Name: Demo: See, Secure, Protect and Manage Your Entire Attack Surface
Uploaded: 2025-07-24T13:53:07.844Z
Duration: 35 min 8 s
Description: Demo: See, Secure, Protect and Manage Your Entire Attack Surface

Transcript for "Demo: See, Secure, Protect and Manage Your Entire Attack Surface": Hello, and welcome, everyone. I'm Raji Woodhouse, one of the campaign managers at Armis, and and I'll be your host for today's session. This is the next installment in our demo series entitled see, secure, protect, and manage your entire attack surface. Before we get started, I just have a few very quick heist keeping items. Today's session will run about thirty minutes, and we'll aim to allow a few minutes for questions at the end. So please add any that you have privately to the q and a section as we go through, and we'll pick these up at the end. And for any that we don't have a chance to respond to today, we'll follow-up one to one with you. Also, please feel free to peruse the additional documentation and resources that we've made available, via the docs tab in your console. With that, it's my pleasure to introduce today's speaker, David Bloomer, principal solutions architect for Armis in EMEA. Over to you, David. Thank you very much. So today, I'm going to talk to you a little bit about, what Armis is trying the problem that Armis is trying to solve and how we'd go about doing that. So it's not an it's not unknown. Everyone knows that there are so many devices connecting to the network these days, billions and billions of devices, and there's a whole range of devices. It's very easy to get focused on the the laptops, the servers, the network equipment, and all of that kind of thing. But there's the the building management systems. There's the TVs. There's the IP telephones. Or if you operate in, in manufacturing or medical, you've got those those devices associated with that. And this is all expected to grow and increase over time. All of these devices are connecting to each other or trying to connect to each other. They present vulnerabilities and risks within the in the in your network. And most of these devices cannot be managed. They you can't install agents on them. They don't necessarily have a a central control system or anything like that. So it leaves these dark spots within the network that are unknown to organizations. Many organizations are deploying multitude of, of security tools to try and address this. And the the number is actually quite staggering, the different tools that the organizations are trying to use. And but that brings with this its own problems because the data in one doesn't necessarily correlate with the data in another. Which ones do you trust? Which ones do you use the most? All of that kind of information. So what Armis is actually trying to do is, first of all, is it's trying to be able to bring that visualization into your environment, understand the expansion of all of these devices within your network. What are the risks? What's the attack surface effectively that all these devices are doing? So we solve that by looking at then being able to build an accurate inventory. And from that asset inventory, then be able to understand what are the risks associated with this device, and are all of these devices on your network meeting the compliance, which could be an internal compliance requirement, something maybe set by your IT or your security operations team to make sure that those devices comply with the corporate policy, or they could be legal requirements. Maybe you have to comply with NIST two or other, compliance regulations and frameworks, which are legal obligations for your organization. Now Armis itself takes the data and that we see from multiple different sources. So it's not just a network and analysis platform, but what we are doing is we'll take the information. Remember all of those security tools we mentioned, for example, 76 security tools. Or maybe there's other tools that you have within your environment that are actually gathering and collecting information. It could be an endpoint agent, Microsoft Defender, CrowdStrike, Cylance, Tanium. All of this kind of information has data about the devices within your network. Armis can integrate with hundreds of different types of these tools to gather the data, correlate it, deduplicate it, and and bring together that single visualization of what that information is. But on top of that, we do still have the network traffic analysis, that deep packet inspection, understanding what the devices are, looking at the fingerprinting of the devices, what is it where is it connecting to, what DNS lookups is it doing, what DHCP requests is it doing, all of that kind of stuff. And all of this is backed by the Armis Centrix platform. This is a collective knowledge base. We're currently tracking over 3,000,000,000 devices with tens of millions of different device profiles, giving us that visibility of immediately knowing when we see devices, recognizing what the device is, matching it to that device profile, understanding is it behaving what good? Is it behaving bad? What are the vulnerabilities? What are the threats associated with that? All all giving you that full visibility of what's going on within your network. So Ahmed pulls this information together, and it's it's basically answering three very fundamental questions. What do I have within my network? So gathering that information together, correlating it, as I mentioned, deduplicating it, understanding and seeing what's going on within my network. Where is it connecting to? Understanding then what actions do I need to take now that I have that information. So taking the intelligence from the SentriX platform, intelligence engine, understanding what the risks are, what the vulnerabilities are, prioritizing that because it's very easy to go into any organization and say, hey. You've got 10,000, 100,000 vulnerabilities. But understanding what is the context for that. Where do I need to focus my attention? Not just where are the critical vulnerabilities, but where are the critical devices? Which are the ones that matter the most? And it and it could be my DMZ servers. It could be my network switches. It could be the laptops that are issued to my executive team. All of these kind of things, it's the differences and the priorities are different for each organization, and then being able to actually manage that in an appropriate manner. So if it's understanding what the assets are, updating and making sure my CMDB is accurate, maybe it's creating alerts, pushing something out to the SIM, maybe it's actually triggering an enforcement, maybe you want Armis to connect to one of your firewalls or your network access controllers and actually trigger that enforcement, or maybe you just wanna push it into a workflow management so that you can actually prioritize the work that your teams are working on. So, ultimately, it comes the core areas that we're talking about today that Armis delivers is, first of all, that asset and inventory, understanding what those devices are, being able to have an not just an accurate CMDP, but an enriched CMDP. Where is the the what not just what is the device? What is what is its purpose and its role? Where is the device? All of that kind of information. Understand that, IT security hygiene for you. And and if those devices are not meeting those I hygiene requirement levels, where are the gaps within that? Which are the devices that don't have my endpoint agent installed? All of that kind of information. And then things like, again, mention the compliance reporting. Once you have all of that, the path on top of that comes the security piece, understanding what the risks are, being able to address any threats that are detected within the environment, and actually being able to push enforcement, for that and and segment out those devices from that. And I do want to emphasize that, you know, all of this this this Centrix knowledge base that we have really is core to what Armis does. We mentioned the 3,000,000 devices, but it's constantly monitoring those devices, constantly looking at what they are, constantly letting you know if someone connects a new device to the network, deduplicating it so that you you don't have to under you don't have to worry about, you know, two two network device a device with two network interfaces appearing twice in your in your CMDB. And understanding the context about that device and what it is and being able to bring that advanced intelligence to to that information. And then being able to close those security gaps. How many of my devices, sorry, how many of my Windows devices, for example, don't have my endpoint agent installed? How many of my virtual machines haven't been connected to active directory? How many of my mobile phones don't have Intune installed on them? All of these are gap analysis type questions that you can report on and understand very quickly from Armis. So and then the risk part of it then comes down and and to understanding that security piece breaks down. What is the risk management, how do I understand it and detect those networks and understand the network segmentation. So the risk management piece, Armis will mention we we understand what the device is. We understand what normal looks like. We understand what devices should and shouldn't be connecting to. So when we see devices with an out of date operating system, they even we it's very common to see devices running Windows 10. You think they're up to date. But actually, many, many build versions of Windows 10 are out of support now understanding what those, devices are and where those devices are. Are we seeing devices using unencrypted credentials across the network or default credentials? Is someone connecting to a CCTV camera using admin admin or admin password or whatever the default password is for those devices? Then building up a risk score for each each and every single device within your network so that you can actually prioritize that and bring that richness of context around that so that you can actually start to move forward and actually reduce the risk and the attack surfaces within your network. This also benefits, things like SOC investigation time. How many times does a a SOC analyst have to refer to ten, fifteen, 20 different tool sets to understand what the device is, where the device is, what's its historical data, what was it connecting to just prior to the attack, what was it connecting to after the attack, was the lateral movement and spread of data within the within the network platform. This is information that's available to you within the Armis platform within seconds. And then being able to understand just the basic network segmentation and bring in that that enforcement for that to actually improve the security posture across the entire organization. Understand where the devices are, which switch is it connected to, which switch port is it connected to, which access port port is it connected to on a Wi Fi potentially. Is it is the device being moved from one VLAN to another? Has it been connected to an unauthorized VLAN? Have we got laptops connecting into a DMZ firewall, network? Have we got, devices that typically normally sit on a corporate network now suddenly being connected to a guest network? All of these questions, again, things that you can answer within Armis. And if you wish to, push that information and enforcement out to the firewalls or the network access controllers. So thank you very much for your time in in in my presentation. What I'm going to do now is is just switch to actually giving you a demonstration of what this actually looks like. Okay. So I'm gonna take just a couple of seconds to start with, giving you the visualization of the dashboard. Of course, multiple, vendors will have a dashboard. The core thing to what we actually say give talk talk about when we come in with the Armis dashboard is it's an entirely customizable environment. So we build out the reports and the dashboards that you get individually for each individual user, at the time that you, sorry, for individual user based on what your role is and the information that you want to see within the environment. So you may have a user who's interested in the asset inventory. You may have a user who's interested in that DAF analysis, understanding which of the devices are missing the the the endpoint agents and things that you would expect to see. You may have another user that's focused very much on the security aspects of it. But instantly, you have a a view of how many devices are connected to your network right now. Remember, Armis will see every single device that connects to your network. So if it connects to the network, we know it's there. So how many devices do I have on your network right now? How many devices were on your network yesterday? How many devices were on your network a month ago between 2PM and 4PM? How many of these carry those risks, which I'll talk about in a little while? How many threat activities have we seen, and how many alerts are there? But, again, alerting with Armis is not so much necessarily about tell me about a threat that's going in. Can you tell me about something in my network? Tell me about an expired certificate. Tell me about devices that haven't been updated to the latest version of Windows. Tell me about two devices with the same IP address or a device with an invalid certificate on it. And it all starts with that information about what those devices are within your network. So Armis is doing this automatically. Armis is identifying the devices within your network. It's typing them and categorizing them, identifying their name, their IP address, everything about that device. And it could be the standard machines within your network, the virtual machines, the personal computers. It could be the servers. It could be the IP cameras. It could be, all sorts of different devices within your environment. And, you know, even down to the esoteric devices, you've got you know, if your mobile phone connects to the network, your watch probably connects to the network. Your if your people these days are connecting their cars or their Amazon Alexa's or their games consoles, these are all important devices because they are on your network. What else is talking to them? What else what risks do they pose to your network? And then just being able to visualize this data slightly differently. Maybe I want to understand what the different categories of devices are, What are the different types of devices I have within my network? All the different models, the different brands of devices. All of this information is easily reported from. Where is Armis gathering its information from? Which of the devices that CrowdStrike knows about? Which devices CrowdStrike doesn't know about, all of that kind of information. So if we take a moment to drill down a little bit more into that, what kind of information does that look like? So if I take, to start off with, just a typical device, I'm gonna pop open another tab so I can go back very easily. So Armis is gathering information about this device from multiple different data sources. We can actually see a quick summary up here of what those different data sources are. We've got an integration with the active directory, with the CrowdStrike agent, with the Palo Alto VPN in this case, with the Qualys agent. So Amex is gathering all of this data together and actually summarizing it together, deduplicating it about what this device is. Amex will automatically then categorize the type, what the model is, the brands, all of that kind of information. When was it first seen on the network? When was it last seen on the network? What are the risk factors associated with it? And some of the network information. So when we try to drill down a bit deeper into this kind of information, everything from what its IP address is, which, where is it located, which switch is it connected to, which switch port is it connected to, what network interfaces does it have, what's its serial number associated, who was the last user logged into the device, all of that kind of information. Now remember, it's this is not just correlating information for the sake of correlating that information. What we will come to in a moment is the ability to then search for the the outliers, the ones that aren't configured correctly. So having this information is available to you being able to search for that information. What is the status of my CrowdStrike agent? People will often ask, you know, I have CrowdStrike. I can log in to CrowdStrike. I can tell the status of that. But what about the devices that CrowdStrike doesn't know about or SentinelOne or Cylance or any of these endpoint agent tools? What are the exceptions to the rule? Which are the ones that the the my vulnerability scanner has not scanned within the last thirty days? And then that detailed information about the operating system in terms of the build, the patch version, is it up to date? Do I need to patch this device as well as the other information then about the the various different attributes about the device. So there's a whole range of information about this device, which I'll show you how we query in a moment. But also then, what is the device doing on my network? Where is it talking to? Where are the inbound connections? Where are the outbound connections? All of that kind of information. Is it talking to devices that it shouldn't be talking to? Is it talking to Internet traffic? How much for each of those connections is it how How much traffic is being sent? And is it and as I mentioned, it's external or external internal traffic. So you can actually, again, very quickly start to build up policies about saying which devices are sending the most traffic to the Internet, all of that kind of information. Understanding which are the the ports it's connecting to and, again, the services. So that that detailed view of where the devices are. And now with that comes also things like the activity information for that device. So, you know, the activity information that we're tracking will include things like what DNS request is it making, what type of, encryption is it using? Is it using weak encryption? Are we seeing TLS one point zero or 1.4 or 1.1 or s s or even SL based connections? So all of that information about the behavior of the device, because it all adds up towards what the risks are for this device, which I'll come to next. But first of all, as well, that asset inventory, what are the device, what's installed on this. So, again, looking for things that perhaps shouldn't be installed. You know, if if applications that access Tor or the dark web, for instance, are banned within the organization, Being able to quickly find those, devices with those out of date oh, sorry, unauthorized applications within the environment. And then as I keep mentioning, things like the risks and the vulnerabilities. So now when we come to what are the risks within the environment, what what threats does this pose within my environment, is it using unencrypted credentials, is it using an end of life operating system, are we using, insecure protocols, for example. So SMB v version one, Windows share version one is a very common propagation mechanism for ransomware. So being able to understand what that that information what's going on with the devices within the network for that or the director vulnerabilities. So if we take a moment to have a look at the vulnerabilities, again, you have all of these vulnerabilities for any device, but understanding the context, is this is this an important laptop to me? Do I need to understand what the, the imperative is for this particular vulnerability? It only has a CVSS score of medium in this case, but, potentially, there's a higher risk score for that. Maybe we want to understand what the vulnerability is, reference the information from the Microsoft article, understand what other devices this vulnerability potentially matches to. Is there any remediation associated with this? So in this case, there's some, Microsoft patches. So the reality is is this device probably just needs an update. It probably just needs the latest Microsoft patches pushed out to it. But knowing that is that this device has lagged behind for some reason is something that Armis can tell you in in seconds. Or understanding what is the real threat of this vulnerability. So, actually, it may only be a medium, severity CVE, but it actually, there are eight active exploits around at the moment that it's actively being exploited. Although it's not associated with ransomware, but there are there are threat actors out there using this. So even though it's not a critical vulnerability, the fact that it's actively being exploited is something that might be of interest to any organization. Going back to the device, obviously, once you have that information, you might want to get notified about it. So there's a complete policy engine that you can actually build up to say, tell me about any of that thing. When I started at the beginning showing the dashboard, what are the alerts for these devices? What are the threats going on with it? Now what do you want to do about that? Create a policy. Maybe I want to get an alert. Maybe now I can actually see in this alert that this device is is actually doing crypto mining. Maybe I actually want to block this device. I'm going to tell my network access control or my firewall to take this device off the network. Now the important thing is that this is a a device, a managed device. This is where most organizations have that context and they have the visibility for what these devices are already, but it doesn't always follow. So for instance, if we have, an IP camera, you can't install an agent on this device. You can't, connect it to your active directory, all of that kind of information. But it's still important to understand what this device is, what is it doing on your network. So, again, Armis is monitoring your network. It understands this device. We actually only have our data sources of being that network monitoring for this device. Still will tell you what the device is, where the device is, when was it seen on the network, when was it last seen on the network, and summarize that inventory information. Again, it's a little bit more sparse than the other device that we have because because we have less information to build from. But you still have things like in this case, even things like which what version of operating system is it running on as well as that, and the same information then about the network connections. Remember, this is every device within your network. Remember the the cars and the the mobile and the watch and all the Amazon Alexa. Where is it connecting to? All of that kind of information. What is it doing on your network? What what DNS lookups is it doing? What TCP connections? And even potentially what applications. So this is an I it's a it's a CCTV camera. It has an web server running on it. So in this case, it's an Apache web server. Is it an up to date version of Apache web server? Is it vulnerable to that kind of thing? Is is it it actually even running an Android browser and all of that. So understanding again then things like what are the risk factors associated for this device, what are the vulnerabilities, all of that for, again, every device within your network and building out those alerts for it. And in this case, yeah, this one is, again, it's another threat activity. What is the botnet associated with that? But being able to do this for every device, so we have our query language. It's very easy to come into here, and I can say, show me just all of the operating systems within my environment. Armis will summarize that information very quickly. Maybe I'm actually focusing on my Windows devices. And, actually, from that, I understand want to understand what's the different types of, the Windows devices I have within my network. So now I can see I've got my virtual machines, my personal computers. It might be a little bit small on your screen, but this is summarizing the data for you to be able to visualize either interactively within your environment, or you can actually, build this out, of course, into those dashboard reports or the or a regular scheduled report that you want to run for your device. And so now out of all of these Windows devices, we can correlate this data as well. So the important thing for that is maybe I actually want to understand how many of these devices have my endpoint agent installed. So I can come down and I can say, actually, out of all of these Windows devices, show me the ones that do have, say, CrowdStrike installed. So I can very quickly search and show me the devices that that remember, I'm searching now for Windows devices with CrowdStrike installed. And, again, I can get to see the types and I can see how many I've got. So in this case, system environment, I've got 13 different operating systems across, a range of different devices that are actually running that. More importantly, though, that gap analysis, I want to understand the devices that do not contain crowds that do not have CrowdStrike running on it. So now I've got a breakdown of all the different device types, all the different operating systems of the different devices that do not have my CrowdStrike agents installed on it. So I can produce that report. I can have it emailed to me daily if you like, daily, weekly, monthly. I want to understand what the status of of the devices are within my environment. Or maybe I want to go back, and I can do this for any of the information saw for that. Maybe I I want to run the reports of the devices not connected to active directory again or or the devices that have not been scanned by Qualys within the last thirty days. Or more importantly, potentially so any of that information that we looked at, maybe I want to understand what the risk factors are within. So all those those risk factors we just talked about a minute ago. So maybe I want to say, okay. Tell Armis tell me, all of the critical and high risks within my environment. And Armis will give you that list again instantly, and we do by the way, you know, just on that the amount of data, the volume of data we have within the platform, we have customers who, quite literally have millions of devices. It's a it's a cloud based solution. We automatically scale, and we can give you that fast searching capability and fast reporting capability by that scale of the cloud platform. So, you know, coming back to the risk factors, I have this instant view of things like end of life operating systems in here. Maybe we've got end of life, switches. So, if you can read the screen, for instance, Cisco switches, for example, that haven't had their firmware updated or maybe the hardware is end of life, then Armis can give you that view quick view of of and that report so you can understand where where is potentially you're gonna have to invest and re replace or update those those devices. Devices connecting across different boundaries. So mention, for example, devices potentially that was on the corporate network being switched, jumped on to the guest network, and then maybe back again. All of that kind of thing is is is that permitted within your organization? Do you want to be alerted to that? Things like certificates being used within the environment, that kind of thing as well. Are there expired certificates within the network? So Armis will build out this list of risk factors again that you can build out those reports for if you need to. And once you have all of this information, it's all then about being able to build out what action you want to take. So, for example, if if I wanted to search for those devices, that didn't haven't been scanned by, the the vulnerability scanner, I can come into Armis and I can say, okay. I want to create a policy. In this case, I'm going to say, when I see a device where the, let's say it's a category of type computers because we're gonna focus on on that. And I'm going to say also where the Qualys last scan date not within the last thirty days. Then, now that's my policy. So what Armis is doing is saying, if we see a device connected to the computer that hasn't been scanned within the last thirty days, what do you want to do with that? Now this could be a device that someone's been working from home for a long time, or maybe it's just a new part of the network, or, essentially, anything that's for any reason why or maybe a remote part of the network that Qualys doesn't even know about. And so what are we going to do about that? So we could create an alert to tell the the the SOC team that this device hasn't been scanned. Maybe we want to tag it for someone to go and have a look at it. Maybe we want to actually block it. It's a bit dramatic. But, actually, the more important thing is maybe we just want to tell Qualys to actually launch that vulnerability scan. So now we're actually saying that when that device appears back on the network and it hasn't been scanned in the last thirty days, tell Qualys to go and instead of waiting for Qualys to go around and scan that part of the network, we're gonna tell Qualys to go scan that, device right now. So all of this can be built up into policies and actions based on threats or what the device is, where the device is, all of that kind of information, whether it be what is the device type, what is it connecting to, should it be connecting to that, building out your CMDB, building out your risk score, building out your vulnerability association information with that. And all of that then feeds back into those dashboards and that reporting. So whether you want to build out a compliance report or, just an activity report, all of that kind of information all comes back into that central location. So I'm going to wrap that up at this point. Hopefully, that gives you a good view of what Armis is capable of, what Armis is able to do, and the the advantages and the speed with which we can actually help secure your network. I'm going to pause my screen sharing at this point and just check for any questions. So, there are some questions. How often is Armis threat intelligence updated? So like a lot of things within Armis, it is a continual update. So we take a number of threat intelligence feeds both from external sources, and we have our own threat intelligence team. So, the other key thing is, actually, Armis is, recently, announced innovations with partnership and investment in in technologies, which actually is proactively discovering threats before they're even published. So we have, capabilities now that will actually, look at what people are working on effectively on the dark web or that kind of thing and actually feed that information in so that we actually know a lot of the time in advance before threats are even published which of the devices within your platform would be impacted by that kind of information. But it's a continuous, update that happens multiple times per hour, within an an individual, well, within the platform itself on a continuous basis. Next question. Could we modify or add our own data to the Armis platform? Yes. You can. So the, the Armis database schema is extensible. So what you saw was all each of those parameters that we looked at and we can correlate and track, for that, you can actually add additional, fields for that for that. And it can be it could be, like, things like an extra string. Maybe you want to understand, like, business owner or may I have one the other day. A customer's asking they want to add the c o two output to a a device. So they create an extra field in the in the device and actually, now can add that field to the device. It could be a date. It could be, when is this device going to be end of life in our internal catalog, for example. And then this data can be updated either manually, individually per device if you really want to. It can be done by importing things like a spreadsheet or a CSV file, or we have a full programmatic API. So you can integrate not just the using the integrations that Armis has out of the box, but you can actually create your own integrations, bring the data in, import data, update each of those fields as well. One more question. Oh, no. No. I think that's all of it. Thank you very much. Over to you, Raji. Great. Thank you very much, David, for that presentation, and thanks everyone for your time today and your engagement. For any questions that we haven't been able to address today, we will come back to you directly one to one via email. For further information on Armis, please do visit our website, armis.com or armis.com/demo to request a more tailored, customized demo. Thanks again, everyone, and have a great day.