Eran Livne, the Senior Director of Product Management for Endpoint Remediation at Qualys, and Thomas Scheffler, the Security Operations Manager at Cintas Corporation, recently sat down for an interview with Help Net Security to discuss their experiences with automated patch management.
Scheffler shared how Cintas made the transition from manual patching processes to Qualys’ automated solution, which significantly improved their efficiency in managing patches. Livne emphasized the importance of effective patch management in reducing business risk and enhancing cybersecurity measures.
Livne highlighted the critical role of a robust patch management strategy in mitigating business risk by closing off potential pathways for malicious actors to exploit. In 2023, the number of recorded vulnerabilities increased by 13%, reaching a staggering 28,834. Prioritizing the most critical vulnerabilities is essential for organizations to enhance their security posture, streamline security efforts, lower insurance premiums, and effectively communicate cyber risk to the leadership team.
Scheffler discussed the scaling challenges faced by Cintas in securing a distributed network of 13 distribution centers and over 47,000 employees. Before adopting Qualys’ solution, they struggled with manual processes and a lack of prioritization based on enterprise risk. With Qualys, they gained better visibility into vulnerabilities and improved remediation processes.
Qualys ensures the effectiveness of its patch management solution against emerging threats by leveraging a team of experts, proactive vulnerability identification, and automation techniques. The solution integrates vulnerability and threat intelligence data from multiple sources, supports various operating systems, and enables remote patch deployment, catering to the evolving landscape of remote and hybrid work environments.
The key features of Qualys’ Patch Management solution set it apart from other products in the market. By combining vulnerability and threat intelligence data, implementing risk-based patching, and supporting multiple operating systems, Qualys provides a comprehensive and efficient solution for organizations. Customers using Qualys typically experience improved remediation times, increased patch rates, and faster ticket closures.
Scheffler highlighted the impact of Qualys’ patch management solution on Cintas, noting a significant reduction in cyber risk and enhanced security compliance efforts. The solution enabled Cintas to streamline security operations, increase visibility of internet-facing assets, and achieve faster remediation times for critical vulnerabilities.
When deploying patches across diverse IT environments and systems, Qualys intelligently targets assets and automates patching for applications with low operational risk. A central dashboard provides visibility across Windows, Linux, and Mac operating systems, as well as third-party applications, allowing security teams to focus on complex remediation tasks.
The metrics used to measure the success of Cintas’ patch management strategy include 100% coverage of the external attack surface, a 300% increase in visibility of internet-facing assets, and a reduced mean time to remediate critical vulnerabilities from two months to eight days.
Qualys’ TruRisk and CyberSecurity Asset Management solutions complement the patch management process by providing real-time assessments of external attack surface risks, passive sensing for IoT devices, and connectors to enhance Qualys sensors. This unified approach streamlines asset discovery, identifies critical vulnerabilities promptly, and facilitates effective patching efforts.
In conclusion, the collaboration between Qualys and Cintas in implementing automated patch management has yielded significant improvements in efficiency, security posture, and risk management. As cyber threats continue to evolve, organizations must invest in robust patch management strategies to safeguard their digital assets effectively.