Managing risk is the name of the game for a CISO. Quantification is a major part of that job, but it doesn’t end there. Without a means of communicating that quantification to the rest of the business, quantification just adds to the noise.

In this episode, UJ Desai, Senior Director of Product Management, Partner Programs at Qualys explains how they provide a comprehensive solution for the Risk Operations Center, with comprehensive ways to ingest data from your applications, make sense of the data, and give your organization the tools to make the right priorities with it. Joining him are our panelists, Montez Fitzpatrick, CISO at Navvis, and Derek Fisher, Director of the Cyber Defense and Information Assurance Program at Temple University.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, Qualys

Full transcript

[Voiceover] Connecting security solutions with security leaders. Security You Should Know starts now.

[Rich Stroffolino] Welcome to Security You Should Know. Today, we’re talking with Qualys, and what they’re doing in the Risk Operation Center category. Now, the problem they’re addressing is, how do you measure, communicate, and ultimately eliminate cyber risk? Helping us get answers to these questions are Derek Fisher, director of the Cyber Defense and Information Assurance Program at Temple University, and Montez Fitzpatrick, CISO at Navvis. So Montez, I’m going to start with you. Why are we still struggling to measure, communicate, and eliminate cyber risk? Isn’t that the job?

[Montez Fitzpatrick]  That is the job. Honestly, us in information security, we have a very real and tangible problem. I think that we speak a different language than our peers, and when we come up from the information security side, we came up on… A lot of us, technically, that was the path that we came to, and it was more or less, we were not able to really talk the language of business.

That, I think, is a difficulty as we churn from a technical role into a business enabler, and there is some problem on both sides of the aisle. On the information security side, we have to learn to talk business better, and then on the business side, they have to really understand cybersecurity risk. Cybersecurity risk, and what has been the traditional risk, maybe from the financial aspect, they use a lot of the same words, but they are different. We don’t get a lot of the same vehicles that they do in financial risk. So there are some challenges that are presented there.

[Rich Stroffolino] Well, Derek, I’m going to come to you with the same question. Why are we still struggling with this problem?

[Derek Fisher] So I think for me, a lot of the challenges is that everything changes every week, every month, every day. Take a look at artificial intelligence when it… I mean, it’s been around for a very long time, but ChatGPT hits the scene, suddenly everything in security is upended. So I think as the landscape changes, whether it’s artificial intelligence, cloud, quantum as it comes on, the changes in the way we deliver features to our clients, and it’s an evolving space, and we all know that. 

But I think the real challenge with that evolution of technology and how it gets delivered to our customers and clients is that, how do we align those challenges to the business impact, right? So okay, ChatGPT comes on the scene, what is the impact to our organization? What does that mean? So trying to figure out those connections can be very difficult.

[Rich Stroffolino] Well, today we’re going to be talking with U.J Desai, Senior Director of Product Management from Qualys. Now, U.J, to start out, we’re answering three essential questions. How do I explain the value of your solution to my CEO? What does your solution do, and what does it not do, and what does the pricing model look like? Can you help us out with these preliminaries?

[U.J Desai] Sure. So Qualys, as you know, in the industry, is known as a vulnerability management solution provider. Over the years, our solution obviously has evolved quite a bit. Today, it’s a platform that allows organizations to measure, eliminate, and communicate cyber risk effectively to all stakeholders. Montez and Derek briefly highlighted the challenges that they face on daily basis, and that’s exactly what we are looking to solve. 

Talking about the language that everybody understands, there is only one language, and that’s the language of money. That’s exactly what Qualys helps you do. It allows you to translate cyber risk into monetary value and then provides your workflow to eliminate that cyber risk. The pricing is very simple. It works on per-asset basis. So depending on number of assets you have in your environment, maybe at workstation servers, code repository, web application, so there’s a cost per asset for our solution.

[Rich Stroffolino] Excellent. Well, Derek, Montez, we’ve heard some of the preliminaries here, but I’m sure you have a lot of questions, a lot of stuff to dig into here. So Derek, I’m going to start with you. What other questions do you have for U.J and for Qualys?

[Derek Fisher] One of the biggest challenges with technology and IT, and whether you’re a smart factory or a software development organization, your infrastructure spans on-prem, hybrid, cloud, colo, all these different locations, how does Qualys take all those disparate environments and distill that down into…I hate using this term because it’s so overused, but the single pane glass, right?

How do I distill my entire organization’s environments into something that I can visualize quickly so that when I’m in the middle of a cyber incident, I know where my assets are, what the risk is to the organization? How does that work?

[U.J Desai] Yeah, so with Qualys, as you know, we have wide variety of sensors that we have in our platform that allows you to identify devices in your network. So if you’re leveraging Qualys today, that information already exists in our platform.  However, if you don’t use Qualys, we can work with any technology that you could be leveraging in your environment, and ingest that data in our platform to give you a unified view of asset.

So today we work with leading vulnerability management solutions like Tenable, Rapid7, we integrate with CrowdStrike, we integrate with EDR solutions, IoT technologies, we integrate with cloud security vendors like this. So any solutions that you may be leveraging that has information about the assets, we will integrate and we’ll bring that into our platform to give you a unified view of your environment, because everything starts with visibility.

[Derek Fisher] So you mentioned sensors. I’m assuming…are these agents? Are they agentless? How does that work?

[U.J Desai] Yeah, we have wide variety of sensors. We have, of course, what we call our classic agents that you can deploy it on workstation and servers. We have network scanners as well that sit in your network and identify devices and network topology in your environment. We have passive sensor, and they can do the discovery of what exists in your environment, and even our agent is equipped with sensing capability. So that agent that you deploy on one of the systems can go ahead and detect additional assets.

[Rich Stroffolino] All right, Montez, what questions do you have for U.J?

[Montez Fitzpatrick]  So a lot of our fellow CISOs, we have done or committed to risk quantification or at least tried, and a lot of us have had a lot of false starts. So we’ve tried the FAIR model or any other, certainly the models that are out there. One learning that I keep coming back to is that, when we try to go to the business and we talk in this language of risk quantification, we are really discussing in a language that no other department in the organization really talks like that.

So I think we can understand with the dollars and sense of it that, that makes a lot of sense to bring that to the organization, but when no other department talks like that, I think they are thrown a little bit unawares or off. So how do you breach that, or how have you talked with other CISOs in that regard?

[U.J Desai] Yeah, this is a common challenge that we see when we engage with our clients as well. I think the central theme here really is to keep the language simple. If you cannot explain your quantification to various stakeholders, that means you failed, right? So the idea is to keep the model very simple. Now, there are certain organizations that are ready for more advanced risk quantification methods. This is where we work with our partners. So we have an alliance, we call it mROC Alliance. So we will work with you or your clients and figure out, what is the right risk quantification strategy for you? Once we have all aligned on that, then we will work with you to implement that.

[Montez Fitzpatrick]  So just from a platform perspective, how many users or full-time employees do we need to run it per thousand? So I don’t know what the scale and gradient is, but just, can you give a sense of how many individuals are needed to operate the platform, to use it as best effectiveness?

[U.J Desai] Absolutely. So initially there is some heavy lifting because you have to ingest the data from wide variety of your scanning tools that you may have because the idea is, we are giving you a unified view of risk. So we want to make sure that whatever risk telemetry you have in your environment through various tools you may be leveraging, we want to ingest that in our platform to give you a unified view of risk. So there is some work needed initially, but once you have configured our sensors and our connectors, then you don’t need a lot of resources.

I think, essentially, what you need, is a couple of people to constantly monitor the risk scores that we are providing, and if you see any spike in the risk score, all of a sudden, you’re seeing that there is a lot more risk than you anticipated, then you need to take action. So this is where you need some help. But the great news is, that we do provide services through our partners. So if you are resource-constrained, we can help you through our partners, who can provide managed services for this platform.

[Derek Fisher] So one of the biggest challenges with managing infrastructure and environments is the concept of shadow IT, right? So, especially with cloud environments, it’s not very difficult for an engineering team to create an environment within minutes, up and running, having PII, sensor data there… Is there any ability to detect that as it comes online? If so, what’s that timing look like? Are we talking about seconds, we’re talking about minutes, days? 

[U.J Desai] Yeah, that’s a great question, Derek. So, of course, if you’re leveraging Qualys and our sensors, then we do have sensors that can identify cloud workloads almost instantaneously. If you’re leveraging other tools to protect your cloud environment, then we will integrate with those tools and bring that information into our platform as well. So we provide you a lot of flexibility in terms of identifying the cloud resources, be it shadow IT, that your team could be leveraging.

[Montez Fitzpatrick]  Just trying to get a sense of how the platform will be used, could you give me a quick overview of once everything is set up, the workflow and what that looks like for the analysts who will be basically running the running the tool from a daily basis.

[U.J Desai] Yeah, there are a couple of important concepts. We have a notion of what we call business entity. This business entity is nothing but group of assets for which you want to manage risk, right? A simple example could be your crown jewels. You can combine your crown jewels into what we call tier one application, and once you set up all the assets associated with this application and configure our Risk Operation Center, it will start giving you the risk score based on the vulnerability, misconfigurations, and compensating controls that exist on those assets.

You can leverage that information to really understand what is going on. So if you see a spike in risk score, that means there are new vulnerabilities that have been identified that needs to be taken care of. So this is where your analyst will spend some time understanding why the TruRisk score went up. But the great thing about our platform is that we also offer remediation. So a lot of these vulnerabilities and misconfigurations oftentimes can be easily remediated, but oftentimes cybersecurity team doesn’t have a full control on the patching aspect, right? So this is where we can help you, where we have our own remediation capability.

But if you’re leveraging other tools, we will work with things like ServiceNow to help you speed up the remediation.

[Montez Fitzpatrick]  So maybe the most unfair question would be, how do you prove that what’s in the tool is correct?

[U.J Desai] Yeah, that’s actually a great question. So one great thing about Qualys is that we’ve been doing vulnerability management for 25-plus years. We protect more than 70% of Fortune 500 clients today. So we have a deep expertise in this area, and we have 120-plus threat researchers that are constantly looking at threat landscape, and understanding what is happening in the real world. So when we bring the risk telemetry from other tools, we just don’t rely on their ratings or their scoring mechanism.

We apply our own threat intelligence, and then we reprioritize based on our understanding of threat landscape. Then we also use the business context of the asset as another aspect to give you the overall prioritization on what you need to fix.

[Rich Stroffolino] All right. Well, U.J, what’s one thing we didn’t ask about that we need to know about Qualys?

[U.J Desai] Yes. So oftentimes when we start talking about ingestion of risk telemetry, we get this question. “Is this a Security Operation Center capability?” The answer is no. Security Operation Center is designed to focus on indicators of compromise, the post-attack scenario. What we’re doing with Risk Operation Center is, we are focused on pre-attack scenario. So we are looking at the risk signals, things like vulnerabilities, misconfigurations, policy violation, asset business context to give you a unified view of the risk, and what you need to do in order to reduce the risk.

[Rich Stroffolino] Well, that’s just about it for this episode of Security You Should Know. To learn more, head on over to qualys.com, and if you have a question that you were screaming at your podcast player, we didn’t get a chance to get to during this show, send it to us, feedback@CISOseries.com, we’d love to help get you some answers.

Thanks to Montez and Derek for helping us learn more about Qualys. Truly appreciate both of your time, and thanks to you, U.J, for your time and being game to answer all of these questions. Thank you for listening to Security You Should Know.

[Voiceover] That wraps up another episode of Security You Should Know. If you like this program, please subscribe, tell your friends, and leave us a review. All companies showcased on this program are sponsors of CISO Series. If your company would like to be spotlighted and interviewed by our security leaders, go to our contact page on ciso-dev.davidspark.dcgws.com or just email us at info@ciso-dev.davidspark.dcgws.com. Thank you for listening to Security You Should Know, connecting security solutions with security leaders.