Vulnerability Management Project using Qualys

1. Introduction

Vulnerability Management (VM) is the process of systematically identifying, assessing, prioritizing, and remediating security weaknesses across an organization’s IT infrastructure. Instead of waiting for attackers to exploit vulnerabilities, VM enables proactive defense by ensuring systems are regularly scanned and updated.

Qualys is a leading cloud-based security and compliance platform that provides tools for vulnerability scanning, continuous monitoring, and remediation tracking. In this project, I deployed the Qualys Virtual Scanner Appliance (CVA) in a virtualized environment and used it to scan a target Windows machine. This lab simulates how enterprises manage vulnerabilities in their environments using Qualys.

2. Vulnerability Management Framework

A strong vulnerability management program follows a structured lifecycle. The framework used here is a 5-step process:

Asset Discovery – Identify and inventory all assets (servers, endpoints, applications, network devices).
Vulnerability Assessment – Scan assets to detect vulnerabilities, misconfigurations, and missing patches.
Prioritization & Risk Analysis – Classify vulnerabilities by severity using CVSS scores and business impact.
Remediation – Fix vulnerabilities through patching, configuration updates, or compensating controls.
Verification & Continuous Monitoring – Re-scan to validate fixes and continuously monitor for new risks.

NB: This ensures VM is not a one-time activity but a continuous security practice.

3. Lab Environment Setup

For this project, I built a virtual lab environment:

Host Machine: Windows 10
Virtualization Platform: VirtualBox
Qualys Scanner Appliance:
- Format: .cva file provided by Qualys
- Deployed as a Virtual Machine
- IP Address: 192.168.105.217
Target Machine (Windows VM):
- OS: Windows 10
- IP Address: 192.168.105.211
Network Setup:
- All VMs configured in the same subnet 192.168.105.0/24
- Default Gateway: 192.168.105.145
- Scanner and Windows VM must be able to ping each other.

NB: Our IP address is determined by our home router.

4. Scanner Appliance Deployment

Steps followed to deploy the scanner:

Imported the Qualys CVA file into VirtualBox.
Configured VM network adapter to Host-only / Bridged so it shares the same subnet as the target.
Booted the scanner appliance and logged into the console.
Set up IP address, subnet mask, gateway, and DNS on qualys scanner virtual machine and target virtual machine.

IP: 192.168.56.217

Mask: 255.255.255.0

Gateway: 192.168.56.1

DNS: 8.8.8.8

Entered the activation code from the Qualys portal.
Confirmed scanner shows up under Scans → Appliances with status Ready.

5. Creating and Running a Scan

Logged into the Qualys Cloud Platform.
Navigated to Scans → New → Vulnerability Scan.
Defined scan target as: 192.168.105.211
Selected the deployed scanner appliance (192.168.105.217).
Chose Initial Options Profile (basic vulnerability scan).
Launched the scan.

6. Implementation

STEP 1: INSTALLING QUALYS VIRTUAL MACHINE

figure 2: Download your qualys Virtual Machine

NB: This will require you to log into your qualys community edition account. Create a new appliance by clicking where the red arrow is showing. Insert the needed credentials and download the CVA file of your appliance while taking note of the activation code given to you.

figure 3: Go to Virtualizer (VirtualBox in my case) and click on file

figure 4: Import appliance

figure 5 : Choose the downloade file's directory

figure 6 : Check settings and click on finish

figure 7 : Client Machine Configuration

figure 8 : Open and configure the LAN IP of the Qualys VM

STEP 2: PRECONFIGURATIONS FOR SCANNING

figure 9 : Configure windows adapter network

NB: Make sure the IP address is in thesame network as your home router

figure 10 : choose properties to modify it ipv4

NB: Make sure the IP address is in thesame network as your home router

figure 11 : configure it static IP address

NB: Make sure the IP address is in thesame network as your home router

figure 12 : Make sure the target machine pings the scanner(qualys appliance)

figure 13 : Go to qualys community dashboard and choose "Assets"

figure 14 : Choose address management

figure 15 : Choose address management

figure 16 : Go to new and choose IP tracked addresses

figure 17 : Choose subscription IPs

figure 18 : Insert IP range you wish to scan

figure 19 : Once the ip range is decided, go back and choose scans

figure 20 : Choose Option Profiles

figure 21 : Create an Option Profile

figure 22 : Name your Option Profile

NB: Leave other configuration to default before saving.

figure 23 : Go to Scans

figure 24 : Go to New and select Scan

figure 25 : Configure the following as indicated and Launch your scan

NB: The last arrow shows where you'll insert your target IP address

6. Results and Findings

After the scan completed:

The Windows VM was successfully scanned.
Discovered vulnerabilities included:
- Missing Windows security patches
- SMB signing not enforced
- Outdated software versions
Vulnerabilities were categorized as Critical, High, Medium, Low using CVSS scores.

(Insert screenshots of Qualys scan results dashboard.)

figure 26 : Results and Findings

7. Remediation & Verification

Applied Windows Updates and security patches.
Configured Windows firewall and system hardening settings.
Re-ran the scan in Qualys.
Verified that previously reported vulnerabilities were either fixed or downgraded in severity.

8. Troubleshooting Challenges

During setup, I faced several issues:

No active scanner appliance found → caused by incorrect gateway configuration. Fixed by setting scanner gateway to 192.168.56.1.
DNS resolution errors → resolved by setting DNS to Google’s public server 8.8.8.8.

9. Conclusion

This project demonstrated how to deploy and use the Qualys Virtual Scanner Appliance for vulnerability management in a controlled lab environment. The exercise showed:

How Qualys fits into a VM lifecycle (discovery, assessment, remediation, verification).
The importance of correct network setup for scanner-to-target communication.
How remediation and verification ensure continuous improvement of security posture.

In a real-world enterprise, this process would be extended to hundreds or thousands of assets, integrated with patch management systems, and monitored continuously.