Qualys has 8,800 Global customers, 400 Billion scans security events yearly, with 99.99% accuracy. Qualys offers freemium services, with a free signup. Qualys is used in 100+ countries, and offers an integrated suite of solutions. This can simplify security operations and lower the costs of compliance. Qualys delivers critical security intelligence on demand, and automates the full spectrum of auditing, compliance, and protection. Qualys is a nice size fit for any size business, including those who are growing, as it is highly scalable. It offers freemium and subscription packages.
In addition to the solutions provided below, Qualys offers a number of freemium services:
SSL – Secure Website Test
Qualys AssetView is a free, cloud-based asset inventory service. It offers visibility and data on the assets of any organization. The service is comprehensive, and provides a scalable view of endpoints. Scalability can handle millions of assets, without the requirement of management infrastructure. AssetView offers details about services, file systems, and registry, with information regarding how to protect and secure systems. Virtualized environments work well with Qualys AssetView. It is designed to grow with your environment,. The services available in relation to Qualys Assetview are:
McAfee Complete Endpoint Protection – Enterprise
With easy installation and configuration, all endpoints will be reporting within 20 minutes. McAfee ePolicy Orchestrator handles automation of workflow, updates, deployment, and maintenance. Easy whitlisting, and installation of known good files and applications, with no scanning, compact footprint. Forensic investigations have flexible response, so you can focus on the most critical risks. High visibility and efficiency are achieved through extensible endpoint architecture with integration with Intel Security and other security providers. It offers zero-impact user scans, collaborative defenses against threats, antivirus, antispam, intrusion prevention, web security, dynamic whitelisting, and an integrated firewall for desktops and laptops. This option is available for Mac, Unix, Linux, Virtualization, Windows, and servers. McAfee Complete Endpoint Protection – Business
McAfee Complete Endpoint Protection for Business offers an easy to use, comprehensive solution for endpoint security. It works with cloud storage, tablets, virtualized systems, PC’s, MACs, and Linux systems. This is a cost effective solution for covering all of your endpoint security needs. This product offers device encryption, integrated firewalls for desktops and laptops, email and web security for phishing blocking, zero-day intrusion prevention, and advanced threat defense. It offers easy deployment, with centralized management and monitoring. McAfee Endpoint Protection for SMB
With a free trial, you will find that the McAfee Endpoint Protection for SMB’s will safeguard you from data, web, and network threats on your Windows and Mac endpoints. Fast deployment and ease of use for on-premise or cloud based platforms without any IT expertise is offered by this product. This is an integrated security solution with centralized management for compliance reporting, policy definitions, and adding new devices. This solution offers a simplified management console, and handles real-time threat intelligence. McAfee Endpoint Security for Microsoft Azure Environments
Easy integration with Azure, this product offers a free trial, and is a very scalable offering. Easily configurable, manageable, and deployable through Azure’s PowerShell platform, your interface is fully protected. This solution covers security for virtual, traditional, and the cloud. As your needs changes, licensing is easy with the Azure PowerShell platform. It covers mobile, data, web, email, and network attacks, as well as including the items that you truly desire: anti-malware, antispam, host intrusion prevention, device control, dynamic application control, and device control. McAfee Active Response
McAfee offers Active Response, which is completely automated for capturing and monitoring context and system state. Monitoring includes changes in system state (like IoA’s), and dormant attack components. Reports are automatically sent to your forensics, operations, and analytical teams. It is highly adaptable for your changing needs, as well as changes in attack methodologies. This product offers automated data collection, alerts and responses that are easily customizable and configurable in relation to your needs. Monitoring is continuous, and utilizes the McAfee ePolicy Orchestrator console. McAfee Endpoint Protection – Advanced Suite
McAfee Endpoint Protection – Advanced Suite Offers centralized policy-based management and endpoint protection for devices on and off of your network, whether it is a Windows or Linux system. Traditional offerings of endpoint security, including blocking viruses, Trojans and worms are found, in addition to monitoring and restriction of data movement to external devices. This solution installs quickly and simply, is known to block zero-day attacks, and can control access to external websites. McAfee Endpoint Protection Suite
Easily and quickly deployable for Mac, Linux, and Windows systems, McAfee’s Endpoint Protection Suite offers solutions for compliance, data loss prevention, malware blocks, and all core functions for securing desktops in a single, customizable platform to lessen costs. This solution is integrated with McAfee’s ePolicy Orchestrator management console for easy deployment and security management.
Qualys Cloud Agent
The Qualys Cloud Agent, with its 3MB lightweight agents can be installed anywhere, allowing it to perform vulnerability management and policy compliance checks across your entire Global IT infrastructure in real time. There is no need to schedule scan windows or manage credentials for scanning. Data is collected and immediately sent to the Qualys Cloud Platform. Agents are remotely deployable, centrally managed, and updating. Resource cost is 5% at peak, with less than 2% in normal operation. Qualys offers a tagging solution, and the attributes can be assigned to asset groups, business owners, technical owners, or criticality of device.
The Cloud Agent can be utilized for Vulnerability Management, Policy Compliance, and Elastic Cloud Environments. It also offers Cloud Agent Connect.
Qualys Vulnerability Management provides an automated and global scalability solution based in the cloud. Advantages of the cloud based services include continuous monitoring of internet exposed systems, accurate assessments anywhere (perimeter, internal, cloud), and verifies fixes. It enables you to view your network the way that hackers do, organizes assets by business value, and provides automated tracking of your risk posture. IT efficiency is boosted, which will reduce the time and costs of network security. There are no servers to deploy, data is up-to-date and accurate, and remediation is prioritized by business risk. The platform grows securely and seamlessly, expanding as your business expands, with rich APIs, global scalability, and a suite of integrated solutions.
Qualys Continuous Monitoring provides real-time protection against phishing scams and zero-day attacks. It will proactively monitor perimeter and internal IT assets, with a free trial. This service will alert on anomalies on your critical assets, and mitigate vulnerabilities before the hackers succeed in breaking in. This service meets the NIST 800-53 mandate that requires continuous monitoring. It provides immediate visibility, boosts auditors’ trust, will catch expiring SSL certificates before they expire, track your digital certificate deployments, find weak or self-signed certs, and offers free security teams to review your reports.
Prioritizes threats and lets you know what needs protecting first, by correlating active threats against your vulnerabilities. The service includes a Live Threat Intelligence Feed, which will show the number of assets that are impacted by threats, and allows you to drill down for asset remediation. The dashboards are dynamic, showing your threats at a glance, and does not require high technical skills to operate. Trend analysis is offred using Qualys Vulnerability Management, which integrates well with ThreatPROTECT. This tool will enable you to scan and create reports for stakeholders. A simplified scanning tool assists in searching , sorting, tagging, filtering, and fine tuning reports.
QualysGuard will show your true security risk posture, your configuration issues, all in one place. The assessment is automated. It completes high volume scanning and identification to identify and track assets anywhere. Assessments can be expanded to include OS, applications, databases, and network devices. Compliance costs are cut, due to reduction of time spent assessing systems. There are no servers to deploy, an interactive policy editor and controls library. This tool can assist in achieving and proving compliance with common audit frameworks based on mandate-based policies. The process is repeatable and trackable, providing detailed failure evidence, and exception documentation and tracking. QualysGuard offers automated ticketing for efficient risk reduction, integration with GRC applications, and ties in well with other ticketing and helpdesk systems through the use of flexible APIs.
Qualys QualysGuard PCI Compliance
PCI Compliance in the cloud offers a simplified solution. Verification of compliance is completed in four (4) easy steps:
1. Deploy – Up and Scanning in minutes
2. Scanning – Achieve PCI Compliant status and secure your network
3. Remediation – solve security threats, with detailed instructions
4. Auto-submission of compliance status to Acquiring bank(s)
Scanning results offer detailed instructions for vulnerability remediation, and offers automatic quarterly scan results and documentation. Qualys is an approved scanning vendor with the PCI Council.
Qualys Security Assessment Questionnaire
The Qualys Security Assessment Questionnaire is based in the cloud, and assists in collecting and analyzing information about your business easily and quickly. It can go beyond risk assessment and compliance, and can verify that internal departments and third-parties are audited for process compliance and operational governance. Reporting is reduced to a single platform, immediately deployable, highly scalable, and can organize host asset groups. Templates have an easy to use UI, with prebuilt out-of-the-box templates to cover common compliance templates like HIPAA, ISO, PCI, HITrust, NIST, etc. Each template has definable options, and drag and drop input controls. Each campaign can be launched and tracked in real-time, with automated information gathering, workflow options, easy reassignment, central management and monitoring, and reminders.
Web Application Security
Web Application Scanning
This cloud-based service provides automated crawling and testing of custom web applications. It identifies XSS, and SQL injection vulnerabilities, as well as others. It enables regular testing, reducing false positives, and easily scales to a large number of websites. Scanning is proactive, scanning for malware infections, and sends alerts to help prevent brand reputation damage and black listing. This tool integrates with SDLC and QA with full visibility on web application security. Qualys MD will find hidden malware, OWASP Top 10 risks, WASC threats, CWE weaknesses, and web application CVEs are detected, tracked, assessed, and remediated. Free training is also offered.
Web Application Firewal
As a cloud based service, the Qualys Web Application Firewall (WAF) is a next –generation cloud-based service. It has an automated and adaptive approach to assist in quickly and efficiently block attacks, web server vulnerabilities, control when and where applications are accessed, and prevention data loss. The Web Application Firewall supports SSL/TLS, does not require user expertise , and is highly scalable. One console is used for WAS, WAF, VM, to allow for centralized management, with XML APIs that will publish data to other tools, like SIEM.
Qualys Malware Detection (MD)
Qualys MD scans websites for malware daily to identify and eradicate malware which could infect visitors and cause a loss of revenue and/or data. The system immediately emails organizations when malware has been discovered, with the infection details so that organizations can isolate and remove the malware. It requires no special hardware to deploy.
Qualys SECURE Seal
The Qualys SECURE Seal helps businesses of all sizes scan for malware, web application vulnerabilities, network vulnerabilities, and SSL Certificate validation. Once the website passes the testing, the merchant can display the Qualys SECURE Seal on their website to notify customers that they are taking a strong approach to security. This tool also provides centralized reporting with verified fixes for remediation, on demand and automated scaling, fully automated multiple website scanning, demonstrated security and sales improvement, and the safeguarding of your brand image.