“Risk-based Remediation Powered by Patch Management in Qualys VMDR 2.0” by Qualys
To tell the truth, I have long been interested in what’s new in Qualys Vulnerability Management, Detection and Response.
According to the recently released Verizon DBIR report, vulnerability exploitation continued to be one of the top three attack vectors exploited by bad actors in 2021 to break into organizations. As of this writing, it’s only June, but more than 10,000 vulnerabilities have already been disclosed in 2022, according to the National Vulnerability Database (NVD). As if that weren’t bad enough, the rate of increase of ransomware attacks last year was more than the last five years combined.
The resources required to patch all these vulnerabilities have not kept up with the pace at which vulnerabilities are disclosed and exploited.
The correct remediation path is not always straightforward. In some cases, patching a vulnerability can require deploying a patch, making a configuration change, or both.
All these introduce delays in the remediation process.
Qualys VMDR 2.0 introduces TruRisk scores that help organizations prioritize vulnerabilities based on risk ratings that weigh multiple factors such as exploit code maturity, exploitation in the wild, and multiple other factors that accurately measure risk.
In general, it looks like Tenable vulnerability priority rating (VPR). It’s probably generated the same way. But the technical details of TruRisk are not given here.
A key step in any remediation workflow is good communication between the vulnerability management (VM) team and the remediation team. However, these two teams use different products and different terminology. The VM team understands the risk and QIDs. The remediation team understands patches. Qualys maps the selected vulnerabilities to the right patches and configuration changes required to remediate them specific to the organization’s unique environment. For some assets, this entire process can be automated with VMDR 2.0. For example, a zero-touch automation job can be created to patch non-mission critical assets that will automatically execute as soon as a new vulnerability with a Qualys Detection Score more than 90 is detected.
Integrated Patch Management is Simply Faster. On average, organizations that use Qualys VMDR + Patch Management remediate vulnerabilities 35% faster than organizations that use separate tools. Even better, with some vulnerabilities the difference can be 63% faster with a combined solution.
I agree that the focus of the VM should be on Remediation and it’s good that Qualys is pushing this topic. Is there enough new features to call this update VMDR 2.0? I don’t think so yet. It seems that if Remediation were fully automated for 100% of the hosts (which requires a fundamentally different approach to functional testing after the patch), then it would be 2.0. But marketers of Qualys know better.
Full episode: https://avleonov.com/2022/07/06/vulne...
Article: https://blog.qualys.com/product-tech/...
#Qualys #VMDR #TruRisk