Rapid7's Exposure Command platform aggregates assets from over 100 data sources to surface security gaps. Jon Schipp demonstrates how it flags 95 high-risk identities out of 43,000 by combining MFA status, admin access, and phishing susceptibility, letting security teams prioritize what to fix first.
Chapters
Today I want to show you the exciting new Attack Surface Management capabilities that are included in Rapid7's Exposure Command platform. When you log in, you immediately start to get information around your attack surface, such as the number of on-premise assets that you're responsible for protecting, as well as the number of cloud assets. And we do this across your internal and external environment. And by external, I'm really talking about external attack surface management. So if you go to the bottom here, you can start to see all the different systems that we've discovered on the internet that are public-facing. We have 179 domains, 189 IP addresses, 8 certificates, and 287 services. We are able to dive into any of these pieces of data to start getting attack service telemetry and visibility, including business context, security context, and asset context about each one of these. So the first thing that we're going to do is we're going to look into our external attack service to get a view. And so we can see here we are sorted by criticality, or severity, I should say. And in this case, we have a number of different hosts that we're discovering online, and we just need the security team to go and review. We have CVSS scores of 9 or 10, and that's what gives the criticality, and we have different numbers for high, etc. So there's a way to actually see all the discovered assets on your external attack surface. In this case, 663 total assets we've discovered. If we actually go back into our overview, we can then start to see what are the most important things the security team actually needs to take care of. So we actually have 23 assets that are lacking endpoint security. And this doesn't matter if it's Rapid7's Insight Agent or it's CrowdStrike or SentinelOne or Defender. We just want to let you know that you're missing endpoint security protection on these hosts. The same thing with the vulnerability scan coverage. In this case, we want to let you know all the assets that are not being assessed by a vulnerability scanner. It doesn't matter what's Rapid7's Insight VM or Tenable or Qualys, et cetera. We just want to make sure that you're seeing vulnerabilities in those scans or those assets are being protected. And the last one is identities are a first-class citizen in our new attack surface capabilities.. And so in this case, we're actually showing the number of identities that have multi-factor disabled and have admin access to some business-critical system. And this is really important. These are top things that we need to go remediate. And so we're going to jump into those next. So let's jump into the identities page. This is going to show you all the identities that we have in our attack surface. We're pulling this data in from Rapid7 as well as any other tools that you have in your environment. And so we're immediately going to do— we're going to start filtering. So let's find all users that have multi-factor set to false. So that's not enabled. So right. So they're not getting their push notifications on their phone as an example, and they're susceptible to password attacks. Then what we're going to do is we're going to filter on all of those users that don't have MFA enabled to have access to critical business applications that with admin privileges. And so what we're going to do is we're going to click true administrator equals true. And so now we went from 43,000 different identities to 95, and we can actually go a step further. We can click on each user that we want to find more information about and get some additional business context. So in this case, we have a user named Abdullah. He— we're pulling in data from Azure Active Directory for the identity. We're pulling information from Slack, from ServiceNow, KnowBe4, etc. It's a lot of telemetry that we're pulling in. And then what we will do with our attack surface capability, we'll normalize that all that data to give you the best view of it across all the different data sources that we pull in. And we support over 100 data sources today. The last thing I want to show you is that how we can actually take in business context. So in this case, we're using KnowBe4 to take in phishing information. And so in this case, this user Abdullah is 22% likely to click on a phishing email. And so now we can add this to our query to say, hey, let's find all users that have multifactor disabled, have admin access to some business application, and also are prone to phishing. And that gives you— your security team a new prioritized list to go and resolve to make the most out of their time, to have the most impact on the reduction of risk in your environment. So thank you.
