Continuous monitoring for enterprise incident response

Qualys has further bolstered its Continuous Monitoring (CM) cloud service. The latest features include automated alerts for changes in perimeter IP addresses, as well as a new API interface that enables integration of alerts into incident response systems and SIEMs such as Splunk and HP ArcSight.

The new features and functionality provide organizations with the most comprehensive view of their security perimeters, while empowering them to proactively identify and address potential threats.

Organizations’ perimeters today are very distributed, complex and highly dynamic. There are often various operational teams managing firewalls, load balancers, systems, applications and databases, making frequent changes to a network environment independent of one another.

Perimeter scanning and response to unintentional security holes created by these changes is often event-driven and only performed at designated times, rather than on a continuous, always-on basis. This presents an opportunity for cybercriminals to exploit newly introduced vulnerabilities and infiltrate corporate networks in between scans.

“In an era of continuous compromise, enterprises need to shift from a mindset of “incident response’ – wherein incidents are thought of as occasional, one-off events – to a mindset of continuous response – wherein attacks are relentless, hackers’ ability to penetrate systems and information is never fully blocked, and systems must be assumed to be continuously compromised, and this, they must be continuously monitored,” said Neil MacDonald, Vice President and Distinguished Analyst for Gartner.

Qualys Continuous Monitoring provides organizations with an always-on view of potential security holes, enabling organizations to immediately identify and proactively address potential threats before they turn into breaches. Built on the Qualys Cloud Platform used by Fortune 1000 and organizations around the globe, Continuous Monitoring uses its elastic scanning capacity to dynamically scale to continuously scan networks of any size and scope, and instantly provide alerts as soon as an unauthorized change is detected.

“More and more customers are asking us to help them address “toxic combination’ type scenarios that can lead to compromises in their IT environments. An example of this could be a server that exhibits a combination of configurations or vulnerabilities that can make it susceptible to attacks,” said Philippe Courtot, Chairman and CEO of Qualys. “Combining a continuous security approach that integrates alerts into the incident response system, enables customers to quickly address potential toxic combinations by alerting them when a critical change suddenly appears in their environment. These alerts help to direct the information to the hands of first responders so they can immediately address and mitigate risk within their global perimeter.”

Qualys Continuous Monitoring now includes:

• Integration with SIEM Providers – a new extensible API interface incorporates alerts into incident response and monitoring systems via integrations with leading security incident and event management (SIEM) platforms, including Splunk and HP ArcSight
• Common Event Format (CEF) Support – use CEF format to send events into all popular SIEM and incident response products and get email alerts delivered directly to the inbox.

In addition, Qualys Continuous Monitoring allows businesses to continuously monitor and respond to any of these combinations:

• New Hosts – to see whenever systems appear, disappear, or are running unexpected operating systems
• OS Changes on Existing Hosts – to see when changes have been made to operating systems on systems
• Open Ports/Services – to keep tabs on network ports including newly opened ports, changes to ports, new services on ports, and closing of ports
• SSL Certificates – to track SSL certificates used on systems including expired, soon-to-expire, rogue or unknown certificates
• Vulnerabilities Changes – to know when there are changes in vulnerabilities including new, re-opened and closed instances
• Software Changes – such as installation of new software, upgrades or downgrades of existing software, and removals.