New security tool serves Amazon Cloud users

The new QualysGuard connector conducts vulnerability scans of virtual servers in the Amazon Cloud.

For many IT managers, moving your company's backbone to the cloud brings a certain sense of freedom. However, the task of caring for and protecting your assets remains. After all, the operative word in "virtual server" is "server"; virtual or not, it's still a fully functioning server from an operational sense, carrying the same risks and vulnerabilities inherent in physical servers. You'll need vulnerability management tools to ensure those servers are secure.

To that end, Qualys announced this week that QualysGuard--its cloud-based suite of security and compliance tools--now works with Amazon's popular cloud services.

The rate at which new vulnerabilities are discovered is staggering. An estimate from 2010 put the figure at two per second. That may be on the extreme high end, but the point is that securing a server--virtual or physical--is a fluid, constantly changing process. You have to monitor regularly to determine which vulnerabilities your servers are exposed to, what the potential impact is, and what you can do to eliminate or mitigate the risk.

The new QualysGuard connector uses Amazon APIs to connect with virtual servers in the Amazon cloud. Businesses that use Amazon EC2 or VPC cloud services can use QualysGuard to conduct automated scans of virtual server assets, and generate reports to help IT admins address potential risks.

Qualys worked with Amazon to ensure the QualysGuard scans are pre-authorized, and to prevent any inadvertent scanning of third-party virtual servers in the Amazon cloud. Customers don't have to get explicit permission from Amazon before conducting a QualysGuard vulnerability scan because the activity is pre-approved by Amazon.

The native Amazon API connectors can be connected to one or more Amazon accounts, and automatically sync asset inventories from the Amazon EC2 and VPC services. Amazon attributes and context data are automatically collected during the import process, and IT admins can assign Dynamic Asset Tag data, which is used by QualysGuard for applying policies and generating reports.

Qualys customers who already subscribe to the QualysGuard Service and use Amazon cloud services will welcome the new capabilities. For companies starting at square one in search of a vulnerability scanning solution for Amazon cloud virtual servers, though, Qualys isn't the only choice. QualysGuard is the only thing that comes up in the Amazon AWS Marketplace if you search for "vulnerability scanning", but Eeye Retina Cloud Security also provides vulnerability management for Amazon EC2.

The new features are currently available to Qualys customers as part of their QualysGuard subscriptions. Annual QualysGuard subscriptions start at $2495 per year for 32 IP addresses. At least one QualysGuard Virtual Scanner Appliance license at $995 per year is required for internal network scanning functionality on Amazon. For more information, visit the Amazon AWS Marketplace.

Join the CSO newsletter!

Error: Please check your email address.

Tags virtualizationsecuritycloud computinginternetqualysbusiness security

More about Amazon Web ServicesQualys

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Tony Bradley

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts