New Data Security Model

The Qualys platform is currently evolving to be able to provide many key features and services like Scheduled Reporting, Zero-Day Risk Analyzer and Asset Tagging, etc. As part of developing the new platform we are now heavily normalizing and indexing large amounts of data so it's easily searchable and reportable. The new data structures also lend themselves to provide much better trending and dashboard information as well. To achieve this we have a new set of backend services that will be constantly processing customer scan data even when a customer is not logged in.

We have implemented a new data security model that helps us keep customer data extremely secure with the right controls in place to assure privacy of the data. We are moving away from the current proprietary encryption scheme developed by us 10 years ago in favor of modern, state of the art technologies from reputed vendors. The new model includes high performance disk encryption modules that assure data is always encrypted at rest. Virtual Private Database (VPD) technology from Oracle ensures that the database itself provides the assurance that one customer can never see other customer's data. Oracle DB audit vault provides the ability for Qualys to have tight control on database access by Qualys DBA. It provides audit logging and monitoring capabilities as well. All of the above technologies in addition to the standard security practices like secure software development lifecycle, IPS/IDS, firewalls, external penetration tests, and SSAE 16 audits ensure that customer data is handled securely with utmost care.

Want to opt-in?

A Manager user can opt in by going to Users > Setup > Security. (For Express Lite, the New Data Security Model is enabled automatically.)