Qualys, Inc. · NASDAQ:QLYS
Qualys — Technical Presentation (2021)
81 slides from Qualys's technical presentation, 2021
Slide 1: Qualys Patch Management
Qualys Patch Management Shyam Raj Lead Technical Trainer
Slide 2: Training Documents
Training Documents • Patch Management Lab Tutorial Supplement • Patch Management Slides for Lab Tutorials • You will find the training documents for this course below this training video (at the very bottom of the page) • No trial accounts are provided for this course, all labs are simulated 2 Qualy
Slide 3: Play Lab Tutorials
Play Lab Tutorials 3 Qualys, Inc. Corporate Presentation
Slide 4: Agenda
Agenda • Introduction to Qualys Patch Management (PM) • PM Activation & Setup • PM Application Overview • PM Deployment Job • Prioritized Products • Patching from VMDR and VM • Zero-Touch Vulnerability Remediation • Uninstall Job • Patch Catalog • PM Assets • Certification Exam 4 Qualys, Inc. Corpor
Slide 5: Introduction
Introduction 5 Qualys, Inc. Corporate Presentation
Slide 6: Qualys Patch Management
Qualys Patch Management § Automatically correlates discovered vulnerabilities with their required patches § Leverage existing Qualys Cloud Agents to deploy and uninstall patches § Provides OS and Application patches, including patches from third- party software vendors (e.g., Adobe, Java, Google, Mo
Slide 7: Qualys Patch Management
Qualys Patch Management § Available for Windows, CentOS 6/7, and RHEL 6/7/8 § Provides patching just about anywhere an Internet connection is available (e.g., airports, coffee shops, remote offices, etc...) § Qualys Agents determine which patches are missing or required and can identify superseded p
Slide 8: Qualys VMDR Lifecycle
Qualys VMDR Lifecycle Asset Vulnerability & Inventory Config Assessment VMDR® Patch Threat Risk and Management Prioritization
Slide 9: Patch Sources
Patch Sources • Windows patches are downloaded from Vendor Global CDNs (e.g., Oracle, Adobe, Microsoft, Apache, Google, etc...) • Linux patches are downloaded from the configured YUM repository • Qualys Gateway Server can be used as a local repository o Patch downloads requested by one agent, are ca
Slide 10: Activation & Setup
Activation & Setup 10 Qualys, Inc. Corporate Presentation
Slide 11: Qualys Patch Management uses the Qualys Cloud Agent for deploying patches
Qualys Patch Management uses the Qualys Cloud Agent for deploying patches
Slide 12: Qualys PM Workflow
Qualys PM Workflow 1. Install Cloud Agent on target host 2. Assign target agent host to a CA Configuration Profile that has PM enabled 3. Activate PM module on target agent host 4. Assign PM license to the host 5. Assign target agent host to a PM Assessment Profile (optional) 6. Configure patch depl
Slide 13: Activation Key
Activation Key § As a best practice, assign a static tag when creating an Activation Key § Create a new activation key or update existing key with Patch Management
Slide 14: Configuration Profile
Configuration Profile § Assign target hosts to CA Configuration Profile that has PM enabled. § Set “Cache size” to at least 2048 MB, to accommodate Windows Updates.
Slide 15: Activate PM Module for Target Host
Activate PM Module for Target Host • Select the PM module in the Agent Activation Key, before and after agent deployment. • Use the “Quick Actions” menu to activate PM for any agent host or use the Qualys Cloud Agent API.
Slide 16: Lab Tutorial 1
Lab Tutorial 1 PM Activation & Setup – Page 3 10 min. 16 Qualys, Inc. Corporate Presentation
Slide 17: Application Overview
Application Overview 17 Qualys, Inc. Corporate Presentation
Slide 18: Patch Management UI
Patch Management UI • CONFIGURATION – Configure the frequency in which patch assessments are performed and allocate patching licenses. • JOBS – Deploy and/or uninstall specific patches for targeted groups of host assets using one or more PM Jobs. • ASSETS – List of agent host assets the PM module ac
Slide 19: Patch Assessment Profile
Patch Assessment Profile • Specifies frequency of patch assessment scans, which assess agent host assets for missing and/or installed patches. 19 Qualys, Inc. Corporate Presentation
Slide 20: Configuration: Assessment Profile
Configuration: Assessment Profile • If you do not create one or more Assessment Profiles, the System Profile will be used (by default). • Assessment scans identify the missing and installed patches for an agent host. 20 Qualys, Inc. Corporate Presentation
Slide 21: Configuration: License Consumption
Configuration: License Consumption • Use Asset Tags to specify which agent host assets are eligible for patching. • Use the “Exclusion” check box to restrict patching on targeted assets. 21 Qualys, Inc. Corporate Presentation
Slide 22: Deployment Job
Deployment Job 22 Qualys, Inc. Corporate Presentation
Slide 23: Deployment job
Deployment job § Use asset tags as targets for patch deployment jobs § As a recommended practice, create and use test asset tags for deployment § Once verified, clone the deployment job and include production asset tags
Slide 24: Deployment job
Deployment job Create a patch deployment job
Slide 25: Deployment job – Basic Information
Deployment job – Basic Information 25
Slide 26: Deployment job – Select Assets
Deployment job – Select Assets Add assets to patch job Add asset tags to patch job 26
Slide 27: Deployment job – Pre and Post Actions
Deployment job – Pre and Post Actions Configure action to execute before job starts Run a PowerShell script or install software 27
Slide 28: Deployment job – Select Patches
Deployment job – Select Patches Use patch Select patches selector using QQL query 28
Slide 29: Deployment job – Manual Patch Selector
Deployment job – Manual Patch Selector View patches within Use queries to scope of selected assets narrow selections Use filters to narrow selections
Slide 30: Deployment job – Automated Patch Selector
Deployment job – Automated Patch Selector Select patches using QQL query Use a query to select patches
Slide 31: Deployment job – Schedule Deployment
Deployment job – Schedule Deployment Deploy patches on- demand or schedule for later Set to None to allow Qualys the time needed to complete the job Set duration for on- demand job
Slide 32: Schedule Deployment
Schedule Deployment • Run jobs ”on demand” or schedule them to run at regular frequencies. 32 Qualys, Inc. Corporate Presentation
Slide 33: Opportunistic Patch Download
Opportunistic Patch Download • You can “Enable opportunistic patch download,” to allow agents to download required patches prior to the start of a scheduled job. 33 Qualys, Inc. Corporate Presentation
Slide 34: Patch Window
Patch Window • A job will display the “Timed out” status, if the patch installation does not start within a specified patch window. • Select the “None” option to give patch jobs an unlimited amount of time. 34 Qualys, Inc. Corporate Presentation
Slide 35: Communication Options
Communication Options • Choose the type of “Deployment and Reboot Communication Options” for each Deployment Job. 35 Qualys, Inc. Corporate Presentation
Slide 36: Communication Options
Communication Options • Choose the type of “Deployment and Reboot Communication Options” for each Deployment Job. 36 Qualys, Inc. Corporate Presentation
Slide 37: Host “Pop-Up” Messages
Host “Pop-Up” Messages • “Pre-Deployment and “Reboot Request messages can be configured with deferment options. 37 Qualys, Inc. Corporate Presentation
Slide 38: PM Processes & Executables
PM Processes & Executables • When patching is active on a Windows host, patching messages and notifications are managed by the “Qualys Cloud Agent UI” process (QualysAgentUI.exe) • ‘stdeploy.exe’ is the name of the patching executable. 38 Qualys, Inc. Corporate Presentation
Slide 39: Job Status
Job Status View Job Status: • Enabled – Job is presently active. • Disabled – Job is presently inactive. • Completed – Job has completed. 39 Qualys, Inc. Corporate Presentation
Slide 40: View Job Progress
View Job Progress 40 Qualys, Inc. Corporate Presentation
Slide 41: Job Status
Job Status Status Description Canceled – Blackout Patch deployment job is canceled on the asset due to blackout window Completed Patch deployment job is completed on the asset Downloaded Patch file is successfully downloaded on the asset Downloading – failed Patch failed to download on the asset Not
Slide 42: Clone job
Clone job Clone an existing job
Slide 43: Lab Tutorial 2
Lab Tutorial 2 PM Deployment Job – Page 6 10 min. 43 Qualys, Inc. Corporate Presentation
Slide 44: Session Break
Session Break 30 min. 44 Qualys, Inc. Corporate Presentation
Slide 45: Prioritized Products
Prioritized Products 45 Qualys, Inc. Corporate Presentation
Slide 46: Prioritized Products
Prioritized Products • Focus on products in your environment that are important to patch on a regular basis • Prioritizes products that introduce the most vulnerabilities from the last 2 years • Helps answer the question – which products should I patch first? • Create a zero-touch recurring deployme
Slide 47: Prioritized Products
Prioritized Products 47 Qualys, Inc. Corporate Presentation
Slide 48: Prioritized Products
Prioritized Products 48 Qualys, Inc. Corporate Presentation
Slide 49: Prioritized Products
Prioritized Products Query is automatically built 49 Qualys, Inc. Corporate Presentation based on chosen products
Slide 50: Lab Tutorial 3
Lab Tutorial 3 Prioritized Products – Page 11 10 min. 50 Qualys, Inc. Corporate Presentation
Slide 51: Patching from VMDR and VM
Patching from VMDR and VM
Slide 52: VMDR Prioritization Report
VMDR Prioritization Report • Identify vulnerabilities that pose the maximum risk to your business • Correlate vulnerability information with threat intelligence and asset context • Identify patches required to fix high risk vulnerabilities • Reduce remediation time with the integrated patch manageme
Slide 53: VMDR Prioritization
VMDR Prioritization Assets to prioritize Prioritize Prioritize based on Prioritize by vulnerabilities by age RTI’s Attack Surface
Slide 54: VMDR Prioritization
VMDR Prioritization Patch all vulnerabilities Select vulnerabilities for patching
Slide 55: Vulnerabilities Section
Vulnerabilities Section View missing patches for selected vulnerabilities
Slide 56: Vulnerabilities Section
Vulnerabilities Section A query is built based on your vulnerability selections Apply missing patches causing vulnerabilities
Slide 57: Zero Touch Vulnerability Remediation
Zero Touch Vulnerability Remediation
Slide 58: Zero Touch Patching
Zero Touch Patching • Update endpoints and servers proactively as soon as patches are available • Remediate new vulnerabilities even before security teams run scans • Automate patch vulnerabilities based on the vulnerability RTI • Can be initiated from “VMDR Prioritization” report or the “Prioritize
Slide 59: Zero Touch Patching
Zero Touch Patching Initiate zero-touch patch job 59 Qualys, Inc. Corporate Presentation
Slide 60: Zero Touch Patching
Zero Touch Patching QQL is automatically populated 60 Qualys, Inc. Corporate Presentation from the prioritization report
Slide 61: Lab Tutorial 4
Lab Tutorial 4 Patching from VM and VMDR – Page 13 Zero-Touch Patch Job – Page 14 10 min. 61 Qualys, Inc. Corporate Presentation
Slide 62: Uninstall Job
Uninstall Job 62 Qualys, Inc. Corporate Presentation
Slide 63: Patch Jobs
Patch Jobs § Uninstall jobs are created exclusively in the Patch Management application. § The workflow for creating uninstall jobs is very similar to deployment jobs. 63 Qualys, Inc. Corporate Presentation
Slide 64: Uninstall or “Rollback” Patches
Uninstall or “Rollback” Patches • Only “rollback” patches are displayed when creating an uninstall job. • Not all patches can be uninstalled. 64 Qualys, Inc. Corporate Presentation
Slide 65: Lab Tutorial 5
Lab Tutorial 5 Uninstall Job – Page 16 10 min. 65 Qualys, Inc. Corporate Presentation
Slide 66: Patch Catalog
Patch Catalog 66 Qualys, Inc. Corporate Presentation
Slide 67: Patches
Patches Download list of patches Create patch job from the “Patches” tab
Slide 68: Catalog’s Default Display Filters
Catalog’s Default Display Filters Default view shows: • Missing patches • Non-superseded patches Use filters to view: • Missing and installed patches • Superseded patches 68 Qualys, Inc. Corporate Presentation
Slide 69: Linux Patches
Linux Patches Default filters are NOT applied when viewing Linux patches. 69 Qualys, Inc. Corporate Presentation
Slide 70: Acquire From Vendor
Acquire From Vendor • Patches identified with the “key-shaped” icon, cannot be downloaded by Qualys’ Cloud Agent. 70 Qualys, Inc. Corporate Presentation
Slide 71: Uninstall or “Rollback” Patches
Uninstall or “Rollback” Patches isRollback:true /* patches that can be uninstalled */ 71 Qualys, Inc. Corporate Presentation
Slide 72: Add Patches to Existing Jobs
Add Patches to Existing Jobs • Additional patches can be added to any deployment job, before it is enabled • Additional patches can be added to a “recurring” job, both before and after it is enabled. 72 Qualys, Inc. Corporate Presentation
Slide 73: Lab Tutorial 6
Lab Tutorial 6 Patch Catalog – Page 18 10 min. 73 Qualys, Inc. Corporate Presentation
Slide 74: Assets
Assets 74 Qualys, Inc. Corporate Presentation
Slide 75: PM Assets
PM Assets • Displays host assets with the PM module activated. • A successful assessment scan will also display the number of MISSING and INSTALLED patches. 75 Qualys, Inc. Corporate Presentation
Slide 76: Quick Actions
Quick Actions • Use the “Quick Actions menu to view asset details, add assets to an existing job, or add assets to a new job. 76 Qualys, Inc. Corporate Presentation
Slide 77: Add Assets to Existing Jobs
Add Assets to Existing Jobs • Additional assets can be added to any deployment job, before it is enabled • Additional assets can be added to a “recurring” job, both before and after it is enabled. 77 Qualys, Inc. Corporate Presentation
Slide 78: Lab Tutorial 7
Lab Tutorial 7 Assets – Page 20 10 min. 78 Qualys, Inc. Corporate Presentation
Slide 79: Training Survey and Certification Exam
Training Survey and Certification Exam Training Survey https://forms.office.com/r/rsy0Aja6Xz Certification Exam https://qualys.com/learning 79 Qualys, Inc. Corporate Presentation
Slide 80: PM Certification Exam
PM Certification Exam Participants in this training course have the option to take the PM Certification Exam: § 30 multiple choice questions. § Answer 75% of the questions correctly to receive a passing score. § Candidates will receive 5 attempts to pass the exam. § You may use the PM presentation s
Slide 81: Thank You
Thank You training@qualys.com 81 Qualys, Inc. Corporate Presentation