Qualys, Inc. · NASDAQ:QLYS
Qualys — Technical Presentation (2021)
160 slides from Qualys's technical presentation, 2021
Slide 1: Cloud Security Assessment and Response
Cloud Security Assessment and Response Shyam Raj Lead Technical Trainer
Slide 2: Training Documents
Training Documents • Cloud Security Lab Tutorial Supplement • Cloud Security Slides • You will find the training documents for this course below this training video (at the very bottom of the page) • No trial accounts are provided for this course, all labs are simulated
Slide 3: Play Lab Tutorials
Play Lab Tutorials Click to open Lab @ Tutorial. ‘Navigate to the following URL to view the “Configure Agents for VMDR” tutori: [PLay 9 htto://ior.ad, Maximize Screen 15 steps /3 mins Configure Agents for VMDR Click Start Button
Slide 4: Agenda
Agenda • CloudView o CloudView Connectors o CloudView Resources o CloudView Dashboard and Monitor o CloudView Policies and Controls o CloudView Responses o CloudView Remediation o CloudView Exceptions o CloudView Reports o CloudView Access Management • Infrastructure as Code scanning • Securing AWS
Slide 5: Introduction to CloudView
Introduction to CloudView
Slide 6: CloudView
CloudView • Continuously discover resources in your public cloud deployments • Provides historical and near real-time views of your inventory • Understand the relationships between your resources • Assess resources for misconfigurations and non-standard deployments using out-of-the-box or custom-def
Slide 7: CloudView Connectors
CloudView Connectors
Slide 8: Connectors
Connectors • Configuration that allows Qualys to aggregate data from your cloud provider accounts via cloud service provider APIs • Support for Amazon Web Services, Microsoft Azure, and Google Cloud Platform • Can be disabled and enabled
Slide 9: AWS Connector
AWS Connector
Slide 10: AWS Connector
AWS Connector • One connector per AWS account • Create cross-account access with your AWS account using IAM roles • Supports Global, US GovCloud, and China region • Use the same cross-account role trust for AssetView connector
Slide 11: AWS Connectors
AWS Connectors 1. Create an IAM role from the AWS Management Console • Provide Qualys AWS account ID and External ID • Alternatively, use your own AWS account as base account for connector • Attach “SecurityAudit” permissions policy 2. Use the IAM role ARN to create connector in Qualys CloudView
Slide 12: Create AWS Connector – Select Trusted Entity
Create AWS Connector – Select Trusted Entity When creating the IAM role, provide: • Qualys AWS Account ID • External ID
Slide 13: Create AWS Connector – Attach Permissions Policy
Create AWS Connector – Attach Permissions Policy SecurityAudit policy is a pre-defined AWS policy that provides read and list permissions on resources
Slide 14: Create AWS Connector – Review
Create AWS Connector – Review
Slide 15: Create AWS Connector – Summary
Create AWS Connector – Summary Provide the Amazon Resource Name (ARN) of the IAM role on the CloudView connector creation page
Slide 16: Create AWS Connector – Summary
Create AWS Connector – Summary AWS Connector • provide the IAM Role ARN from AWS • set the desired polling frequency (1 hour to 24 hours, default is 4 hours)
Slide 17: AWS Connector Summary
AWS Connector Summary The Connector summary shows connector status, regions monitored, and resources discovered
Slide 18: Create AWS Connector – CloudFormation Template
Create AWS Connector – CloudFormation Template
Slide 19: Create AWS Connector – CloudFormation Template
Create AWS Connector – CloudFormation Template Provide a stack name for the CloudFormation template
Slide 20: Create AWS Connector – CloudFormation Template
Create AWS Connector – CloudFormation Template When the stack creation is completed, copy the IAM role ARN and provide it on the Qualys CloudView console
Slide 21: CloudView Base Account
CloudView Base Account Base Account • use your own AWS account for AWS API queries from CloudView • provide AWS Account ID, access key, and secret access key • required for creating a connector for China region
Slide 22: Azure Connector
Azure Connector
Slide 23: Azure Connector
Azure Connector • One connector per Azure subscription • Supports Global, and US GovCloud • Following information is required to create a connector: • Application ID • Directory ID • Authentication Key • Subscription ID • Use the same application ID for multiple subscriptions/connectors
Slide 24: Create Azure Connector – Register an application
Create Azure Connector – Register an application Registering an app with Azure AD provides an application definition to Azure and allows the service to know how to issue tokens to the application
Slide 25: Create Azure Connector – Authentication Key
Create Azure Connector – Authentication Key Provide a secret key to authenticate to the application
Slide 26: Create Azure Connector – Add API Permissions
Create Azure Connector – Add API Permissions API permissions: • Connector requires programmatic access to Azure services • Allow user_impersonation permission to allow the connector to get access on behalf of a user
Slide 27: Create Azure Connector – Add Reader Role
Create Azure Connector – Add Reader Role Reader role: • Built-in Azure role • Allows viewing of all resources (except secrets) but does not allow making any changes
Slide 28: Create Azure Connector – Create Custom Role
Create Azure Connector – Create Custom Role Create a custom role in Azure to provide required permissions to access Azure Subscriptions
Slide 29: Create Azure Connector – Custom Role Permissions
Create Azure Connector – Custom Role Permissions
Slide 30: Create Azure Connector – Add Custom Role
Create Azure Connector – Add Custom Role Attach custom role and Reader role to the application
Slide 31: Create Azure Connector - Summary
Create Azure Connector - Summary Azure Connector • provide these details obtained from the Azure portal: • Application ID • Directory ID • Authentication Key • Subscription ID • set the desired polling frequency (1 hour to 24 hours, default is 4 hours)
Slide 32: Azure Connector Summary
Azure Connector Summary Connector summary shows: • Regions monitored • Resources discovered • Status
Slide 33: GCP Connector
GCP Connector
Slide 34: Create GCP Connector
Create GCP Connector • One connector per GCP project • Use the same service account for multiple projects • Enable required APIs on GCP account • Create service account, download configuration file from GCP console and upload to Qualys CloudView
Slide 35: Create GCP Connector – Enable APIs
Create GCP Connector – Enable APIs • Compute Engine API • Cloud DNS API • Cloud Resource Manager API • Cloud Key Management Service API • Kubernetes Engine API • Cloud Logging API • Cloud SQL Admin API • Stackdriver Monitoring API • BigQuery API • CloudFunctions API
Slide 36: Create GCP Connector – Create Service Account
Create GCP Connector – Create Service Account Service accounts are used by applications to make authorized API calls Service accounts use public/private RSA key pairs to authenticate to Google
Slide 37: Create GCP Connector – Service account permissions
Create GCP Connector – Service account permissions Viewer role provides read-only permissions, but cannot modify any data Security Reviewer provides permissions to list all resources and IAM policies on them
Slide 38: Lab 1, 2 and 3
Lab 1, 2 and 3 Lab 1 – AWS Connector Lab 2 – Azure Connector Lab 3 – GCP Connector 20 min. Please follow pages 3 – 7 from the Lab Tutorial Supplement
Slide 39: CloudView Resources
CloudView Resources
Slide 40: Supported AWS Resource Types
Supported AWS Resource Types • Subnet • Auto Scaling Group • Network ACL • Security Group • Internet Gateway • Lambda Function • Load Balancer • RDS • EC2 Instance • EBS Volume • Route Table • EKS Cluster • S3 Bucket • EKS Node Group • IAM User • EKS Fargate Profile • VPC
Slide 41: CloudView Resources
CloudView Resources Use the dropdown to switch to a different cloud provider
Slide 42: CloudView Resources
CloudView Resources Use the search bar to run queries Selected resource type Vulnerability details for AWS Instances detected by VM
Slide 43: CloudView Resources – Query Type
CloudView Resources – Query Type Use the dropdown to change query type
Slide 44: CloudView Resources – Group By
CloudView Resources – Group By Group By options depend on the selected resource type and view
Slide 45: CloudView Resources – Filters
CloudView Resources – Filters Vulnerabilities of type Information Gathered, Fixed, Ignored, and Disabled are excluded by default
Slide 46: CloudView Resources – Date Range
CloudView Resources – Date Range By default, the search returns results from the last 24 hours
Slide 47: CloudView Resources – Save Search Query
CloudView Resources – Save Search Query Save your search query to quickly run again
Slide 48: CloudView Resources – Saved Searches
CloudView Resources – Saved Searches
Slide 49: Supported Azure Resource Types
Supported Azure Resource Types • SQL Server • Function App • SQL Server Database • Resource Group • Virtual Network • Virtual Machine (created using Resource Manager) • Network Security Group • Web App (App Service)
Slide 50: CloudView Resources — Azure
CloudView Resources — Azure CloudView + Microsoft Azure 8 SUBSCRIPTION ID Sdeovee mee 19c3a me 99640 571s RESOURCE TYPE Network Security. Resource Group Virtual Machine Virtual Network Function App Y 3more LOCATION Total Resource Types DASHBOARD MONITOR POLICY REPORTS. Q Search for resources discove
Slide 51: Supported GCP Resource Types
Supported GCP Resource Types • VM Instances • Networks • Firewall Rules • Subnetworks • Cloud Functions
Slide 52: CloudView Resources — GCP
CloudView Resources — GCP CloudView » Google Cloud Platform 5 Total Resource Types PROJECT ID GCP 136 quale state we 63 RESOURCE TYPE VM Instances Firewall Rules ‘Subnetworks LAR DASHBOARD RESOURCE TYPE © — vMinstances © Networks © Firewall Rules © Subnetworks @® Cloud Function RESOURCES Q. Search f
Slide 53: Vulnerability Details for Instances
Vulnerability Details for Instances • Vulnerability details are displayed for AWS EC2 Instances, Azure Virtual Machines, and GCP VM Instances • The resource must also be detected during a Qualys scan or must have Qualys Cloud Agent installed • Enhanced information available for resources that also e
Slide 54: Enhanced Information
Enhanced Information ¥ CLOUD METADATA General: Summa ‘Summary ry Instance Name: AVA! Network interfaces i ® i-O1aeed7 Instance 10; HOtaeed7: ‘Associations ; First September 6, 2020 12:27 PM samncet pe ie 1 Discovered rage Instance be First Discovered On: September 6, 2020 12:27 PM INVENTORY Instance
Slide 55: Associations
Associations CloudView shows the associations of your resources, for example security groups, auto scaling groups, and elastic load balancers associated with EC2 Instances
Slide 56: Lab 4 – CloudView Resources
Lab 4 – CloudView Resources Please follow pages 8 – 11 from the Lab Tutorial Supplement 10 min.
Slide 57: CloudView Dashboard
CloudView Dashboard
Slide 58: Dashboard
Dashboard A dashboard is made up of widgets, each representing a piece of data
Slide 59: Dashboard
Dashboard CloudView provides pre-configured dashboards, and allows creation of custom dashboards
Slide 60: Dashboard
Dashboard GCP Dashboard Last 24Hrs + RESOURCE DISTRIBUTION BY PROJECT ID uals: TOP 5 FAILED CONTROLS RESOURCE DISTRIBUTION BY TYPE Subnetworks Networks TOP 5 ACCOUNTS BY FAILED CONTROLS com RESOURCES FALED PROJECT cONTROLS FAILED Ensure VM cisks for ertical VMs ate encrypted with... TT genau 62 coat
Slide 61: CloudView Monitor
CloudView Monitor
Slide 62: CloudView Monitor
Failed remediable CloudView Monitor evaluations Use the dropdown to switch to a different cloud provider Use CloudView Monitor to assess your resources for misconfigurations and non-standard deployments
Slide 63: CloudView Monitor
Use the search CloudView Monitor bar to run queries policy.name:"AWS Best Practices Policy" and control.result:FAIL service.type:"IAM" and control.result:"FAIL" and control.criticality:"HIGH"
Slide 64: CloudView Monitor – Control Posture
CloudView Monitor – Control Posture CloudView Monitor shows a list of controls, criticality, service to which the control belongs to, and the security posture – number of resources passing and failing a control
Slide 65: CloudView Monitor – Control Details
CloudView Monitor – Control Details Controls details include: • Control ID and statement • Service • Policy • Criticality • Evaluation criteria • Remediation Steps • Platform (AWS, Azure, or GCP) • List of resources passing and failing the control
Slide 66: CloudView Monitor – Control Evidence
CloudView Monitor – Control Evidence Use Evidence to determine why a control has failed evaluation
Slide 67: CloudView Monitor – Remediation Steps
CloudView Monitor – Remediation Steps View Remediation Steps to determine how a control failure can be mitigated – using the GUI or CLI
Slide 68: Lab 5 and 6
Lab 5 and 6 Lab 5 – CloudView Dashboard Lab 6 – CloudView Monitor Please follow pages 12 – 15 from the Lab Tutorial 15 min. Supplement
Slide 69: CloudView Policies and Controls
CloudView Policies and Controls
Slide 70: CloudView Policy
CloudView Policy CloudView policies are collection of controls. A control represents the evaluation of a datapoint on a monitored resource. Policies may be system-defined or user-defined.
Slide 71: CloudView Policy
CloudView Policy Use queries to search for policies
Slide 72: CloudView Controls
CloudView Controls Select provider to view controls
Slide 73: CloudView Controls
CloudView Controls Each control has a control ID, control name (statement) and criticality
Slide 74: CloudView – Control Summary
CloudView – Control Summary Control summary shows information such as control specification, associated policies, evaluation criteria, rationale, manual remediation steps and references
Slide 75: CloudView – Control Specification
CloudView – Control Specification
Slide 76: CloudView – Control Policies Information
CloudView – Control Policies Information The Policies tab shows the policies to which a specific control belongs
Slide 77: CloudView – Evaluation Information
CloudView – Evaluation Information The Evaluation tab shows the criteria used to evaluate a control pass/fail and the the associated messages
Slide 78: CloudView – Control Rationale
CloudView – Control Rationale The Rationale tab explains the importance of a control pass
Slide 79: CloudView – Control Remediation Steps
CloudView – Control Remediation Steps Remediation steps outline how a control failure can be mitigated using the GUI or CLI
Slide 80: CloudView Controls - Customization
CloudView Controls - Customization Some controls can be customized Some controls allow for customization, these can be used as a template for creating new controls
Slide 81: CloudView Controls - Customization
CloudView Controls - Customization Change criticality of a control Create a copy and customize
Slide 82: CloudView Controls – Change control criticality
CloudView Controls – Change control criticality Criticality of all controls can be changed
Slide 83: CloudView Controls – Change Evaluation Parameter
CloudView Controls – Change Evaluation Parameter Change the Operator and/or Expected Value to affect how the control evaluates a resource
Slide 84: CloudView Controls – Customized Control
CloudView Controls – Customized Control New control ID
Slide 85: Lab 7 and 8
Lab 7 and 8 Lab 7 - CloudView Policy Lab 8 - CloudView Controls Please follow pages 16 – 19 from the Lab 15 min. Tutorial Supplement
Slide 86: Session Break
Session Break 30 min.
Slide 87: CloudView Responses
CloudView Responses
Slide 88: Alerting Response
Alerting Response • Get notified when critical controls fail evaluation • Receive alerts on: • Email • PagerDuty • Slack
Slide 89: Alerting Response – Create Action
Alerting Response – Create Action Available actions: • Send email (via Qualys) • Post to Slack • Send to PagerDuty
Slide 90: Alerting Response – Create Rule
Alerting Response – Create Rule Query source Rule query to match Trigger criteria Assigned action
Slide 91: Alerting Response – Create Rule
Alerting Response – Create Rule Single match – one alert for one match Time-window count match – alert when X matches occur within Y mins/hours Time-window Scheduled match – alert for all matches in a defined time window
Slide 92: Alerting Response – Activity
Alerting Response – Activity Triggered rule
Slide 93: Alerting Permissions
Alerting Permissions Role Crea’ Step 2 of 3 Edit permissions for this role 1 Role Details Y% Role Permissions by Modules (12) © Permissions v Cloudview 3. Review And Confirm » Manage Remediation Permissions (1 of 1) ¥ Alerting Permissions (7 of 7) Alerting Access Create, Edit, Delete your own Action
Slide 94: Lab 9 – Responses
Lab 9 – Responses Please follow pages 20 - 22 from the Lab Tutorial Supplement 15 min.
Slide 95: CloudView Remediation
CloudView Remediation
Slide 96: Remediation
Remediation • Remediate resource misconfigurations • Perform actions on cloud resources • Remediate AWS, Azure, and GCP misconfigurations
Slide 97: Required Permissions
Required Permissions • Only available to users with Manager role or sub-user role with “Manage Remediation” permission
Slide 98: To enable remediation
To enable remediation 1. Enable remediation for the connector 2. Assign write access for the connector
Slide 99: Configure Connector for Remediation
Configure Connector for Remediation Enable Remediation: • Create new or edit existing connector • Enable the Remediation function
Slide 100: Permissions required on AWS
Permissions required on AWS • ec2:RevokeSecurityGroupIngress • s3:PutBucketVersioning • ec2:AuthorizeSecurityGroupIngress • rds:ModifyDBInstance • ec2:DisassociateIamInstanceProfile • rds:ModifyDBClusterSnapshotAttribute • ec2:StopInstances • rds:ModifyDBCluster • ec2:ModifySnapshotAttribute • redsh
Slide 101: Permissions required on Azure
Permissions required on Azure • Microsoft.Sql/servers/firewallRules/delete • Microsoft.Storage/storageAccounts/write • Microsoft.Storage/storageAccount/blobServices/containers/write • Microsoft.Network/networkSecurityGroups/write • Microsoft.Network/networkSecurityGroups/write • Microsoft.Web/sites/
Slide 102: Permissions required on GCP
Permissions required on GCP • compute.firewalls.update • compute.instances.setMetadata • storage.buckets.setIamPolicy • cloudfunctions.functions.setIamPolicy • bigquery.datasets.update • cloudsql.instances.update • cloudkms.cryptoKeys.setIamPolicy
Slide 103: Remediable Failed Evaluations
Remediable Failed Evaluations The Monitor tab shows the number of remediable failed evaluations
Slide 104: Remediate Resources
Remediate Resources Click the “Remediate Now” button next to a control to fix the failure
Slide 105: Remediate Resources
Remediate Resources Remediate resources: • View resource id • View actions • View impact • Provide comments
Slide 106: Resource Actions
Resource Actions DASHBOARD RESOURCES MONITOR POLICY REPORTS CONFIGURATION % — ee Instance ¥ Q Search for resources discovered... a Last24Hrs ov Without Agents With Public IP Docker Hosts With Vulnerabilities Resource.type: Instance © v Instance Group By:... Y Filters v 1-50 of 473 Iv EC2 INSTANCE ID
Slide 107: Remediation Activity History
Remediation Activity History
Slide 108: Lab 10 - Remediation
Lab 10 - Remediation Please follow pages 23 – 27 from the Lab Tutorial Supplement 10 min.
Slide 109: CloudView Exceptions
CloudView Exceptions
Slide 110: Exceptions
Exceptions • Exempt certain cloud resources from control evaluations • Temporarily change the status of a resource from Failed to PassE (Pass with Exception)
Slide 111: Create Exception
Create Exception CID-47 Ensure access logging is enabled for S3 buckets Policy: AWS Best Practices Policy Platform: AWS Evaluation: Control checks whether the logging is enabled on S3 buckets. Service: $3 Manual P . Ree eciation: | ViewSteps Criticality: SI »< resource. id:"cloudviewdemobucket” and
Slide 112: Create Exception
Create Exception Exception Reason
Slide 113: Create Exception
Create Exception Exception applies only for selected resource Create exception for all resources associated with connector
Slide 114: Create Exception
Create Exception Pass with Exception
Slide 115: Lab 11 – Exceptions
Lab 11 – Exceptions Please follow pages 28 - 30 from the Lab Tutorial Supplement 10 min.
Slide 116: CloudView Reports
CloudView Reports
Slide 117: CloudView Reports
CloudView Reports Two types of reports: • Use the “Reports” function to generate downloadable CSV or PDF reports • Supports use of queries to filter data at run time • Use the “On-screen reports” function to generate on-screen reports • Supports mandate-based reporting
Slide 118: CloudView - Report
CloudView - Report Select cloud provider Include one or more policies Include required connectors Use queries to filter results
Slide 119: CloudView – On-Screen Report Template
CloudView – On-Screen Report Template Include multiple Include multiple policies in report connectors/groups in report
Slide 120: CloudView – On-Screen Report
CloudView – On-Screen Report On-screen reports are interactive – click a control to view associated resources
Slide 121: Lab 12 - Reports
Lab 12 - Reports Please follow page 31 from the Lab Tutorial Supplement 10 min.
Slide 122: CloudView Access Management – Grouping Connectors
CloudView Access Management – Grouping Connectors
Slide 123: Access Management – Create Groups for Connectors
Access Management – Create Groups for Connectors To restrict access to Connectors, first create groups and assign them Grouping connectors allows for easier management. A group may contain multiple connectors and a connector may belong to multiple groups.
Slide 124: Access Management – Assign Groups to Connectors
Access Management – Assign Groups to Connectors
Slide 125: Access Management – Assign Permissions to Users
Access Management – Assign Permissions to Users Limit user scope using: • Connector groups, and/or • Connectors and Access restriction regions by group * If no groups are assigned to a sub user, the sub user can access all connectors Access restriction by connector and region
Slide 126: CloudView Access Management – Creating Users
CloudView Access Management – Creating Users
Slide 127: User Permissions
User Permissions • User with Manager Role • Most privileged role, has full permissions • Sub Users • All privileges – full access in CloudView except creating and managing other users • Reader privileges – can only view data in CloudView
Slide 128: User Permissions
User Permissions Operations Manager Sub User with Sub User with Role All Privileges Reader Privileges Create new users Yes No No Grant access to Sub-Users Yes No No Update Access of Existing Users Yes No No Create and assign Groups to Connectors Yes No No Manage Connectors Yes No No Manage Policies
Slide 129: Access Management
Access Management To create user with limited privileges: 1. Create User from Administration Module • Create a new user of type Reader 2. Create Role with limited permissions • Create a new role that provides access to CloudView 3. Assign Role to User • Replace the Reader role with the new role
Slide 130: Access Management – Create User
Access Management – Create User Create user from Administration module To create a new CloudView user with limited access, begin by creating a Reader user from the Administration module
Slide 131: Access Management – Create User with All Privileges
Access Management – Create User with All Privileges To create a sub user with all privileges, include: • CloudView UI Access • CloudView API Access
Slide 132: Access Management – Create Read Only User
Access Management – Create Read Only User To create a sub user with read-only privileges, include: • CloudView UI Access • CloudView API Access • CloudView Readonly Access • CloudView API Readonly Access
Slide 133: Access Management – Assign Role to User
Access Management – Assign Role to User After creating the role and the user, edit the user’s profile and replace the default role with the CloudView role
Slide 134: Lab 13 and 14
Lab 13 and 14 Lab 13 - User Management Lab 14 - Access Management 10 min. Please follow pages 32 - 35 from the Lab Tutorial Supplement
Slide 135: CloudView APIs
CloudView APIs
Slide 136: CloudView APIs
CloudView APIs • Utilize many CloudView features and integrate with other products using APIs • Use Swagger tool to access the REST APIs • Access the Swagger UI using the URL: http://<QualysURL>/cloudview-api/swagger-ui.html
Slide 137: CloudView APIs
CloudView APIs Azure Connector 4?''s for the Azure Connectors /rest/v1/azure/connectors Get the list of connectors POST /rest/v1/azure/connectors Create anew connector DELETE /rest/v1/azure/connectors Delete the provided connectors r /rest/v1/azure/connectors/{connectorId} Get the details of connect
Slide 138: CloudView APIs
CloudView APIs Edit parameters and execute
Slide 139: CloudView Postman Collection
CloudView Postman Collection • Appropriate for testing/consuming APIs based on specifications • Available on https://github.com/Qualys/CloudView-API-Postman- Collection
Slide 140: Secure Infrastructure as Code
Secure Infrastructure as Code
Slide 141: Secure Infrastructure as Code
Secure Infrastructure as Code • Secure your code before it gets deployed • Improves security posture by preventing misconfigurations • Upload code for scanning via CLI or API
Slide 142: Infrastructure as Code – Supported Templates
Infrastructure as Code – Supported Templates • AWS, Azure, and GCP Terraform templates • AWS, Azure, and GCP Terraform plan • AWS CloudFormation Template
Slide 143: Infrastructure as Code – Launch Scan
Infrastructure as Code – Launch Scan Username and Platform URL File name password Scan results
Slide 144: Infrastructure as Code – Scan Results
Infrastructure as Code – Scan Results
Slide 145: Securing EC2 Instances with Qualys
Securing EC2 Instances with Qualys
Slide 146: Securing EC2 Instances with Qualys
Securing EC2 Instances with Qualys 1. Setup Qualys Connector 2. Deploy Qualys Sensors 3. Assess EC2 Instances 4. Run Reports
Slide 147: Setup Connectors
Setup Connectors • Use the same connector as CloudView • Discovers EC2 and VPC assets • Can be configured to automatically tag and activate EC2 Instances
Slide 148: AWS Metadata
AWS Metadata • AssetView Connector collects AWS Tags and Instance state updates • AssetView Connector and Cloud Agent collection General, Location, Network Information, and Tags
Slide 149: Scanning in AWS
Scanning in AWS • Deploy Cloud Agents on EC2 Instances, or • Deploy scanner appliances
Slide 150: EC2 Vulnerability Scan
EC2 Vulnerability Scan • Provide the following: • Connector • Platform • EC2-Classic • EC2-VPC (All VPCs in a Region) • EC2-VPC (Selected VPC) • Region • Tags • Scanner appliance • Scan targets for vulnerability and compliance
Slide 151: Cloud Perimeter Scan
Cloud Perimeter Scan • Scan public DNS or public IP of AWS Instances or Azure Virtual Machines using Qualys External scanners • Scan targets for vulnerability and compliance posture
Slide 152: Securing Azure Virtual Machines with Qualys
Securing Azure Virtual Machines with Qualys
Slide 153: Qualys Integration with Microsoft Azure Security Center
Qualys Integration with Microsoft Azure Security Center • The Microsoft Azure Security Center provides a unified security management and monitoring console. • Qualys is integrated into Microsoft Azure Security Center's partner solutions for Vulnerability assessment. • The Security Center: • Detects
Slide 154: Integrating Qualys with Microsoft Azure Security Center
Integrating Qualys with Microsoft Azure Security Center • Using the Microsoft Azure Security Center integration to deploy Qualys Cloud Agents: • Reduces the operations overhead • Allows DevOps to get visibility into the security posture from within the Security Center
Slide 155: Integrating Qualys with Microsoft Azure Security Center
Integrating Qualys with Microsoft Azure Security Center
Slide 156: Integrating Qualys with Microsoft Azure Security Center
Integrating Qualys with Microsoft Azure Security Center
Slide 157: Training Survey and Certification Exam
Training Survey and Certification Exam Training Survey https://forms.office.com/r/rsy0Aja6Xz Certification Exam https://qualys.com/learning
Slide 158: Cloud Security Certification Exam
Cloud Security Certification Exam Participants in this training course have the option to take the Cloud Security Certification Exam: § 30 multiple choice questions. § Answer 75% of the questions correctly to receive a passing score. § Candidates will receive 5 attempts to pass the exam. § You may u
Slide 159: Additional Resources
Additional Resources • CloudView User Guide - https://www.qualys.com/docs/qualys-cloud-view- user-guide.pdf • Securing AWS with Qualys - https://www.qualys.com/docs/qualys- securing-amazon-web-services.pdf • Securing Azure with Qualys - https://www.qualys.com/docs/qualys- securing-azure-with-qualys.
Slide 160: Thank You
Thank You training@qualys.com