Jon Schipp shows how to use Rapid7's Attack Surface Management to find security gaps in your infrastructure. He filters for Windows machines without SentinelOne protection or any vulnerability scanner, then maps those high-risk assets to MITRE ATT&CK techniques to prioritize fixes.
Chapters
I'm going to quickly show you how you can use Rapid7's Attack Surface Management capability as part of the Exposure Command platform to easily find your security coverage gaps across your fleet of infrastructure and systems. So I'm going to pivot over to the Assets page, which has an inventory of all the assets in your environment— your servers, workstations, IoT devices, etc. across on-premise and cloud. And so we're going to pivot in here and get a list of our machines. The first thing we're going to do is we're going to try to find security control gaps of machines that are not covered by a specific endpoint protection system. So we're actually going to pivot on to SentinelOne here and we'll use the SentinelOne agent. And then we're going to find all systems that are not covered by the SentinelOne agent. I can go a little bit further though. I can then find all the ones that are running Windows because maybe that's the more, more prone, vulnerable operating system in my environment. So we're going to find all the ones that are— do not have SentinelOne and are running Windows. Now I get a more refined list and we can keep going down further. The last thing I want to do is I want to filter on machines that do not have SentinelOne, are running Windows, and do not have a vulnerability scanner attached to it. And so we map to MITRE's ATT&CK mitigation framework to find all those correlated machines that don't have a vulnerability scanner. It doesn't matter if it is Rapid7's vulnerability scanner or if it's Tenable, Qualys, or another vendor. We'll pull all that data in and make sense of it. And so now we have a more prioritized list of machines that do not meet our basic requirements for coverage. And the security team, going back to basics, knows that these are the most important things they need to resolve to get visibility and monitoring across the environment. Thank you.
