Free Newsletter
Register for our Free Newsletters
Access Control
Deutsche Zone (German Zone)
Education, Training and Professional Services
Government Programmes
Guarding, Equipment and Enforcement
Industrial Computing Security
IT Security
Physical Security
View All
Other Carouselweb publications
Carousel Web
Defense File
New Materials
Pro Health Zone
Pro Manufacturing Zone
Pro Security Zone
Web Lec
ProSecurityZone Sponsor
ProSecurityZone Sponsor
ProSecurityZone Sponsor
ProSecurityZone Sponsor
ProSecurityZone Sponsor
ProSecurityZone Sponsor

QualysGuard Gets Policy Compliance Module

Qualys : 16 February, 2011  (New Product)
Security-as-a-service offering now provides security compliance visibility, file integrity verification and password auditing
Qualys has announced the release of QualysGuard Policy Compliance 3.0, providing more comprehensive policy compliance scanning capabilities without the need to install agents. The latest version expands support for new operating systems and adds support for scanning databases and network devices – providing customers with a full, in-depth view of IT policy compliance across all assets.

“We have been using QualysGuard Policy Compliance to reduce the cost and complexity of our compliance auditing and reporting,” said Dan Klinger, senior manager of global information security for The Hershey Company. “QualysGuard Policy Compliance 3.0 expands its ability to scan IT assets beyond just servers and operating systems with the ability to scan databases and network devices. This will give us a more complete view of our compliance status and helps us to better prepare for audits and share proof of compliance with auditors from QualysGuard during the audit cycle.”

Independent research firm, Forrester Research, Inc. stated in the Wave* evaluation for Vulnerability Management report that “Qualys is one of the few vendors in this evaluation that has a full-featured configuration compliance module that provides concrete mappings from a wide list of regulations to actual IT controls.”

New features in QualysGuard Policy Compliance 3.0 include:

    * Expanded configuration support. New supported technologies include Active Directory 2000, 2003 and 2008, AIX 6.x. CentOS 4.x and 5.x, Oracle Enterprise Linux 4 and 5, HPUX 11i.v3, Windows 7, and Cisco IOS 12.x and 15.x. Total number of configuration checks as of February 11, 2011 is 6,922 across 34 technologies.

    * File integrity checks. Users can verify the integrity of files through agent-less, authenticated scans. New advanced scanning allows Windows and Unix file hashes to be calculated and compared scan to scan to verify the integrity of critical files.

    * Support for benchmarks and security checklists. The importable policy library currently supports the following Center for Internet Security (CIS) benchmarks: Windows XP Professional v2.0.1, Windows 2000 Level 1 v1.2.2, Windows 2000 Server Level 2 v2.2.1, and Windows 2003 Member Server v2.0.0; Federal Desktop Core Configuration (FDCC) security checklists: Windows XP v1.2, Windows XP Firewall v1.2, Windows Vista v1.2, Windows Vista Firewall v1.2, and Internet Explorer 7 v1.2; and United States Government Configuration Baseline (USGCB) security checklists: Windows 7 v1.0, Windows 7 Firewall v1.0, and Internet Explorer 8 v1.0.

    * Use of dissolvable agents. The QualysGuard scanning engine can use a dissolvable agent – an application used by the scanning engine to access certain data on target hosts that cannot be accessed remotely – for remote authenticated scanning. The agent is created on demand as needed and removes itself completely when it’s done collecting data, enabling secure, trusted, authenticated scans remotely. Read more about dissolvable agents in our Qualys Community post.

    * Password auditing checks. New advanced scanning capabilities using the dissolvable agent check the actual password of users, not just the rules governing the passwords. QualysGuard Policy Compliance 3.0 can validate password rules including empty password, password matches user name, and password matches an entry in the custom password dictionary.

    * User-defined controls. In addition to published content, QualysGuard Policy Compliance 3.0 supports user-defined content for Windows and Unix. This capability allows customers to expand content for additional or custom configuration settings stored in the registry or files.

    * New trend reports. Executive and technical reports include up to 90 days worth of trending data, including number of hosts scanned, number of controls in the policy, and compliance pass/fail results.

    * Integrations with leading GRC solutions. QualysGuard Policy Compliance 3.0 is now integrated with leading GRC solutions including RSA Archer and Rsam. These integrations help customers leverage their GRC investments by automating the collection of technical controls through agentless scanning.

    * Integrations with credential management systems. To continue to improve privileged scanning, QualysGuard Policy Compliance 3.0 supports integrations with Cyber-Ark for storing privileged credentials in a password vault and PowerBroker for providing better control and logging of escalated privileges.

“The new policy compliance features in 3.0, including the ability to scan databases and the use of dissolvable agents for secure authenticated scanning, create a powerful solution providing customers with a more complete view of their security and compliance postures at a price point lower than the annual maintenance cost of traditional enterprise solutions,” said Philippe Courtot, chairman and CEO for Qualys.
Bookmark and Share
Home I Editor's Blog I News by Zone I News by Date I News by Category I Special Reports I Directory I Events I Advertise I Submit Your News I About Us I Guides
   © 2012
Netgains Logo