Qualys Vulnerability Scanner

What is the Qualys vulnerability scanner?

The Qualys vulnerability scanner is a cloud-based tool that finds, scores, and tracks software security vulnerabilities across an organization’s assets. It is sold commercially, and it is used to prioritize what to fix first, assign the work, and confirm the fix before an attacker finds the same weakness.

Qualys Web Application Scanning (WAS)

Qualys is also used to scan for vulnerabilities in deployed web applications. The Qualys Web Application Scanner (QWAS) is used to target web application vulnerabilities. QWAS tests against the OWASP Top 10, the Open Web Application Security Project’s list of the most critical web application security risks. The OWASP Top 10 list categorizes and prioritizes the most dangerous risks faced by web applications. The Qualys Web Application Scanner finds these vulnerabilities, including SQL injection, cross-site scripting (XSS), cross-site request forgery (CSRF) and URL redirection. 

Qualys VM is a cloud-based service that provides visibility into where IT systems might be vulnerable to threats. Qualys VM provides continuous vulnerability management and supports compliance. Qualys VM helps to continuously identify threats and monitor changes in your network that could become data breaches. 

Key Features and Functions

Qualys VM supports discovery of even forgotten devices and helps your internal teams better organize host assets. Qualys VM discovery helps your team determine what is actually running in the different parts of the network. This can include hybrid environments from your perimeter and corporate network to Amazon EC2 cloud services. 

Agent-based architecture

Qualys VM also supports Qualys Cloud Agents, which extends network coverage to assets that can’t be easily scanned. The agents reside on the assets they monitor. Nothing else is required. Vulnerabilities are found faster, and generally with minimal network impact.

Expansive visibility

Qualys VM continuously scans and identifies vulnerabilities with very high accuracy. This provides important protection for IT assets on premises, in the cloud and in mobile devices. The Qualys VM dashboard displays an overview of security posture and more. Qualys VM generates custom, role-based reports for multiple stakeholders. This includes automated production of the security documentation compliance auditors ask for.

Hybrid  vulnerability management

Qualys covers hybrid environments, including on-premises, cloud, and mobile deployments.  

Broad scanning capabilities and flexibility

Systems can be scanned from one console. Targets may include your perimeter, your internal network, and cloud environments. Qualys VM separates scanning activity from reporting. You can create custom reports that segment data by the intended viewer audience. This includes:

• Select target hosts by their Internet Protocol (IP) address, asset grouping or asset tagging. 
• Scan on demand, on a schedule, or continuously.
• Scan behind the firewall with Scanner Appliances which are remotely managed by Qualys. 
• Internal networks may be scanned, including those with overlapping private IP address space. 
• Authentication credentials may be used securely to log in to each host, database, or web server scan on Amazon EC2.
• Configuration information may be stored offsite with a secure audit trail.

Risk triage

Qualys VM helps identify the highest business risks using trend analysis, Zero-Day and Patch impact predictions. Other capabilities include:

• Track vulnerabilities over time and show continual status and changes
• Monitor digital certificates deployed throughout your network
• See which hosts need updates after Patch Tuesday every month 
• Examine your network’s vulnerabilities over time
• Predict which hosts are at risk for Zero-Day Attacks with the optional Qualys Zero-Day Risk Analyzer

Remediate vulnerabilities

• Automatically generate and assign remediation tickets for identified vulnerabilities.
• Produce consolidated reports of which hosts need which patches. 
• Allow Integration with IT ticketing systems. 
• Allow for exception management. A vulnerability is sometimes riskier to fix than to leave in place.
• Automatically expire exceptions after a period of time for later review.

Custom reporting

Custom reporting can generally be done anytime without re-scanning. Qualys VM uses a library of built-in reports. You can change what’s shown or choose different sets of assets without having to re-scan. Reports can be generated on demand or scheduled automatically and then shared with the appropriate recipients online and in a variety of formats. Other capabilities include: 

• Create different reports for different audiences.
• Document that policies are followed, and also document when lapses in policy are remediated.
• Provide the right data you need to document each vulnerability, including changes in status (trends), possible predictions, and potential approaches to remediation.
• Track ongoing progress against vulnerability management objectives. 
• Share data with GRC systems & other enterprise applications using a flexible XML-based API.

Other Qualys VM features

• Qualys VM visually maps your network using a graphical host map.
• Help teams remediate and triage vulnerabilities by assigning a business impact to each asset. 
• Identify which OS, ports, services, and certificates are on each device on your network. 
• Control which hosts can be scanned by which appropriate users.
• Allows for the continuous monitoring of your perimeter for unexpected changes with the optional Continuous Monitoring Service (offered by Qualys).
• Dynamically assign assets to categorize hosts by tags like network address, software installed, vulnerabilities, and more. 

Summary of Qualys VM Benefits

Visibility

Qualys VM provides full clarity into data center assets, identifies their vulnerabilities, prioritizes remediation and assesses IT compliance. On-premises, at endpoints or in the cloud, the Qualys Cloud Platform sensors are always on which provides continuous 2-second visibility of all your IT assets. Remotely deployable, centrally managed and self-updating, the sensors come as physical or virtual appliances, or lightweight agents. 

Continuous protection

Qualys VM continuously monitors your environment, and flags traffic anomalies and compromise indicators. Qualys Cloud Platform provides an end-to-end solution, minimizing the cost and complexities that come with managing multiple security vendors. The Qualys Cloud Platform also automatically gathers and analyzes security and compliance data in a scalable, state-of-the-art backend, and provisioning additional cloud apps.

Prioritize result management

Qualys VM features a flexible and highly functional data analysis, correlation, and reporting engine. The Qualys Cloud Platform is accessible directly in the browser and does not require the use of plugins. This includes a single-pane-of-glass user interface for all applications and lets the organization customize dashboards, drill down into critical details, and generate necessary reports for teammates and auditors.

Low total cost of ownership (TCO)

No capital expenditures, extra human resources or infrastructure or software is required to deploy and manage Qualys VM.

Alert-driven response to threats

Qualys’ Cloud Agent technology and Qualys Continuous Monitoring service lets teams proactively address potential threats whenever new vulnerabilities appear, and then Qualys generates real-time alerts on a timely basis.

Frequently asked questions about Qualys

Is Qualys a vulnerability scanner?

Yes. Qualys is a cloud-based vulnerability scanner and a broader security platform. Its scanning is delivered through internet and internal scanner appliances and through lightweight Cloud Agents installed on the assets themselves.

Is the Qualys scanner free?

Not for enterprise use. Qualys offers a free tier called Community Edition, which covers a limited number of assets and web applications and is intended for small environments and evaluation. Full vulnerability management is licensed commercially. [SME review] Confirm current Community Edition asset limits before publishing rather than quoting a number here.

What is Qualys used for?

Finding and prioritizing security vulnerabilities across on-premises, cloud, and mobile assets, tracking them over time, generating remediation tickets, and producing compliance reporting for auditors.

How does Qualys work?

Qualys builds an inventory of your assets, scans them from appliances or agents, matches what it finds against its vulnerability signatures, scores and prioritizes the results, and hands them to your team as reports or tickets. Scanning and reporting are separate, so you can re-report on existing scan data without re-scanning.