ERP needs to de-risk. Spoiler alert, ERP systems are special but not quite that special and ‘all’ aspects of the global enterprise technology stack need solid vulnerability management and de-risking mechanisms in order for them to be able to operate effectively, productively and securely.
But ERP does has a special role to play in modern systems vulnerability management as its core business process transactions and wider universe of opererational data is fundamental to risk management platforms that are able to dovetail core risk data (cybersecurity risks and the entire spectrum of application exposure and weakness points) with working business data.
But there’s a challenge, risk systems work on risk data and business systems work on business data.
Qualys Risk Operations Center (ROC)
Aiming to bridge these two world together with a new toolset designed to provide resilience at a new level of robustness for orgaziations across all business verticals is disruptive cloud-based IT, security and compliance solutions company Qualys. The company has announced the launch of its Risk Operations Center (ROC) with Enterprise TruRisk Management (ETM) at the Qualys Security Conference in San Diego this month.
The solution enables CISOs and business leaders to manage cybersecurity risks in real-time, transforming fragmented, siloed data into actionable insights that align cyber risk operations with business priorities. The application consolidates both Qualys and non-Qualys security risk data, including from technology alliances like Forescout, Okta and Oracle across cloud, on-premises and hybrid environments.
Organizations are facing an ever-growing volume of risk findings spread across multiple, disconnected top-10 dashboards. This fragmented view results in conflicting analyses, duplicate work, missed threats and strategies that fail to fully protect the organization. As a result, companies struggle to get a clear understanding of their true, overall risk, hindering their ability to make informed remediation decisions.
To overcome these challenges, businesses need an integrated approach that combines heterogeneous risk factors from various asset management tools and disparate cybersecurity solutions into a single platform with remediation and mitigation capabilities to reduce risk quickly. That is why Qualys is launching the world’s first ROC with Enterprise TruRisk Management designed to unify asset inventory and risk factors, apply threat intelligence, business context, risk prioritization and orchestrate remediation, compliance and reporting through a single interface.
Context, threat intelligence & finance
“With IT environments growing more complex and potential risk exposures more numerous, organizations need a holistic and proactive cybersecurity management platform that brings all cyber-risk exposures to one place, unifies scoring and simplifies prioritization and reporting,” said Michelle Abraham, research director at IDC. “Qualys’ approach with the Risk Operations Center delivers this ideal in a cohesive way. With the ability to analyze all risk factors at a glance – such as exploitability, unique organizational context, threat intelligence and financial impact – Qualys Enterprise TruRisk Management empowers CISOs and business leaders to create actionable, enterprise-wide strategies to reduce risk to levels that align with the business’s objectives.”
Qualys Enterprise TruRisk Management enables enterprises to operationalize their ROC witg these key features:
Ingesting Qualys and Non-Qualys Data for an Accurate Measure of Business Risk: Enterprises are able to measure their TruRisk score, by aggregating and unifying dispersed risk factors – such as vulnerabilities, security postures, asset exposures and identities – generated by their security toolset across the full stack of cloud, on-premises, or third-party applications. This data is correlated with over 25 threat intel sources and business context to precisely highlight key risk exposure indicators, enabling proactive risk management for business entities, processes or applications.
Aligning Risk to Business Value to Communicate Financial Impact of Cyber Risk:
CISOs are expected to communicate the return on investment (ROI) and outcomes of existing and future cybersecurity investments in terms of reduction of business risk. By aligning business value and potential losses from cyber risks, ETM enables cyber risk quantification (CRQ) for CISOs and risk teams to communicate the business impact of TruRisk for critical applications, entities and processes, shifting the focus from technical issues to understanding the financial impact of security threats. ETM also allows teams to recognize the contribution of risk factors produced by individual cybersecurity tools, toward overall enterprise-wide TruRisk scores impacting the business, to justify cybersecurity tool investment and better prioritization.
Automated Remediation Workflows to Reduce Cyber Risk:
Security and Risk Operations teams can leverage personalized risk reduction plans with Qualys TruRisk Eliminate to intelligently patch or mitigate the prioritized exposure indicators, such as vulnerabilities, misconfigurations, asset and software risks, by balancing risk reduction with business continuity. ETM also supports rule-based integrations with ITSM tools, such as ServiceNow and JIRA, to automatically assign prioritized tickets of unified exposures to the right remediation teams and orchestrate active remediation through integrated zero-trust, firewalled solutions to rapidly reduce risk, which helps reduce time to communicate and mean time to remediation.
“On its 25th anniversary, Qualys continues its never-ending innovation journey by again disrupting the cybersecurity market with the introduction of the Risk Operations Center (ROC),” said Sumedh Thakar, president and CEO of Qualys. “The ROC delivered by Qualys ETM transforms proactive cybersecurity, empowering organizations to operationalize their risk management process in a single platform and revolutionizing the way customers measure, communicate and eliminate risk, irrespective of which cyber tools they employ.”
Availability
Qualys Enterprise TruRisk Management is immediately available and users can sign up for a free trial and read the blog, “The Future of Cybersecurity Risk Management with Risk Operations Center (ROC)”.