University in East Asia Guards Against Reputational Risk of Security Breaches

“As well as limiting our insight into our vulnerability exposure, it took us a significant amount of time to extract useful data from the scanning tools,” adds the Head of Information Security. “We depend on our IT system owners to apply patches and update security configurations, but most of them are not security specialists. As a result, we were keen to find a way to deliver actionable vulnerability insights to them faster.”

Moving to a proven platform

To enhance its approach to cyber security, the university selected Qualys VMDR® with integrated apps for asset identification and management, vulnerability management, threat detection and prioritization and response. VMDR empowers the university to scan its on-premises systems and web applications from a single point of control, eliminating the need for multiple separate scanning tools.

“When we were searching for a new solution, one of our key criteria was the ability to gain a more complete picture of all the vulnerabilities across our estate,” says the Head of Information Security. “Crucially, we also wanted detailed reports that were easy to understand, because we rely on systems owners without specialist security knowledge to carry out the remediation work. One of the things we really appreciate about Qualys VMDR is that it combines comprehensive visibility of vulnerabilities with actionable reports, helping our stakeholders see exactly what they need to do to remediate their assets.”

Looking to the future, the university plans to transform its IT environment by increasing its footprint in the cloud. As a result, the organization was impressed with the ability to use Qualys APIs to gain real-time visibility into the vulnerability status of cloud-based systems.

Building a 360-degree view of vulnerabilities

By replacing its legacy tools with a cloud-based solution, the university gains advanced vulnerability management capabilities without the cost and complexity of managing its own on-premises infrastructure. And thanks to the combination of network-based scanning and Qualys Cloud Agents, the organization ensures that it can capture detailed data from all parts of its IT environment.

“Qualys Cloud Agents are extremely lightweight, which means we never have to worry about system performance issues, even when we’re deploying them to a critical server in our environment,” adds the Head of Information Security.

Today, the university uses Qualys VMDR to scan its IT environment every six months, prioritize the most critical vulnerabilities, and generate detailed reports to help its teams rapidly close down threats.

“The progressive scanning function of Qualys Web Application Scanning allows us to thoroughly test our web applications, no matter how many URLs or pages they include,” explains the Head of Information Security. “Without a doubt, the Qualys solution is contributing to higher visibility and easier management of vulnerabilities.”

Saving costs, boosting security

Since transitioning to VMDR, the university is realizing its goal of maintaining an open and inclusive digital space while at the same time protecting its students and teaching staff against cyber threats.

“Although information security initiatives like ours don’t set out to achieve cost-savings, we’re confident that the Enterprise TruRisk Platform offers a significantly lower total cost of ownership, especially when taking into account the software and hardware infrastructure previously needed to run our previous on-premises tools,” comments the Head of Information Security.

“Most importantly, we are now offering our system owners clear, actionable insight into which patches they need to deploy much faster than we could in the past. In fact, we estimate that Qualys VMDR has helped us to reduce the average time between detection and remediation by up to 60%, which is contributing to better protection for our stakeholders across the university.”

Ready for what’s next

Today, Qualys VMDR is tightly integrated into the university’s information security process. The organization’s server team has been given access to the scanning capabilities and uses VMDR to verify that new system implementations and patching initiatives are appropriately hardened against vulnerabilities.

Building on its success with the Qualys solution, the university is now exploring additional ways to harness the capabilities of VMDR to further strengthen its security posture. For example, the organization aims to use Qualys APIs to integrate VMDR with ServiceNow Configuration Management Database, dramatically reducing the manual effort required to keep its inventory of IT assets up to date.

“Our students and teachers rely more than ever on digital systems as it’s vital to ensure that they’re always available and protected,” concludes the Head of Information Security. “Qualys VMDR empowers our lean team to protect over 2,500 IT assets and 1,000 web applications 24/7—and we look forward to working with Qualys to continue to enhance our protection in the future.”