Qualys, Inc.

The present disclosure describes defending against an attack execution operation. According to one aspect of the subject matter described in this disclosure, a method for generating a domain-specific language (DSL) file is disclosed. The method may comprise determining, a framework based on an attack repository, determining a first primitive based on the framework, and determining a second primitive based on the framework. In one implementation, the first primitive and the second primitive are fundamental structures or constructs within a DSL. The method further comprises combining the first primitive and the second primitive into a DSL file. In one implementation, the DSL file is executed to defend against a first attack execution operation executed by a threat-actor.

Disclosed are methods and systems for assessing system risks associated with one or more assets coupled to a network and mitigating against said system risks. According to one implementation, a method for assessing a system risk comprises receiving network data associated with a first asset communicatively coupled to a network, quantifying the network data, and generating a risk parameter using the quantified network data and vulnerability data associated with the network. The method further comprises determining, based on the risk parameter that a security risk of a first asset of the network is higher than the security risk of a second asset of the network. Upon this determining, the method initiates remediation operations that first secure the first asset on the network against a security breach to the network.

Disclosed are systems and methods for discovering one or more computing assets associated with primary identification data. The systems and methods comprise a series of processes and steps to discover an organization's external attack surface. The processes and steps include building a unique external attack surface management catalog to be used as a configuration value as a first step of discovering unknown internet-facing assets of an organization. Then the processes and steps include using the unique external attack surface management catalog in combination with open-source reconnaissance and proprietary scanners to determine the external attack surface of the organization. The disclosed systems and methods then uniquely present the acquired relevant data to users using a single display screen. The disclosed systems and methods not only discover the external attack surface and internet-facing assets of an organization and its aliases, but also internet-facing assets of related subsidiary, affiliate, and partner entities.

Methods and systems for generating an attack path based on user and system risk profiles are presented. A method comprises determining user information associated with a computing device; determining system exploitability information of the computing device; determining system criticality information of the computing device; determining a risk profile for the computing device based on the user information, the system exploitability information, and the system criticality information; and generating an attack path based on the risk profile. The attack path indicates a route through which an attacker accesses the computing device. The system exploitability information is associated with or based on one or more of the vulnerability associated with the computing device, an exposure window associated with the computing device, and a protection window associated with the computing device. The system criticality information is associated with or based on one or more assets and services associated with the computing device.

Methods and systems for generating an attack path based on user and system risk profiles are presented. A method comprises determining user information associated with a computing device; determining system exploitability information of the computing device; determining system criticality information of the computing device; determining a risk profile for the computing device based on the user information, the system exploitability information, and the system criticality information; and generating an attack path based on the risk profile. The attack path indicates a route through which an attacker accesses the computing device. The system exploitability information is associated with or based on one or more of the vulnerability associated with the computing device, an exposure window associated with the computing device, and a protection window associated with the computing device. The system criticality information is associated with or based on one or more assets and services associated with the computing device.

Disclosed are systems and methods for discovering one or more computing assets associated with primary identification data. The systems and methods comprise a series of processes and steps to discover an organization's external attack surface. The processes and steps include building a unique external attack surface management catalog to be used as a configuration value as a first step of discovering unknown internet-facing assets of an organization. Then the processes and steps include using the unique external attack surface management catalog in combination with open-source reconnaissance and proprietary scanners to determine the external attack surface of the organization. The disclosed systems and methods then uniquely present the acquired relevant data to users using a single display screen. The disclosed systems and methods not only discover the external attack surface and internet-facing assets of an organization and its aliases, but also internet-facing assets of related subsidiary, affiliate, and partner entities.

Disclosed embodiments include receiving network data associated with a first system of a network. The network data may comprise first data, second data, third data, fourth data, fifth data, and sixth data. The method may quantify, the first data, the second data, the third data, the fourth data, the fifth data, and the sixth data. The method may further determine, a risk parameter based on the quantifying. The method may generate, a vulnerability risk profile for a vulnerability based on the risk parameter. The vulnerability profile may indicate a security weakness of the first system or the second system. The method may determine, based on the security weakness of the first system or the second system, a remediation protocol for minimizing the security weakness of the first system of the network or the second system of the network.

The present disclosure relates to methods, systems, and computer program products for generating an attack kill chain for threat analysis. The method comprises receiving a first security event captured by a first security operation associated with a computing device, and receiving a second security event captured by a second security operation associated with the computing device. The first security event and the second security event are associated with an attack campaign. The method further comprises mapping the first security event to first security data in an attack repository, and mapping the second security event to second security data in the attack repository. The method also comprises determining based on the mapping, one or more attack execution operations for executing the attack campaign associated with the first security event and the second security event. Additionally, the method sequences the one or more attack execution operations to form an attack kill chain.

The present disclosure describes defending against an attack execution operation. According to one aspect of the subject matter described in this disclosure, a method for generating a domain-specific language (DSL) file is disclosed. The method may comprise determining, a framework based on an attack repository, determining a first primitive based on the framework, and determining a second primitive based on the framework. In one implementation, the first primitive and the second primitive are fundamental structures or constructs within a DSL. The method further comprises combining the first primitive and the second primitive into a DSL file. In one implementation, the DSL file is executed to defend against a first attack execution operation executed by a threat-actor.

Disclosed are systems and methods for discovering one or more computing assets associated with primary identification data. The systems and methods comprise a series of processes and steps to discover an organization's external attack surface. The processes and steps include building a unique external attack surface management catalog to be used as a configuration value as a first step of discovering unknown internet-facing assets of an organization. Then the processes and steps include using the unique external attack surface management catalog in combination with open-source reconnaissance and proprietary scanners to determine the external attack surface of the organization. The disclosed systems and methods then uniquely present the acquired relevant data to users using a single display screen. The disclosed systems and methods not only discover the external attack surface and internet-facing assets of an organization and its aliases, but also internet-facing assets of related subsidiary, affiliate, and partner entities.