Qualys’ library of built-in policies makes it easy to comply with the security standards and regulations that are most commonly used and adhered to. Qualys provides a wide range of policies, including many that have been certified by CIS as well as the ones based on security guidelines from OS and application vendors and other industry best practices.

In order to keep up with the latest changes in security control requirements and new technologies, Qualys publishes new content to the Policy Library every month.

The March release includes the following new policy and updates:

• New Industry and Best Practice policies for Microsoft Windows 10 Release 1809
• New CIS Benchmark policies for Amazon Linux 2 v1.0.0, VMware ESXi 6.5 v1.0.0, Debian Linux 9 v1.0.0, and Microsoft Windows 10 Enterprise Release 1803 v1.5.0

Continue reading …

This new release of the Qualys Cloud Platform, version 8.18.2.0, includes the new look for the App Picker, new technology support for Unix UDCs, and error code/text for errors that occur during control evaluation.

Continue reading …

Tell your security story to your peers at Black Hat USA 2019!

Qualys is looking for customers excited to share your security story, for example:

• How you integrate security into DevOps
• Best practices for building security into modern enterprises
• Case studies leveraging the use of the Qualys Cloud Platform

Take the stage in the Qualys booth to share your experience with Black Hat USA attendees two or three times total during exhibit hall hours on August 7 and 8.

If you would like to be considered as a presenter, please send a title and short abstract for a 20-minute presentation to Victoria Venturi at vventuri@qualys.com. The call for presenters is open through Thursday, June 6, 2019.

Black Hat USA is held at Mandalay Bay Resort and Casino in Las Vegas. Qualys will provide accepted presenters with a full conference pass, and pay your airfare plus hotel expenses for the conference.

Looking for inspiration? See what customers presented in the Qualys booth last year.

Recently new vulnerabilities like Zombie POODLE, GOLDENDOODLE, 0-Length OpenSSL and Sleeping POODLE were published for websites that use CBC (Cipher Block Chaining) block cipher modes. These vulnerabilities are applicable only if the server uses TLS 1.2 or TLS 1.1 or TLS 1.0 with CBC cipher modes.

Continue reading …

The Qualys Training team has expanded the AssetView & Threat Protection course, and added two new training series: CertView and Troubleshooting Scanner Appliance Error Codes.

These new additions build on last month’s update, when we introduced the new Vulnerability Management learning path, which takes you from the fundamentals through advanced topics, and ensures you have a complete foundation in Qualys technology.

The Qualys Training team brings you these updates to help you learn quickly how to get the most value from your Qualys subscription. Read on for more detail on what’s new this month.

Continue reading …

If your company uses Slack and is looking for ways to easily monitor activities in its AWS Golden AMI Pipeline, you can use AWS native services to send messages into a Slack channel. This can give your teams better visibility into the approval process for the candidate AMIs that they submit, as opposed to handling this via email. As we all know, email messages can get lost, overlooked or dumped in spam folders, which doesn’t happen with Slack messages. Moreover, Slack channels can have multiple subscribers so a single message can be seen by multiple people or other bots. Handling approval requests within a Slack channel also simplifies the management of the process.

Read on for a detailed, step-by-step explanation.

Continue reading …

(This is a guest post by Grant Johnson, Director, Risk & Compliance at Ancestry)

Over the past two years, Ancestry moved its entire applications and data infrastructure from local data centers to Amazon’s cloud, and this required a new approach for managing vulnerabilities in our DevOps pipeline. In the hopes that our insights will help security teams embarking on this path, this article details the challenges we faced and the best practices that helped us succeed, including:

• the benefits of replacing production AMIs with new ones instead of patching them;
• the importance of making security an enabler of agile, cloud processes like DevOps;
• and effective ways to get DevOps team members and senior leaders to buy into your risk reduction strategy.

Read on to learn how, with Qualys’ help, we streamlined and automated vulnerability fixes, resulting in a steep drop in the number of high severity bugs in our production applications.

Continue reading …

This release of the Qualys Cloud Platform version 2.38 includes updates and new features for AssetView, Web Application Firewall, and Web Application Scanning, highlights as follows.

Continue reading …

This month’s Patch Tuesday addresses 74 vulnerabilities, with 16 labeled as Critical. Eight of the Critical vulns are for scripting engines and browser components, impacting Microsoft browsers and Office, along with another 5 Critical vulns in MSXML. Two Critical remote code execution (RCE) vulnerabilities are patched in GDI+ and IOleCvt. Two privilege escalation vulns in Win32k are reported as Actively Attacked, while another in the Windows AppX Deployment Service has a public PoC exploit.

Continue reading …

Qualys’ library of built-in policies makes it easy to comply with the security standards and regulations that are most commonly used and adhered to. Qualys provides a wide range of policies, including many that have been certified by CIS as well as the ones based on security guidelines from OS and application vendors and other industry best practices.

In order to keep up with the latest changes in security control requirements and new technologies, Qualys publishes new content to the Policy Library every month.

Continue reading …