Qualys Helps Organizations Manage Risk with Cybersecurity Asset Management

You can’t protect what you can’t see. Yes, it is a tad trite at this point. As vendors have focused on comprehensive visibility in recent years, the phrase has almost become something of a buzzword. That in no way changes the truth of the statement, though. It is a simple fact. An accurate inventory of the devices and assets in your environment is the only foundation on which you can build a solid cybersecurity strategy. Qualys recognizes that you can’t protect what you can’t see, but takes it a step farther to “you can’t protect what you don’t understand” with the recently announced Cybersecurity Asset Management (CSAM).

Asset Inventory

Qualys provides a free tool to help organizations with the seeing part. Global IT Asset Inventory is available for free to help companies discover and maintain an accurate inventory of everything across a hybrid-IT environment.

Asset inventory means different things to different teams, though—or at least it is used in completely different ways. Qualys recognized that the IT team needs an accurate asset inventory to manage things like licensing, and software or hardware support. The security team, on the other hand, needs to be able to dive a little deeper—to detect vulnerabilities, monitor asset health, and identify risk exposure.

The inventory is important, but it is only half the battle for effective cybersecurity. Armed with an accurate inventory, the next step is to analyze those assets to gain a better understanding of what you are protecting and where you are exposed or vulnerable to enable you to effectively prioritize your security efforts.

Risk Management

In a press release announcing CSAM, Jatinder Pal Singh, director of security operations at Informatica, explained, “As an organization focused on security operations, we believe that ‘you can’t protect what you don’t understand,’ with understand being the key word. Hence, asset management in the security operations context isn’t just ‘seeing’ an asset; it is having the right ‘risk’ context of each and every software, hardware and IoT asset at our fingertips.”

That is where CSAM comes in. Cybersecurity Asset Management applies analytics and intelligence to help customers implement an effective risk management program. It leverages the native sensors and CMDB (configuration management database) integrations of Qualys Cloud Platform to continuously inventory known and unknown assets, discover installed applications, and overlay business and risk context to establish asset criticality.

Qualys CEO Sumedh Thakar stressed that everything starts with knowing your inventory, but the inventory is a matter of perspective to some extent. Traditionally, the security team relies on the IT team to provide them with the inventory of assets they should be protecting, but the scope of things that need to be considered assets and the depth of information needed is different from a cybersecurity perspective.

From a risk management perspective, the security team needs to understand if there is required software missing from a system, or rogue software installed. They need to know if operating systems or applications in use are nearing end of life—or if support has already expired. They need to know if devices contain vulnerabilities, as well as the broader context of which devices or assets are exposed to the internet.

Sumedh described it as enriched visibility. CSAM goes beyond IT asset inventory to provide visibility of the hygiene and health of the assets on your network.

Qualys Cybersecurity Asset Management will be available in June. You can visit qualys.com/CSAM-trial to sign up for a free trial waiting list.