Last updated at Mon, 24 Jul 2017 14:41:02 GMT
If you're currently using our vulnerability management software Nexpose, then you're probably already scanning your environment to identify, prioritize and remediate vulnerabilities and misconfigurations. But do you have visibility into the controls in place that mitigate these risks from being exploited? We recently launched a new product, ControlsInsight, that allows you to leverage your Nexpose deployment to automatically assess the effectiveness of your controls and get a complete picture of security risks on your assets.
Why do I need both Nexpose and ControlsInsight?
Using Nexpose to identify vulnerabilities and misconfigurations is an integral part of an effective security program because it reduces the number of weaknesses that attackers could exploit. However, there are many other important controls that can effectively stop an attack at other parts of the kill chain, e.g. configuring your email client to block suspicious email attachments to prevent malware from being delivered via email. ControlsInsight adds value to Nexpose by providing new visibility into effective countermeasures such as anti-malware software, unique admin passwords, browser hardening, and code execution prevention tools.
Are you currently scanning your desktops?
Many organizations use Nexpose to manage risks on servers and critical infrastructure but are not scanning their desktops, perhaps because they don't have the time/budget/resources to build a process for this, or desktop security is simply not a high priority right now. However, today's attackers are more likely to enter your network by compromising your endpoints via phishing, web drive-by or stolen credentials than a traditional network intrusion. According to the Verizon 2013 Data Breach Report, 71% of attacks and breaches in 2012 involved compromised end user devices.
Build a process for managing desktop risks
Endpoints are one of the most likely assets in your organization to be compromised, but are also one of the least secure. This is why the first version of ControlsInsight focuses on endpoint controls and helps you to build a plan for identifying, prioritizing and remediating security risks on your desktops. Similar to Nexpose's remediation reports, ControlsInsight prioritizes actions based on ability to reduce the most risk with least effort and gives step-by-step guidance for IT operations teams to deploy and configure controls broadly across the environment.
Analyze and track progress on reducing risk
Do you spend a lot of time correlating information from different security products to explain your security posture to stakeholders? ControlsInsight can help you aggregate and analyze information from Nexpose, your anti-virus software, patch management software and Windows configuration settings. The information is consolidated and presented in simple metrics that can be used to set and monitor KPIs for deploying and maintaining controls, as well as demonstrate effort spent on reducing security risk over time.
Did you know ControlsInsight can be accessed directly from your Nexpose instance?
If you're an existing Nexpose customer, your Rapid7 account manager can enable a free ControlsInsight trial on your Nexpose license. After that you simply need to restart Nexpose or perform a manual update and run a scan on your Windows PCs with domain credentials. Your security assessment will be automatically displayed in the ControlsInsight console, which you can access by appending "/insight/controls" to the end of the Nexpose console URL after "3780", e.g. "https://localhost:3780/insight/controls". Check out our quickstart guide to find out more about how to get the most out of ControlsInsight.
If you're considering Nexpose, it's super easy and requires no additional effort to trial both products at the same time.
Get your free 7-day trial of ControlsInsight here or contact us for more information.
