Connect with us
CCW 2024

News

Qualys Announces First-Party Software Risk Management Solution

Published

on

Qualys has announced it is opening up its risk management platform to AppSec teams to bring their own detections to assess, prioritise and remediate the risk associated with first-party software and its embedded open-source components. In the digital transformation era, every organization develops its own software to run its business. This first-party, or company-developed, software often lacks the disciplined vulnerability and configuration management practices used for third-party software. Studies have shown that over 90% of first-party software includes open-source components while more than 40% have high risks such as exploitable vulnerabilities.

Today, application and security operations teams rely on manual checks or siloed scripts to evaluate the security of first-party software, resulting in ad-hoc security assessment that impedes the ability to prioritize and remediate risk effectively. Furthermore, traditional vulnerability assessment or software composition analysis tools do not detect the presence of embedded open-source packages across the production environment. As a result, security teams face challenges in comprehending the true risk, particularly in security breaches like the Log4J incident.

The new Qualys solution enables organizations to bring their own detection and remediation scripts created using popular languages like PowerShell and Python to Qualys Vulnerability Management, Detection and Response (VMDR) as Qualys ID (QIDs), which the Qualys Cloud Agent executes in a secure and controlled manner. Qualys TruRisk then detects and prioritizes the findings in the same workflow and reporting as used for the third-party software findings. This empowers application and security teams to leverage their own detections to identify sensitive content, assess critical process and application statuses, tag assets based on sensitive or PII data presence, and mitigate risks associated with critical vulnerabilities like Log4J by configuring file parameters or addressing Follina by modifying GPOs/registry settings to efficiently manage the risk arising from both first and third-party sources.

The new Qualys platform capabilities allow teams to:

  1. Easily Build Your Own Signatures – Create Qualys Detections (QIDs) and remediations based on your own logic or scripts leveraging major scripting languages such as Python, PowerShell and others. These detections integrate directly into VMDR workflows and TruRisk scoring, helping SecOps teams unify and manage risk across first and third-party applications in their environment.
  2. Proactively Detect, Manage and Reduce Supply Chain Risks: Get continuous, real-time visibility into deeply embedded open-source software packages, such as Log4J, openSSL and commercial software components leveraging the Qualys Cloud Agent. Qualys TruRisk then prioritizes and correlates the information based on data from over 25 threat feeds and the asset’s business criticality. This information allows security teams to rapidly mitigate the risk of high-profile security issues such as zero-day threats and Log4J outbreaks by crafting custom detection and responses.
  3.  Effectively Communicate Risk with Unified Reporting and Dashboarding: With native integration to VMDR workflows, effectively communicate the unified view of risk in first and third-party software to the right stakeholders via real-time dashboards and reports. Integration with ticketing systems such as ServiceNow and JIRA enables the automatic assigning of detailed remediation tickets to the right owners through a common view to quickly close tickets and reduce risk.

“First-party applications, being proprietary, often lack adequate risk detection, prioritization and remediation support from scanning tools,” said Sumedh Thakar, president and CEO of Qualys. “Our first-in-industry capabilities enable organizations to leverage the Qualys platform’s capabilities, identifying and analyzing both first-party and third-party software risks to develop an overall TruRisk score for a comprehensive view of the organization’s overall risk.”

Enhancements to the Qualys Cloud Platform, including Custom Assessments and Remediation via VMDR integrations, will be available by the end of August.

Cyber Security

Regional Leaders Chart Course for Secure Telecom Networks at SAMENA Leaders Summit 2024

Published

on

Huawei, in collaboration with the SAMENA Telecommunications Council and stc, hosted a critical roundtable discussion on cybersecurity at the recent SAMENA Leaders’ Summit 2024. Titled “Building Telecom Cyber Resilience to Protect Business in the Digital Era,” the session brought together leading telecom operators, cybersecurity experts, and decision-makers from regulatory bodies.

This second edition of Huawei’s Global Carrier CISO Roundtable Series, led by Mazen Al Ahmadi, General Manager of Cyber Defense at stc, featured distinguished guests and high-level speakers. Their discussions focused on boosting telecom cyber resilience and safeguarding the digital space in an increasingly interconnected world.

Cybersecurity: A Cornerstone of Digital Success
The roundtable highlighted the critical role of cybersecurity and privacy protection in the success of businesses operating in the ever-evolving digital landscape. With the rise of immersive digital experiences and ubiquitous intelligent applications, network capabilities are undergoing rapid transformation, driven by deep network-cloud-intelligence convergence.

Mohammed Alosaimi, Chief Security Officer at Huawei Saudi Arabia

Securing the Future of Telecom Networks
Experts addressed the importance of cyber resilience for innovative telecom operators. Discussions focused on current challenges posed by advanced technologies like 5G and 5G-Advanced (5G-A) networks integrated with cloud and AI capabilities. Speakers examined strategies, models, tools, and skill sets needed to build resilience, alongside the necessary support from regulatory authorities. Remedial actions to address these challenges were also explored.

Mazen Al Ahmadi, General Manager of Cyber Defense at stc, said, “In today’s rapidly evolving digital landscape, cybersecurity and privacy protection have emerged as paramount concerns for businesses across all sectors, particularly in the telecom industry. The potential for cyber threats and data breaches has grown exponentially as the world becomes increasingly interconnected and reliant on digital infrastructure. Recognising the critical importance of addressing these challenges, the roundtable was a vital platform for industry leaders, experts, and stakeholders to engage in meaningful discussions, share invaluable insights, and collaborate on strategies to fortify the telecom industry against the ever-present menace of cyber threats.”

Mohammed Alosaimi, Chief Security Officer at Huawei Saudi Arabia, reaffirmed Huawei’s commitment to reinforcing cybersecurity infrastructure, stating, “As an industry leader actively engaged in cybersecurity R&D and building a cybersecurity ecosystem in the region, Huawei remains steadfast in our collaboration with carriers and partners to strengthen the construction of digital infrastructure around the world, build a thriving ecosystem, and unleash the potential of the digital world securely.”

A Multifaceted Threat Landscape
Discussions explored the evolving cyber threat landscape, including cyber threats, vulnerabilities, insider threats, and supply chain risks. Experts also analysed the contrasting security challenges of legacy signalling systems (2G and 3G) compared to modern IP-based networks (4G & 5G).

Success Stories and Collaboration
Real-world examples took centre stage as speakers shared cybersecurity use cases that directly contribute to the success of telecom businesses. Recognising the importance of collective action, the session concluded with an interactive discussion focused on fostering collaboration between industry stakeholders. Participants explored ways to address existing and future cybersecurity challenges, enhance resilience across the telecom ecosystem, and ensure adherence to international standards such as GSMA NESAS, MCKB, and OIC-CERT recommendations.

Building on a Global Dialogue
This second edition of Huawei’s Global Carrier CISO Roundtable builds upon the momentum established at MWC2024. At that event, 50 carriers and industry organisations engaged in discussions on best practices and industry standards for safeguarding the digital world.

The SAMENA Leaders’ Summit 2024, held under the patronage of UAE’s Telecommunications and Digital Government Regulatory Authority (TDRA) and with global collaboration from ITU, served as a platform for this crucial dialogue. The summit, held on May 13th in Dubai under the theme “Evolving toward Integration, Intelligence & Sustainability in Infrastructure,” highlighted the importance of collaborative efforts in building a secure and sustainable digital future.

Continue Reading

Magazine

Security Review – May-June 2024: CCW 2024 Special Edition

Published

on

Welcome to the latest issue of Security Review magazine. This is the CCW 2024 Special Edition.

Read the magazine on Magzter!

Download the magazine!

Continue Reading

Critical Communications

Mansoor bin Mohammed Inaugurates Critical Communications World 2024

Published

on

H.H. Sheikh Mansoor bin Mohammed bin Rashid Al Maktoum, Chairman of Dubai’s Supreme Committee of Crisis and Disaster Management, today opened Critical Communications World 2024, the critical communication sector’s leading global conference and exhibition running until May 16 in Dubai World Trade Centre.

The 2024 edition began with the traditional inauguration ceremony, led by H.H. Sheikh Mansoor bin Mohammed, who launched the proceedings. In the days that follow, CCW’s empowering platform will provide visitors with unique opportunities to engage with specialists from over 26 countries, including visionaries from the Middle East, Africa, Asia, Europe, and the US.

The Critical Communications Association (TCCA), the organiser of the annual industry showpiece, has cast an in-depth spotlight on precisely what visitors can expect over its three-day duration. Under the theme ‘Securing society and industry – Connection is the lifeline’, TCCA has promised an ‘unparalleled experience’ for all.

Kevin Graham, Chief Executive Officer, TCCA, said, ” As the leading event in the critical communications sector, CCW is internationally renowned, revered, and respected for its outstanding track record in bringing professionals, organisations, and industry experts together to converge, collaborate, and innovate in the mission-critical communications realm. Now the biggest, most important edition yet has arrived, we’re naturally thrilled that the latest innovations and strategies that define the industry’s future are now being unveiled to the world. Without question, new foundations for transformative changes that enhance global safety and security are about to be solidified.”

As exhibitors display cutting-edge technologies, services, and solutions whilst leading live demonstrations and holding interactive sessions on a vibrant exhibition floor, the conference programme will feature keynote presentations, panel discussions, and interactive debates surrounding the latest innovations and trends unfolding throughout the sector. Amidst an intimate setting perfect for converging and networking, attendees can also enjoy focus forums and roundtable discussions with registration free online.

Advanced TETRA systems, mission-critical broadband, 5G, and MCX and network services are amongst the most relevant topics being examined. Device integration and multi-layered constellation will also be explored, as will the integration of AI and IoT in public safety and healthcare environments and the implementation of geospatial data systems and digital twins.

Furthermore, CCW presents a diverse and inclusive agenda with over 150 distinguished guests and representatives from leading companies like Airbus, AT&T, Ericsson, Motorola Solutions, Hytera and Professional Communications Corporation – Nedaa sharing their insights, experiences, and perspectives. This same agenda will encompass various sectors with emerging technologies in telecommunications, public safety, and city services set to be explored alongside smart solutions integration in policing and healthcare.

When asked why all those with a passion for the critical communications industry should attend, Graham added, “Not only is this edition of Critical Communications World a landmark event; it is destined to be a catalyst for driving critical communications into a vibrant new space in the years ahead. Everyone with a vested interest in this fascinating industry should not let the opportunity to be a part of such a significant occasion that will be remembered for many years to come pass them by. It’s going to be incredibly influential and an unparalleled experience for attendees and participants alike.”

As the essential hub for professionals within the critical communications field, CCW 2024 serves as a platform for industry leaders, policymakers, and technology innovators from around the globe. Live from Dubai’s world-renowned Central Business District, the event will foster new collaborations, ignite new conversations, and inspire the next revolutionary era in mission-critical communications technologies and services.

Continue Reading
Advertisement CCW 2024

Follow Us

Trending

Copyright © 2021 Security Review Magazine. Rysha Media LLC. All Rights Reserved.