Qualys Threat Research Serves Up a Buffet of Mitigations

Hey everyone. Welcome back here to Tekstrom TV. We're live in Austin at the Qualys Rock On conference this year, day two.

We've had so many great conversations, a lot of learning. I hope you've enjoyed it. My next guest is my friend Saeed Abasi.

We were talking, the last time I saw Saeed, we were in Vegas at the Fontainebleau Hotel, taking an Uber up to the Mandalay. Correct. From about 114 degrees out there.

It was. You feel like a piece of meat. It's a lot more comfortable here in Austin.

Oh, yes. Isn't it, Saeed? 100%.

Anyway, Saeed, I'm going to let you introduce yourself. Thank you. If you wouldn't mind, here's the camera on you.

Tell people your background, what you do here. Yeah, for sure. My name is Saeed Abasi.

I lead our threat research unit at Qualys. We have 140 plus and growing researchers. We like to call them white hat researchers because they are essentially white hat researchers.

And our job in Qualys research is essentially helping with our customers to focus on early threat intel, to tell them what is that they need to pay attention. Also, we investigate and we do research, zero day hunting for vulnerabilities that is the backbone of the internet. Everybody needs to be aware of it.

We do a lot of research. We work with the maintainers to, in a responsible way, disclose those vulnerabilities, and especially vulnerabilities that the attackers really care about. Because even if you take a look at CSAC of today, you will find bunch of vulnerabilities that it was discovered at threat research unit.

First, we work with the maintainers, and years later end up being in CSAC, which is essentially some sort of evidence that the threat actors are weaponizing those vulnerabilities. And more importantly, we focus a lot at threat research unit on building exploit-based validations. Uh-huh.

So because the moment that there is a new vulnerability, everybody want to know, am I affected? Is it impacting me within my organization with all my security tools in place? Am I still exposed to this, or have certain mitigation?

So we build exploit-based detections that they can fire exactly the same way from outside, similar to a threat actor to make sure if there are vulnerabilities that they are being exploited in the wild, they can test it on their environment and immediately bring that to the top of their list. And because of that particular work and essentially the expertise that the team has for building this type of exploit, they exactly know how these vulnerabilities can be mitigated. So with the insight that we have, we know patching everything on a priority is very difficult.

It's not even advisable, but when we build this detection, we also build different type of mitigation- Sure ... for them to deploy those mitigation. It could be mitigation that disable the service, uninstall, or a targeted mitigation that specifically block that particular attack path, so everything else is working.

" And things in that nature. Essentially, the investment heavily is with Qualys and Qualys research actually to be ahead, find these vulnerabilities, build exploit for them, have early detection for our customers, and help them with the response, so they don't need to worry about everything else. All they need to do is focus how they can go about fixing those on a priority.

Agreed. Saeed, I speak to a lot of cyber people, I've been in cyber a long time. Post Methos, right?

I think Sumedh set it up in his keynote yesterday. I forgot what day it was, but it was April. April 7th, I think.

Something like that, yeah. There was before April 7th and after April 7th. It almost seems like, do we really need to find more vulnerabilities?

Because God knows with the Glasswing and Methos, and it's not just that anymore, right? OpenAI scanner, there's some of the Chinese scanners. They all have amazing abilities to find vulnerability in our software.

The new focus is remediation, right? And the time from vulnerability to exploit to remediation is critical. Absolutely.

How's Qualys kind of operating in that world? Yeah, you're right. So these models are very good in discovering new vulnerabilities, which is good.

It's good for the community, for all the different vendors that they are using. So we will see these huge number of vulnerabilities keep coming for a while at least, maybe for another couple of quarters, potentially. But you're right, some of these vulnerabilities are being weaponized in the wild, and we need to be ahead of them.

So again, threat intelligence is key here. And we recently pulled some data, actually, for my session today, and we take a look at different category of technologies. Let's say network devices, like F5 or Cisco, Palo Alto Networks, Juniper, things like that, and endpoint enterprise software.

What you see is two category, one, that it is patched very quickly in a matter of days, and there are second category as a network devices and enterprise application that it take 45 days. Yeah. No, they hang out there.

Yes. Yeah. So organization need to have a way if they cannot apply the patches.

" And these are, as we like to say, a buffet of remediation. Right. You choose which one is fitting your environment, your current situation, and your team allows.

So we build all kind of mitigation in different layers. From the one that our agent can apply to stop certain mitigations and help with the mitigation, all the way to targeted mitigation, then the service is working, but it is very surgical in blocking the attack paths. In case of network devices, there is no agent to be installed in that, let's say, Palo Alto device or Cisco device.

So we have a scanner-based mitigation, which is today, we log into these devices through our network scanner, through SSH or API and some other paths, and we identify vulnerability. " So we are providing them the way to leverage the same way that a QID works for detection, for mitigation at a scale, because you cannot do that across 10,000 Cisco devices. Yeah.

Yeah. You know what's funny? I wrote an article, it's up in Security Boulevard today, I think.

Bank of America hired thousands, thousands of contractors to go try to patch just post Methos vulnerabilities that were found on their own Bank of America systems, and they did it for about two months. Wow. Cost them millions- Costly ...

millions of dollars. And you want to know why? Didn't really make much of a difference because the amount of patches, they were finding new vulnerabilities still, even with thousands of extra workers.

They were finding new vulnerabilities faster than they were patching- Yes ... the new ones. And so I am convinced that this is not a human problem.

You got to solve this with AI. 100%, yes. And that's the thing.

And like you said, you need that vulnerability or that remediation buffet. Yes. Even if it's temporary, say, until I could get to patching this, it might take me 45 days.

Until I get, I unplug it from the internet, I change a port setting, I block something here, I do some micro-segmentation, some containment, control the blast radius, all of these things. I think that's the new mission, right? Correct.

Instead of finding vulnerabilities, that's the mission. Correct. And we are seeing our customers are doing that, and it is very exciting to see it, actually.

When we look at past five years of CISO care vulnerabilities, over a billion records of different vulnerability instances, we found that on average, 12% to 16% of our customers fix vulnerabilities before they are even landed in system. Really? Yes.

And we are seeing it on a daily basis. Let me give you one example. In August, or I might be wrong, maybe April, BlueHammer vulnerability, a vulnerability in Microsoft Defender, I think it was April.

BlueHammer vulnerability get disclosed, and in matter of two days, half of our customer patched that vulnerability because they already set all those policy and the machine doing it. Yeah. For our talk, I actually pulled the data and figured out that after six months, there is still 9% of those vulnerabilities are still open.

Okay. Because- I'm not surprised, to be honest with you ... someone somewhere want to manually approve or deploy those patches.

And two days, in two days, half of our customers, it was millions of vulnerability for that particular component. And you're right, it require some sort of autonomous remediation in all level because, for example, at ETM, you can configure a lot of details based on your environment to on what situation you go with auto patch or auto remediation, mitigation, all of that. And we are seeing things at a scale across 10,000 customers, so we can adjust our, you probably know about patch liability score.

Yes. So thousands or millions of patches being deployed, and we are using those insight to guide our customer, for these, we deployed millions of time. Nobody had a problem.

You can leave it to autonomous- Yes, they do ... remediation group. It's a question of trust, which is- Correct ...

true trust, true confidence. Yes. That's the word here, right?

True confidence. Correct. Saeed, we're over time, I'm sure.

We were talking, but we could probably talk all day. But hey, thank you- It was really nice to be with you ... for all the work you and your team do.

Of course. It's important work. Thank you.

Thank you. Always a pleasure. I'll see you maybe RSA.

Yes. Well, maybe there, or we'll see you in other conferences. For sure.

Until then, thank you. Thank you. Nice to see you.

Saeed Abasi here- Thank you ... on Rock Con. We're live.

We're going to take a break. We got more coming up. Thank you.