Spot Security Control Gaps and Non-Compliant Resources Across Your Attack Surface

I'm going to show how you can use Rapid7's Attack Surface Management capabilities as part of our Exposure Command platform to get deep asset visibility across your ecosystem of machines, servers, IoT devices, etc. So we're going to click on the Assets page, and we're ingesting all sorts of data across your tools. We support over 100 connectors. We're pulling in on-prem devices, cloud devices, again, across your ecosystem of tools.. And so we have one catalog that correlates and deduplicates everything to give you a best view of what the number of assets in your environment that you're responsible for protecting. In this case, we have 61,000 assets that we're pulling in. We're going to quickly key in on an asset of interest. We're going to go to search for the word enterprise and find one of our enterprise servers that's got a number of different services running on it. So we're going to pick on hubspotenterprise.nc.com. In here, we can actually see the number of data sources that we're pulling telemetry in that has information about this asset. ServiceNow is telling us stuff. InsightVM is telling us stuff. Intune, Microsoft Defender, Exabeam, so on and so forth. We're collecting a lot of data across your business security and IT tools and putting them in one place. All this information is then correlated in the General tab. It pulls the best information from each tool and gives you an overall view of your particular asset. We get the agent version, the server, the business owner of the asset, when it was first seen or last seen, If you click on any of the tooltips, it tells you where the information is coming from so that you know, and you can auto-customize this to your will and needs. We actually have a number of security mitigations on this asset. We're covered with next-gen AV, ransomware protection. We have a disk that's encrypted and it has a vulnerability scanner. Again, this is pulling from all these different tools like InsightVM for the vuln scan, Microsoft Defender for the next-gen AV, etc., etc., and pulling all this information in one place for, for users. In addition, we can see all the vulnerabilities around this asset. But next, what I want to do is I actually want to pivot into the asset group. So now we can start to build out relationships in a different view. We have all those columns that we saw previously, but maybe you want to map out the environment. And so in this case, we have this host and a bunch of information that's connected. We can see some vulnerabilities on the host. The primary user is Abdullah. There's a server operators group and we have the encrypted disk as well as some mitigations on this device. What I want to key in though is the network that this device is on, a 10.10/24. I'm going to click on this network. And that actually shows you a built-in topology map that can help you understand blast radius if this machine were to be compromised. I'm going to clear out some of the clutter. We don't need all this information. We actually have too much enabled. What I really just want to show is the machines that are correlated and connected to this device. And so in this case, what we got here is we have the HubSpot machine right here connected to this network right here. And on the same network segment, we have the app server, the messaging server, a load balancer, email server, etc. So now we know if this machine was compromised, which is on the internet, that they'd have lateral, potential lateral movement to these other devices on the same subnetwork. And so this gives you deep asset visibility across your business context, security context, and asset context and network data in one place. So thank you.