Qualys Has a Prescription for Better Cybersecurity

One of the first things I saw when I arrived in Las Vegas for Black Hat—aside from the flashing lights of the banks of slot machines and the large neon “Welcome to Las Vegas” sign in the airport terminal—was an ad on the wall for Qualys. The ad shows a red and white pill with the Qualys logo, accompanied by the tagline “A New Prescription for Security and It’s Free.”

A Cure for What Ails Your Cybersecurity

What is the prescription, you might ask? Global IT Asset Inventory. Qualys recently made the tool available for free and promoting the tool took center stage for Qualys at Black Hat.

Chris Carlson, VP of Product Management for Qualys, presented a session at the event titled “A New Prescription for Security,” which focused on real-world lessons learned and practical tips for how IT and security teams can effectively leverage software solutions to identify assets, risks, threats, and vulnerabilities. Chris also talked about how to mitigate these challenges across on-premises networks, endpoints, cloud environments, containers, and hybrid workloads. One thing he stressed, though, is that accurate, real-time asset inventory is a necessary foundation for everything else.

Right Prescription at the Right Time

Qualys seems to have the right idea. If you don’t know what is on your network, there is no way you can truly know what vulnerabilities exist or what risks your applications and data might be exposed to.

The concept of maintaining an accurate inventory of the assets on your network is not new, but it does seem to be in the spotlight right now. Asset inventory has always been a challenge, but with hybrid cloud environments that span multiple physical locations, containers that can spawn by the thousands one minute and disappear the next, and the explosion of mobile and IoT (internet of things) devices, it is increasingly difficult to know what is on your network at a given moment.

I had many conversations with vendors and with Black Hat attendees while I was in Las Vegas, and the need for and challenges of accurate asset inventory came up repeatedly. Qualys is one of the companies leading the effort, but organizations of all sizes and industries recognize the need for real-time asset inventory, and many vendors are jumping on that bandwagon.

More from Qualys at DefCon

Global IT Asset Inventory was certainly a focus for Qualys, but it was not the only thing the company talked about in Las Vegas. Researchers and analysts from Qualys also presented a few sessions at the extended Hacker Summer Camp—also known as DefCon.

Parmanand Mishra provided an overview of how Hachi uses the provided by ATT&CK to map the symptoms of malware on the ATT&CK matrix, and why Hachi should be part of an analyst’s tool kit. Jyoti Raval demonstrated a phishing simulation tool that provides an intuitive tutorial and customized assessment to analyze how people act in a given situation to increase awareness and understanding of phishing attacks. Finally, Sanket Karpe joined Parmanand Mishra for a session on making safer networks for smart homes in which they shared a new type of network segregation system based on a Raspberry Pi that can be easily deployed on a home network to help mitigate risk and address the challenges of securing vulnerable IoT devices in the home.

Most of the Black Hat and DefCon sessions should be recorded and available to watch online at some point in the near future, so you may be able to view these presentations even if you weren’t in Las Vegas for the events—or even if you were and just couldn’t squeeze these sessions into your schedule.

Whether you currently have a tool for asset inventory or not, I recommend you check out Global IT Asset Inventory from Qualys. The app is free, so you have nothing to lose in trying it out to determine whether it will work for you.