Qualys, a provider of disruptive cloud-based IT, security and compliance solutions, has announced it is opening up its risk management platform to AppSec teams to bring their detections to assess, prioritise and remediate the risk associated with first-party software and its embedded open-source components.
Every organisation develops its own software to run its business in the digital transformation era. This first-party or company-developed software often lacks the disciplined vulnerability and configuration management practices used for third-party software.
Studies have shown that over 90% of first-party software includes open-source components, while over 40% have high risks, such as exploitable vulnerabilities.
Today, application and security operations teams rely on manual checks or siloed scripts to evaluate the security of first-party software, resulting in ad-hoc security assessment that impedes the ability to prioritise and remediate risk effectively.
Furthermore, traditional vulnerability assessment or software composition analysis tools do not detect the presence of embedded open-source packages across the production environment. As a result, security teams face challenges in comprehending the true risk, particularly in security breaches like the Log4J incident.
The new Qualys solution enables organisations to bring their own detection and remediation scripts created using popular languages like PowerShell and Python to Qualys Vulnerability Management, Detection and Response (VMDR) as Qualys ID (QIDs), which the Qualys Cloud Agent executes in a secure and controlled manner.
Qualys TruRisk then detects and prioritises the findings in the same workflow and reporting used for the third-party software findings. This empowers application and security teams to leverage their detections to identify sensitive content, assess critical process and application statuses, tag assets based on sensitive or PII data presence, and mitigate risks associated with critical vulnerabilities like Log4J by configuring file parameters or addressing Follina by modifying GPOs/registry settings to efficiently manage the risk arising from both first and third-party sources.
"In our complex enterprise environment, we've often encountered situations where our security needs surpassed the capabilities of off-the-shelf software,” says Gabriel Julián Carrera, CISO at OSED. “Consequently, we've resorted to pulling together independent scripts to achieve the assessments our unique homegrown solutions require. Qualys' new offering eliminates this fragmented approach by seamlessly integrating our proprietary assessments and commercial tools into one unified Qualys TruRisk Platform saving us time and helping us stay ahead of potential attackers."
The new Qualys platform capabilities allow teams to create Qualys Detections (QIDs) and remediations based on their logic or scripts leveraging major scripting languages such as Python, PowerShell and others. These detections integrate directly into VMDR workflows and TruRisk scoring, helping SecOps teams unify and manage risk across first and third-party applications in their environment.
The teams also get continuous, real-time visibility into deeply embedded open-source software packages, such as Log4J, openSSL and commercial software components leveraging the Qualys Cloud Agent. Qualys TruRisk then prioritises and correlates the information based on data from over 25 threat feeds and the asset’s business criticality. This information allows security teams to rapidly mitigate the risk of high-profile security issues such as zero-day threats and Log4J outbreaks by crafting custom detection and responses.
With native integration to VMDR workflows, teams effectively communicate the unified view of risk in first and third-party software to the right stakeholders via real-time dashboards and reports. Integration with ticketing systems such as ServiceNow and JIRA enables the automatic assigning of detailed remediation tickets to the right owners through a standard view to close tickets quickly and reduce risk.
"First-party applications, being proprietary, often lack adequate risk detection, prioritisation and remediation support from scanning tools,” adds Sumedh Thakar, president and chief executive officer of Qualys. “Our first-in industry capabilities enable organisations to leverage the Qualys platform's capabilities, identifying and analysing both first-party and third-party software risks to develop an overall TruRisk score for a comprehensive view of the organisation's overall risk."
Enhancements to the Qualys Cloud Platform, including custom assessments and remediation via VMDR integrations, will be available by the end of August.