Qualys, Inc. · NASDAQ:QLYS
Qualys — RSA Conference 2014
46 slides from Qualys's conference presentation, February 2014
Slide 1: Continuous Monitoring with the 20 Critical Security Controls
Continuous Monitoring with the 20 Critical Security Controls SESSION ID: SPO1-W02 Wolfgang Kandek CTO
Slide 2: We called 2013 the year of the data breach…
We called 2013 the year of the data breach… #RSAC 2
Slide 3: …but 2014 started in much the same spirit…
…but 2014 started in much the same spirit… #RSAC 3
Slide 4: Background
Background Open System Administration Channels Default and Weak Passwords End-user has Admin Privileges Outdated Software Versions #RSAC 4
Slide 5: Outdated Software Versions
Outdated Software Versions Vulnerability Breach Use Probability Random CVSS 10 Exploit DB Metasploit EDB+MSP 0% 5% 10% 15% 20% 25% 30% 35% #RSAC 5
Slide 6: Background
Background Open System Administration Channels Default and Weak Passwords End-user has Admin Privileges Outdated Software Versions Non-Hardened Configurations => Flaws in System Administration #RSAC 6
Slide 7: Solution
Solution 20 Critical Security Controls What works in Security? #RSAC 7
Slide 8: Solution
Solution 20 Critical Security Controls What works in Security? Owned by the Council on Cybersecurity With widespread industry expert input #RSAC 8
Slide 9: Solution
Solution 20 Critical Security Controls What works in Security? Owned by the Council on Cybersecurity With widespread industryexpert input #RSAC 9
Slide 10: Solution
Solution 20 Critical Security Controls What works in Security? Owned by the Council on Cybersecurity With widespread industry expert input International Participation #RSAC 10
Slide 11: Solution
Solution 20 Critical Security Controls What works in Security? Owned by the Council on Cybersecurity With widespread industry expert input International Participation #RSAC 11
Slide 12: Solution
Solution 20 Critical Security Controls What works in Security? Owned by the Council on Cybersecurity With widespread industryexpert input International Participation #RSAC 12
Slide 13: Solution
Solution 20 Critical Security Controls What works in Security? Owned by the Council on Cybersecurity With widespread industryexpert input International Participation #RSAC 13
Slide 14: Solution
Solution 20 Critical Security Controls What works in Security? Owned by the Council on Cybersecurity With widespread industry expert input International Participation 5 Tenets #RSAC 14
Slide 15: 5 Tenets of the 20 CSC
5 Tenets 20 CSC Offense informs Defense Prioritization Metrics Continuous Diagnostics and Mitigation Automation #RSAC 15
Slide 16: 5 Tenets of the 20 CSC
5 Tenets 20 CSC Offense informs Defense Prioritization Metrics Continuous Diagnostics and Mitigation Automation #RSAC 16
Slide 17: Solution
Solution 20 Critical Security Controls What works in Security? Owned by the Council on Cybersecurity With widespread industry expert input International Participation 5 Tenets Prioritized #RSAC 17
Slide 18: Solution
Solution 20 Critical Security Controls What works in Security? Owned by the Council on Cybersecurity With widespread industry expert input International Participation 5 Tenets Prioritized #RSAC 18
Slide 19: Solution
Solution 20 Critical Security Controls What works in Security? Owned by the Council on Cybersecurity With widespread industry expert input International Participation 5 Tenets Prioritized Implementation Guidelines #RSAC 19
Slide 20: Solution
Solution 20 Critical Security Controls What works in Security? Owned by the Council on Cybersecurity With widespread industry expert input International Participation 5 Tenets Prioritized Implementation Guidelines = Quick Wins, Visibility/Attribution, Configuration/Hygiene, Advanced
Slide 21: Implementation Guidelines
Implementation Guidelines #RSAC 21
Slide 22: Implementation Guidelines
Implementation Guidelines Quick Win 1 - Control 1 – HW Inventory Implement an automated discovery engine (active/passive) Quick Win 3 – Control 2 – SW Inventory Scan for Deviations from Approved List Quick Win 3 – Control 3 – Secure Configurations Limit Admin privileges Quick Win 10 –
Slide 23: Implementation Guidelines
Implementation Guidelines Measure Success Control 1: Detect new machines in 24 hours Control 1: How many unauthorized machines on network? Control 2: How many unauthorized software packages installed? Control 3: Percentage of machines that do not run an approved image ? Control 4: Percen
Slide 24: Implementing Quick Wins - Prototype
Implementing Quick Wins - Prototype QualysGuard, API, PERL, Splunk Daily Authenticated Scan of Network Scripted API Access and Load #RSAC 24
Slide 25: Implementing Quick Wins - Prototype
Implementing Quick Wins - Prototype #RSAC 25
Slide 26: Implementing Quick Wins - Prototype
Implementing Quick Wins - Prototype Logins - user, date, type Scans - user, date, type, target, duration Reports - user, date, type, duration, size Hosts – machine, date, active, fixed, severity counts, scores Vulnerabilities – id, severity, cvss, age Software – name, publisher Certifi
Slide 27: Implementing Quick Wins - Prototype
Implementing Quick Wins - Prototype Logins - user, date, type Scans - user, date, type, target, duration Reports - user, date, type, duration, size Hosts – machine, date, active, fixed, severity counts, scores Vulnerabilities – id, severity, cvss, age Software – name, publisher Certifi
Slide 28: Implementing Quick Wins - Prototype
Implementing Quick Wins - Prototype QualysGuard, API, PERL, Splunk Daily Authenticated Scan of Network Scripted API Access and Load Data Transformation in Scripts Scoring – Dept. State CVSS based Data Promotion Software, Patches, MAC address Splunk for Reports and Graphing #RSAC 28
Slide 29: CSC1 – HW Inventory - Quick Win
CSC1 – HW Inventory - Quick Win 1 Deploy Asset Inventory Discovery Tool (active/passive) Goal: Discover new machines within 24 hours Daily Active Scan of the Network -> Splunk Query Splunk for new Machines ~ where the earliest scandate is within the last day #RSAC 29
Slide 30: CSC1 – HW Inventory - Quick Win
CSC1 – HW Inventory - Quick Win 1 Asset Inventory Discovery Tool (active/passive) Discover new machines within 24 hours Daily Active Scan of the Network -> Splunk Query Splunk for new Machines #RSAC 30
Slide 31: CSC2 – SW Inventory - Quick Win
CSC2 – SW Inventory - Quick Win 3 Discover Unauthorized Software Goal: Within 24 hours Daily Active Scan of the Network -> Splunk Query Splunk for new Server Ports ~ where the earliest scandate is within the last day #RSAC 31
Slide 32: CSC2 – SW Inventory - Quick Win
CSC2 – SW Inventory - Quick Win 3 Discover Unauthorized Software Goal: Within 24 hours Daily Active Scan of the Network -> Splunk #RSAC 32
Slide 33: CSC2 – SW Inventory - Quick Win
CSC2 – SW Inventory - Quick Win 3 Discover Unauthorized Software Goal: Within 24 hours Daily Active Scan of the Network -> Splunk Query Splunk for new Software ~ where the earliest scandate is within the last day #RSAC 33
Slide 34: CSC2 – SW Inventory - Quick Win
CSC2 – SW Inventory - Quick Win 3 Discover Unauthorized Software Goal: Within 24 hours Daily Active Scan of the Network -> Splunk Query Splunk for new Server Ports ~ where the earliest scandate is within the last day Query Splunk for new Software #RSAC 34
Slide 35: CSC2 – SW Inventory - Quick Win
CSC2 – SW Inventory - Quick Win 3 Discover Unauthorized Software Goal: Within 24 hours Daily Active Scan of the Network -> Splunk Query Splunk for new Software ~ where the earliest scandate is within the last day Can be Alerted On #RSAC 35
Slide 36: CSC3 – Secure Configuration
CSC3 – Secure Configuration Automation: Discover Non Standard Setups Goal: Within 24 hours Daily Active Scan of the Network -> Splunk Query Splunk for certain SoftwareMarker Here: “Qualys Desktop Build” – which is a custom SW package that identifies our IT standard builds #RSAC 36
Slide 37: CSC3 – Secure Configuration
CSC3 – Secure Configuration Automation: Discover Non Standard Setups Goal: Within 24 hours Daily Active Scan of the Network -> Splunk Query Splunk for certain SoftwareMarker Here: “Qualys Desktop Build” – which is a custom SW packag that identifies out IT standard builds #RSAC 37
Slide 38: CSC3 – Secure Configuration
CSC3 – Secure Configuration Automation: Discover Non Standard Setups Goal: Within 24 hours Daily Active Scan of the Network -> Splunk Query Splunk for certain Software Marker Here: “Qualys Desktop Build” – which is a custom SW package that identifies out IT standard builds Can be Alerted
Slide 39: Further Uses and Projects
Further Uses and Projects Plot Progress for a Machine #RSAC 39
Slide 40: Further Uses and Projects
Further Uses and Projects Plot Progress for a Machine #RSAC 40
Slide 41: Further Uses and Projects
Further Uses and Projects Plot Progress for a Machine Plot Progress for a Network #RSAC 41
Slide 42: Further Uses and Projects
Further Uses and Projects Plot Progress for a Machine #RSAC 42
Slide 43: Other Operational Reports
Other Operational Reports Usage Reporting User Logins API Logins Reports Anomaly Detection GeoIP #RSAC 43
Slide 44: Other Operational Reports
Other Operational Reports Usage Reporting User Logins API Logins Reports Anomaly Detection GeoIP #RSAC 44
Slide 45: Beyond Prototyping
Beyond Prototyping Continuous Monitoring Alert on Additions & Changes Machines Vulnerabilities Ports Certificates Simple Configuration #RSAC 45
Slide 46: Questions?
Questions? [email protected] @wkandek http://laws.qualys.com