS USERS WITH UNMANAGED ASSETS | ACCOUNT USERS COUNT — jsmith/ACME @) jsmith/WEB.ACME.COM 1 High
Slide 57: Unmanaged asset search
@ Qualys. Enterprise Asset Inventory v Unmanaged v INVENTORY De © i >< 001142-2381N Last30Days ¥| = 1 TOP HARDWARE CATEGORIES ‘TOP OPERATING SYSTEMS CATEGORIES 5 5 Total Asset ———————E—— 0 Dn ‘Unidentified Windows meataen 1-10f1 +60u% Unidentified 1 ASSET OPERATING SYSTEM HARDWARE — Notebook LUST US
Slide 58: Unmanaged asset search
@ Qualys. Enterprise Asset Inventory v Unmanaged v 1 Total Asset DASHBOARD INVENTORY De © i >< 001142-2381N Last30Days ¥| = TOP HARDWARE CATEGORIES ‘TOP OPERATING SYSTEMS CATEGORIES 5 5 ———————E—— 0 a ‘Unidentified Windows 1-1o0f1 +ObK% ASSET OPERATING SYSTEM HARDWARE Notebook LAST USER INVENTORY 00
Slide 59: Passive scanner asset summary
@ Qualys. Enterprise y SENSORS Passive Scanner ‘470P Asset Summary PT] 001142-Z381N Microsoft Windows 10 Unidentified Identification Hostname: 001142-Z381N FQDN: 001142-Z381N NetBIOS Name: - Mac Addresses: 34:41:5d:2a:b9:58 IPv4 Addresses : 192.168.251.66 IPv6 Addresses : fe80::0418:12cc:2016:68fe A
Slide 60: Passive scanner asset summary
@ Qualys. Enterprise Passive Scanner ‘470P Asset Summary PT] 001142-Z381N Microsoft Windows 10 Unidentified Identification Hostname: 001142-Z381N FQDN: 001142-Z381N NetBIOS Name: - Mac Addresses: 34:41:5d:2a:b9:58 IPv4 Addresses : 192.168.251.66 IPv6 Addresses : fe80::0418:12cc:2016:68fe Asset ID: 8
Slide 61: Traffic summary
@ Qualys. Enterprise < Asset Details: 00114: y INVENTORY ‘Asset Summary ‘System Information Network Information Open Ports Traffic Summary y SENSORS Passive Scanner 381N Traffic Summary Q Search for traffic details. [oan | Client Server TRAFFIC VOLUME © Click and drag in the plot area to zoom in ING
Slide 62: How is this possible?
How is this possible? CLOUD-BASED ARCHITECTURE
Slide 63: Slide 63
Slide 64: Global IT Resources dashboard
@ auaiys Global IT Resources ° ASSETS WITH ZERO-OAY VULNERABILITIES 200 rusnene INDICATION OF COMPROMISE ASSETS ‘ls Fait conTRoLs 58 sp tlanen ase Q2K parson) Global IT Asset Inventory AGED ASSETS
Slide 65: Global IT Resources dashboard
@ Qualys. Global IT Resources {> All Tags (12/12) | [ (§§ All Business Units *| [ @) All Locations | [= Last 90 days | (+) ASSETS WITH ZERO-DAY ASSETS WITH MISSING CRITICAL INDICATION OF COMPROMISE ASSETS CIS FAILED CONTROLS VULNERABILITIES PATCHES 200 " Aulasoea 2.5k (8%) 20 eS ppg 2.5K (0.8%) 58 ¢
Slide 66: IT Security dashboard
id Web Server Database IT Security NEW SEV 5 VULNERABILITIES 126 Y 75.0% showing last 30 days ASSETS WITH FAILED PATCH INSTALLS 4 vy 57.01% showing last 30 days ~~ 4 Web Application Backup and Recovery TOP EOL SOFTWARE CATEGORIES ASSETS WITH MISSING PATCHES 10 450% showing last 30 days a Sev1 TOTAL
Slide 67: Certificates and compliance dashboard
EXPIRING CERTIFICATES CERTIFICATES BY ISSUING AUTHORITY CERTIFICATES BY GRADE {634 1.1k Total B Total co Comodo Unapproved Compliance CIS POSTURE BY STATUS CIS CONTROLS BY CRITICALITY FEDRAMP POSTURE BY STATUS FAILED FEDRAMP CONTROLS BY CRITICALITY 65% 256K 23% 103 Passing Controls Passing Controls
Slide 68: Cloud & Container Security
Status of the ‘Icredit’ setting within the ‘pam_pwquality’ PAM module Status of the ‘syslog-ng' service Cloud & Container Security SECURITY POSTURE BY REGION Region: 858 Total AWS. Compute SECURITY POSTURE 1.2K All Storage @ High Database Networking @ Medium Critical Critical ae a % CLOUD CATEGORIES
Slide 69: Cloud and web application security
SECURITY POSTURE CLOUD CATEGORIES BY SEVERITY @ High @ Medium @ Low @ High @ Medium @ Low ce TT [le 1.2K ¥ 1.9K .6K ( Database ET et La Networking EN [NN NN aws AWS MA bre © Google 0 50 100 150 200 250 300 Compute EE nn 2 CONTAINER DISTRIBUTION CONTAINER DISTRIBUTION BY VULNERABILITY SEVERITY ROGUE
Slide 70: Responding to a suspicious device
Responding to a suspicious device
Slide 71: Slide 71
Slide 72: aad y sais
aad y sais ASSN ne WYLESAQASS \easSasnnany, SSMU, NASER EER, SS SN Whe RNIN wq S S\N Satas. S RAIA AAS s 3 s 8 a 9 » NERA EANETER, Nat\aag > Nissin Saas, x Se tangence RaROEA ~ Rasheed S ‘Nantkowedt Ss Rasheed, NISHA, \ RSs, x ~ SSR, RSS, SS SN Neen Saseeneny, Yesaetness,
Slide 73: aac: —
aac: — ~ WL sxcas, WYESAUASR Jeanna, REN NANI EAR = Seetocematen DG w= Ya N \ EN RCE WRN ATE WWM Arie, ~*~ WQWQ. inetiitien, oS Ne Rt, ARR. ARRRAER ARAM, - See * Rete —e ~ WRAL OMEN, RRAKAME EEE, S SSN ~ Rastoewed, S ‘Nanhowedt S Rashowel x RISA, ~ Rasta, \ ~ SAO RSSA, \ RISA \egeasaeneny, EARNS,
Slide 74: Threat Protection
THREAT PROTECTION RTIS 68 Tort ATis @ Zero Day Easy Exploit DOS attack ® Exploit kit Public Exploit High Data Loss @ Active Attacks High Lateral Movement Unpatchable @ Malware
Slide 75: Raa yp csasics
Raa yp csasics S\N -. SRAR SIENA YESSY, BSNS SSSI Neath, Eas, SSE, ee, SS ASNe ES AN ASSES INETY, Wiese, x A REQ x TSS SERA, aS RS NSESTOEaN uae ~ Aiwa, ~~ ~ b Nee _ MAS, Ss } Woe ts, nu N SWAG sree, x Wineiiinn, Tea senian S S ee TREATS GANA, SK Rw me WEAN Osivan Aan thea QAEDA, WS YSEANISO OME RED
Slide 76: Raaady csasics
Raaady csasics RAA’SIAISNSAL AE \, SSNS SSS SNS wether, WHEN, W ~ WRAY RARQRRNENA. EEMEER SENDS SSSEE ED TREN. NES. SEERA, SAA LGRAEQR.. NSESAMAR ax IS. SenS has. WSS. QEEA ~ TARE. NEGA Ya (18, + SER RSME. Wea. EE Sa SERGE NESSES Ua IS, YOST), RERSNRSREL USSSA ‘ —_ eens,
Slide 77: ara saci
ara saci RAAQSIAQSNSAL YSSRSSENRANY, a = WERNER = = SHO SEE, — aes. SSN SSNS Awe IN WUsA A TR sutast “R Noes. RUAN, Castes WRN, we > SRO RARQRENEDA. EREER | SENDS. SEES TARE. NES. EEE, RRMLGRAEEQE.. NESRAMAL Ua 1S. Renesas... Weeks. WERE, =~ TARE. MEGEARA Ya (1S, + SER RSME. Wea. WE <=. RERRERQERELA
Slide 78: Raaady csasics
Raaady csasics SSS NSAS VAR MS ~ SQL 5 a = XQSCAQAT TAMIA Yes Sasnmany, sae. 5 eee ere NY TAWHENS NSARM, QREtas, SSS } MALWARE CATEGORY WAR IAA Ne ASEER, ON ’ SS SSAA, ssa ® SN zw ANT. Sh yw x ~ WW was WS x Twme 8 TR veo. SS ARWRERTER, Rae _ SSN <5} SS PAS NahaR NER NSREAGR CANES, ASQ QOS Getic —= =
Slide 79: Ras rnesice
Ras rnesice | SSS SSA MASEL YeaeSoanenay, sae re DRANG EENS, TWeRs SAOSIN, AEEkus DW EAA WE WAIN ARRAS, rahe) ‘ ~~ ~ ~ . . S SN : SS é SS Q ora 8 : ~N cw ~!N we XN ww 4 ESSN . wag HNN Tose . oS A QHERR ica, <a oN = wag Nenangenes \SREAERARAEESEE, > NY 4 xtiieasn, WY SH Wh. SSS, xX — _ _ + ROE, AREA
Slide 80: Raaady csasics
Raaady csasics — + WRAL _— - XQSCAQAT TAMIA Wea aaenany, — XS TSS RAKE CAREEEY STS TsHENs SHO SIRE Eras WEA, SW WSAUASGA SEERA Ee, AAS NENEN, sa SSD AsasEie Ns. Ns. Bose 4 Aw x ~r os g + WD inexiitien, NS Ri, aR NaA NEL NSREAGR CANES, VAS Geiicass, AN SS x » WSDINS, MRR Racha AS RAR AERIS SAARI, AAS
Slide 81: Ras rnesice
Ras rnesice | SSS SSA MASEL VesrSaenneny SaaS ‘ rare >. SASRRE. KREAEHY ATES CANES BS SSN os WERE WE SASS sashes, AACN, : a an RAS OA ~R x g ~ WW Ane, ARRANGES as enn. atiaaiand! ~ eck 4 RESKEESRER, atheten, A, SQ MB, Wh. x SS Nae a SSS YETI. TERE SAE RD MAAN aia, AMIDA, Nessa, SO ~N a ASR ANNAN AEN
Slide 82: File details
SESS INNS NWEAAIAS NN \ \retean \ wen WOR Wartane. NREIRAN RAAT, ae ~ Nemtame. RELA aha SERS. YX AIAG Rh ANTS) Ss \ SINISE tee SERRE DISEINANNS, Net SAATE. YING Rw - Wapato SS EY NXSAAS FILE DETAILS Neate File Action: : File Name: fe Path: Full Path: Mos: 186131 e ‘ 5 ‘SHA2S6: b9219a09t f fb 6d378f
Slide 83: Ras rnesice
Ras rnesice NWEAAIAS . \ \ etas, wen SAS WAG oer. Nee RANE RAEN Sane. AS arcane. SAGA Yaka. YEENE WAQAG we. y SAT SES x. SSRIS ESRI ISIN, SES NWERRAMRRCAIS, TATIONS. —— . RENE. Se WS NX SSS “sees Ets AE. SERS : cake SS erase Nee E ARES, Nase. ax Yas RASS HERES SHENTON GSAT; Sharan, RA GaA SUES HERE
Slide 84: . SX ARISALSS AGN ANEMONE LEO S)\ =
. SX ARISALSS AGN ANEMONE LEO S)\ = VT Ne STIS GS AHSIN TAPE ESA CESSES OEE, TAN WIAA TERI, > SS g SRSA ANA ASIN, cs Atanas ese, VEE LRG (RAIS ERAN CTA, NN Yate, DQ Sshaoss, orcs, ]DQ Bassas bags CANT ISESST, SSS DH GARE WAST DH wee SEI Waar, ]D a AaksNNRMARAIINOTR Ws, Qes > hoes, WOR DH AGE Vs KAVA
Slide 85: Rule Details
@ Qualys. Enterprise Rule Details Provide the following information to create the rule Rule Information Rule Name Required Notify when Malware is Detected - 2 within 30 mins Description Required Notify when Malware is Detected - 2 within 30 mins Rule Query Provide a query to match particular source
Slide 86: Edit Rule: Trigger Criteria
@ Qualys. Enterprise < Edit: Rule Trigger Criteria Provide the match criteria Trigger Criteria Required Time-Window Count Match Y Time-Window Count Match No Of Matching Events Required In Required [2 | [x0 | [wns | Aggregate Alerts Aggregate Group [ves : Asset Host Name Y | Action Settings Choose an
Slide 87: Send Email action
@ Qualys. Enterprise < Edit: Rule Send Email Recipient Required ccarlson@qualys.com Subject Required | agg: Malware Detected on S{asset hostName} [S{indicatorscore}] ${malware-farnil | Message Required Insert token Malware Detected on host Sfasset.hostName} ‘Score: ${indicator score} Filename: $ffil
Slide 88: Ras rnesice
Ras rnesice NWEAAIAS . \ \ etas, wen SAL WAG ~Watane, Sees SAAS IE, Sssse. ~ Naateme AEE Rakes WINE SSA We. sy SAT SES S. SSSR SRST REL DIONNE, SES Neen taenshinas, YETTA, ew. = SWeENTNE. SS NSS NX XI SSS Rasta ASEAG ‘ate asian, SEES 2 —~ SS Sane, eR AINE, Sse. ww Yas. AHS S ATS GaN SAB SiG CUES HHT
Slide 89: Manually apply policy
Manually apply policy Something about what the user will need to know about the fields below. Policies Reason
Slide 90: Manually apply policy
Manually apply policy Something about what the user will need to know about the fields below. Policies Quarantine policy for vulnerable employee laptops Reason
Slide 91: Searching for a critical exploit
Searching for a critical exploit
Slide 92: Threat Protection live feed
@ Qualys. Enterprise Threat Protection v | tev | marketing Teomy | Log out Dashboard Feed Assets Configuration Saved Searches ~ . Contents _CVE-2019-0708 HIGH RATED FEED 194 June 17, 2019 Oracle WebLogic Deserialization Remote Code Execution Vulnerab Live Threat Intelligence Feed Recently a highly c
Slide 93: CVE-2019-0708 feed
@ Qualys. Enterprise Threat Protection v Dashboard Feed Assets Configuration Step y Marketing Team Log out Saved Searches ~ Contents CVE-2019-0708 Power + savores May 14, 2019 Microsoft Remote Desktop Services (RDP) Remote Code Execution Live Threat Intelligence Feed Introduction: Microsoft has rele
Slide 94: CVE-2019-0708 feed
@ Qualys. Enterprise Threat Protection v Dashboard Feed Assets Configuration Step y Marketing Team Log out Saved Searches ~ Contents CVE-2019-0708 Power + savores May 14, 2019 Microsoft Remote Desktop Services (RDP) Remote Code Execution Live Threat Intelligence Feed Introduction: Microsoft has relg
Slide 95: Remote Desktop Services RCE Vulnerability
‘O) Qualys. Threat Protection Microsoft Remote Desktop Services (RDP) Remote Code Execution Vulnerability — CVE-2019-0708 Posted by Mandar Jadhav on May 15, 2019 In lion: Microsoft has released fixes for a very high-risk vulnerability (CVE-2019-0708, aka BlueKeep) in this Patch Tuesday that impacts
Slide 96: SUCCESSTU! CXPIONAUON aN alacner Call Galli COGS CXSCUUION ON WG VUINCTADIS SYSIOMS. AN allacner
SUCCESSTU! CXPIONAUON aN alacner Call Galli COGS CXSCUUION ON WG VUINCTADIS SYSIOMS. AN allacner COUG en Ista programs; view, change, or delete data; or create new accounts with full user rights. Customers running Windows 8 and Windows 10 are not affected by this vulnerability. Vulnerability: The vu
Slide 97: CVE-2019-0708 feed
@ Qualys. Enterprise Threat Protection v Dashboard Feed Assets Configuration Step y Marketing Team Log out Saved Searches ~ Contents CVE-2019-0708 Power + savores May 14, 2019 Microsoft Remote Desktop Services (RDP) Remote Code Execution Live Threat Intelligence Feed Introduction: Microsoft has rele
Slide 98: Vulnerability Management results
@ Qualys. Enterprise Vulnerability Management DASHBOARD = VULNERABILITIES = SCANS = REPORTS ~—s- REMEDIATION = ASSETS KNOWLEDGEBASE —USERS be © 1] Vulnerabilities se Vulnerability ¥ | >< vulnerabilities. vulnerability. cveIds:CVE-2019-0708 ap 6 | Asset | Vulnerability | [ Group By:..._¥ | | VP Filte
Slide 99: Patch Management dashboard
@ Qualys. Enterprise Patch Management DASHBOARD PATCHES ASSETS JOBS —_ CONFIGURATION FJJ-NP-CVEs Per Year View v PATCHES BY STATUS HOST ASSESSMENT STATUS Failed Success Already Installed — Scanned Pending MISSING PATCHES BY PLATFORM TOP 10 MISSING PATCHES / CVES MISSING PATCHES BY TYPE Total Tame CV
Slide 100: Patch Management dashboard
@ Qualys. Enterprise Patch Management FJJ-NP-CVEs Per Year View v PATCHES BY STATUS Failed MISSING PATCHES BY PLATFORM Success TOP 10 MISSING PATCHES / CVES DASHBOARD PATCHES ASSETS JOBS —_ CONFIGURATION HOST ASSESSMENT STATUS @ Scanned: 36 sa © Pending: 13 B Scanned Pending MISSING PATCHES BY TYPE
Slide 101: Patch Catalog
@ Qualys. Enterprise Patch Management © DASHBOARD PATCHES Patch Catalog ASSETS JOBS CONFIGURATION (patchStatus:Missing and cve:"2019-0708") and cve: ‘CVE-2019-0708" ) Actions (0) ¥ 1-60f 6 Total Patches PATCH STATUS PATCH TITLE > ARCHIT BULLETIN / KB TVPE ao SEVERITY MISSING INSTALLED PATCH STATUS —
Slide 102: Patch Catalog
@ Qualys. Enterprise Patch Management © Patch Catalog ) Total Patches PATCH STATUS ‘APP FAMILY Windows VENDOR Microsoft UPDATE TYPE Security Patches Non-Security Pat... TYPE os ‘VENDOR SEVERITY Critical ns PATCHES ASSETS JOBS CONFIGURATION >< (patchStatus:Missing and cve:"2019-0708") and cve: ‘CVE-2
Slide 103: Patch Catalog
@ Qualys. Enterprise Patch Management © Patch Catalog ) Total Patches PATCH STATUS ‘APP FAMILY Windows VENDOR Microsoft UPDATE TYPE Security Patches Non-Security Pat... TYPE os ‘VENDOR SEVERITY Critical ns DASHBOARD PATCHES ASSETS JOBS CONFIGURATION >< (patchStatus:Missing and cve:"2019-0708") and c
Slide 104: Create: Deployment Job
@ Qualys. Enterprise < Create: Deployment Job STEPS 1/6 Basic Information 9 Basic Information Create this deployment job by selecting assets and patches to be installed. Also define the deployment schedule and configure message options you want to display as reminders. Select Assets Select Patches T
Slide 105: Create: Deployment Job
@ Qualys. Enterprise < Create: Deployment Job STEPS 1/6 Basic Information 9 Basic Information Create this deployment job by selecting assets and patches to be installed. Also define the deployment schedule and configure message options you want to display as reminders. 2. Select Assets 5 Select Patc
Slide 106: Select Assets
@ Qualys. Enterprise | < Create: Deployment Job STEPS 2/6 Select Assets Basic Information Select the assets you want this job to deploy patches on. Select Assets Include the following assets. Select Assets 3 Select Patches I 4 Schedule I There are no assets selected s Options 1 Take me to asset sele
Slide 107: Slide 107
Slide 108: Slide 108
Slide 109: Slide 109
Slide 110: Slide 110
Slide 111: Slide 111
Slide 112: Slide 112
Slide 113: Slide 113
Slide 114: Slide 114
Slide 115: Slide 115
Slide 116: Slide 116
Slide 117: Slide 117
Slide 118: Slide 118
Slide 119: Slide 119
Slide 120: Slide 120
Slide 121: Slide 121
Slide 122: Slide 122
Slide 123: Slide 123
Slide 124: Slide 124
Slide 125: Slide 125
Slide 126: Security built in Azure – not bolted on
Security built in Azure – not bolted on
Slide 127: Slide 127
Slide 128: Slide 128
Slide 129: Slide 129
Slide 130: Slide 130
Slide 131: Slide 131
Slide 132: Slide 132
Slide 133: Slide 133
Slide 134: Slide 134
Slide 135: Slide 135
Slide 136: Slide 136
Slide 137: Slide 137
Slide 138: Slide 138
Slide 139: Slide 139
Slide 140: Drastically reducing false alert
False Alert Drastically reducing Compromised The ability to respond in
Slide 141: We cannot secure
False Alert We cannot secure Compromised
Slide 142: Qualys Global IT Asset Inventory
Qualys Global IT Asset Inventory
Slide 143: Slide 143
Slide 144: It's free and comes with unlimited assets
It’s free and comes with unlimited assets. QUALYS.COM / INVENTORY
Slide 145: Data Lake and Security Analytics
Data Lake and Security Analytics
Slide 146: Data Lake and Security Analytics - Goals
Data Lake and Security Analytics - Goals Provide a coherent and actionable view of your security posture by breaking down security data silos Coalesce all data into a centralized highly scalable security data lake Leverage the strength of Qualys Cloud Platform, Cloud Agent and Apps to build a compre
Slide 147: Data Lake and Security Analytics - Objectives
Data Lake and Security Analytics - Objectives Combine and enrich Qualys generated findings and telemetry with third-party signals (firewall logs, IDS, IPS, user data, threat feeds, etc.) to provide: • Real-time streaming correlation and analytics solution • Out-of-band batch analytics to generate un
Slide 148: Advanced Correlation and Analytics
Advanced Correlation and Analytics ML/AI Service Orchestration & Automation UEBA Patterns | Outlier | Predictive SoC Integration | Playbooks | Response User & Entity Behavior Analytics Threat Hunting Security Analytics Advanced Correlation Search | Exploration | Behavior Graph Anomaly | Visualizatio
Slide 149: Correlation and Data Platform Architecture
Correlation and Data Platform Architecture Qualys Stream and Batch Processing Qualys Streaming Data Backbone Qualys Connectors API Networ End k Point Apps Firewall Clou Server d UI IoT Users
Slide 150: Threat actor attack scenario
Threat Actor Threat Actor IT Infra Security Targets webserver Could NOT Events Infra Events with known vuln exfiltrate the CVE-2018-7600 sensitive info (Drupalgeddon 2) Continuous Logging from Qualys Apps and 3rd Passive Party Sensor Logs Correlation Threat outbound C2 SOAR Engine Storyline traffic
Slide 151: Accelerated Security Analytics Practice
Accelerated Security Analytics Practice • Robust security incident detection and management • Centralized auditing for compliance • Comprehensive orchestration • Detection, protection and response • Out-of-box and real-time threat hunting and forensic capabilities … all built on top of a very robust
Slide 152: Summary
Summary Bringing a Unique Value Proposition to our Customers and Investors Global IT Asset Discovery and Inventory as a free service for all Enabling stack consolidation with 19 apps native on the Qualys Cloud Platform providing a single pane of glass view Helping build security into their Digital T
Slide 153: Thank You
MAKING THE WORLD SAFER – ONE APP AT A TIME Thank You pcourtot@qualys.com sthakar@qualys.com