security best practices qualys customer

0.88 MB·

Best Practices
from a Qualys
Customer
Paris
Thursday 23 January
#QSC20
Best Practices from a Qualys Customer
Once upon a time… More than a vulnerability scan program
Computing a score for each scope creates positive competition
#1
between each region
Some IT admins and managers have a part of their annual bonus
#2
calculated based on the score
Some Business Units are not fairly assessed as scanning of all their
#3
IP addresses is not mandatory
Creation of a fairplay score to have BU register more assets,
#4
but difficult to keep up-to-date
Local teams don’t always have the time to work on the service
#5
(ex : business value)
Choose a popular and well-known programming language!
#6
(Python vs Ruby)
#7 Adapting our scripts took time
Exploring and playing with the scanning profiles and report
#8
templates helps to find the ones we need
We can’t rely on these reports only as we need to communicate
#9
the VuDiP score
#10 Establish a trustworthy relationship with our OT contacts
Communication (contents & format) to Directors and Managers
#11
is not to be neglected
Invest time to properly delegate scanning rights
#12
(allowed scope, training)