{"id":35754,"date":"2019-10-31T22:06:09","date_gmt":"2019-10-31T19:06:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-ya-stal-uyazvimym-skaniruem-it-infrastrukturu-s-pomoshhyu-qualys\/"},"modified":"2019-10-31T22:06:09","modified_gmt":"2019-10-31T19:06:09","slug":"kak-ya-stal-uyazvimym-skaniruem-it-infrastrukturu-s-pomoshhyu-qualys","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/kak-ya-stal-uyazvimym-skaniruem-it-infrastrukturu-s-pomoshhyu-qualys","title":{"rendered":"How I Became Vulnerable: Scanning IT Infrastructure with Qualys","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Hello everyone!<\/p>\n

Today, I want to talk about the cloud solution for vulnerability discovery and analysis, Qualys Vulnerability Management, which is the foundation of one of our services<\/a><\/noindex>.<\/p>\n

Below, I will show how the scanning process is organized and what information can be obtained about vulnerabilities as a result.<\/p>\n

\"How
\n<\/a><\/noindex><\/p>\n

What can be scanned<\/h3>\n

\nExternal services. <\/b>To scan services that have internet access, the client provides us with their IP addresses and credentials (if authentication is required for the scan). We scan the services using the Qualys cloud and send a report based on the results.<\/p>\n

\"How
\n
\nInternal services.<\/b> In this case, the scanner looks for vulnerabilities on internal servers and network infrastructure. This type of scanning can help inventory the versions of operating systems, applications, open ports, and services behind them. <\/p>\n

To scan within the client's infrastructure, a Qualys scanner is installed. The Qualys cloud serves as the command center for this scanner. <\/p>\n

In addition to the internal server with Qualys, agents (Cloud Agents) can be installed on the objects being scanned. They collect information about the system locally, creating minimal load on the network and the hosts they operate on. The information collected is sent to the cloud.<\/p>\n

\"How
\n
\nThere are three important points: authentication and selection of objects for scanning.<\/p>\n

    \n
  1. Using authentication<\/b>. Some clients request black-box scanning, especially for external services: they give us an IP address range without specifying the system and say \"act like a hacker.\" But hackers rarely act blindly. When it comes to attacking (not reconnaissance), they know what they are hacking.\u00a0\n

    Blindly, Qualys might stumble upon decoy banners and scan those instead of the target system. Also, without understanding what exactly will be scanned, it is easy to misconfigure the scanner settings and inadvertently affect the service being tested.\u00a0<\/p>\n

    Scanning will yield more benefits if conducted with authentication before the scanned systems (white-box). This way, the scanner will understand where it has arrived, and you will receive complete data on the vulnerabilities of the target system.<\/p>\n

    \"How
    \nQualys offers many authentication options.<\/i><\/li>\n

  2. Group assets<\/b>Running a scan for everything at once without proper sorting will be lengthy and create excessive load on the systems. It's better to group hosts and services by importance, location, OS version, infrastructure criticality, and other characteristics (in Qualys, they are called Asset Groups and Asset Tags) and select a specific group during scanning.<\/li>\n
  3. Choose a maintenance window for scanning.<\/b> Even if you have planned everything and prepared, scanning generates additional load on the system. It may not necessarily cause service degradation, but it\u2019s advisable to choose a specific time, similar to that of backups or updates.<\/li>\n<\/ol>\n

    <\/p>\n

    What can be learned from reports?<\/h3>\n

    \nAt the end of the scan, the client receives a report that will include not just a list of all detected vulnerabilities, but also basic recommendations for remediation: updates, patches, etc. Qualys offers many reports: there are default templates, and you can create your own. To avoid confusion, it's better to first determine the following:\u00a0<\/p>\n