Name: America | Live Demo Armis Centrix™ for Vulnerability Prioritization and Remediation
Uploaded: 2025-04-29T18:46:03.738Z
Duration: 30 min 8 s
Description: America | Live Demo Armis Centrix™ for Vulnerability Prioritization and Remediation

Transcript for "America | Live Demo Armis Centrix™ for Vulnerability Prioritization and Remediation": Hello, and welcome, everyone, and thank you for joining us at today's Armis demo. I am Antonio Querales, the campaign marketing manager at Armis, and I will be your host today. In this session, we will discuss Armis centric for vulnerability, prioritization, and remediation. Before we begin into our demo, I would like to cover some housekeeping items. This is a thirty minute demo session. This session is being recorded, and it will be available for you on demand. Please submit your question in the chat, and we will address them at the end of the presentation. We have provide some additional resources for you on the topic. Please check them out after the webinar. With that, I would like to introduce our speaker, Michael Atkinson, principal sales engineer at Armis. And now, Michael, I hand this off to you. Thanks so much, Antonio, and thanks everyone for being here. I really appreciate it. Michael Atkinson here, and we're gonna talk about Armis Centric's vulnerability, prioritization, and remediation. There are just way too many vulnerabilities in operating systems and in software for anybody to keep up with it. We're seeing, almost a 700% increase in less than six years. Typical organizations have only one out of 10 vulnerabilities solved within a given month, and 56% of the vulnerabilities reported in 2022 were exploited in within a week of disclosure. This is an ongoing problem that we can see in a lot of ways, not least of which all the ransomware attacks that you hear in the news, a lot of that is coming from organizations who are unable to prioritize and remediate vulnerabilities in a timely fashion. So we address key challenges in this space. We find the missing vulnerabilities from the assets you cannot scan. IT devices are often scannable, but Internet of things devices, industrial control systems devices, and definitely medical devices should not be scanned. It can cause serious availability issues. We often see incomplete and unreliable vulnerability data. The sheer volume of vulnerabilities with no capability to prioritize by business risk is an enormous challenge. And there's also a lack of process management automated workflows. The humans are the expensive part of this process. Everything that we can automate makes our humans more efficient. So here's how we solve it. Armis is a platform with a modular approach to address key security challenges. And today, we're gonna talk about our vulnerability prioritization remediation product that allows you to see, consolidate, prioritize, and remediate all vulnerabilities, improve mean time to resolution with automatic remediation and ticketing workflows. The secret sauce behind Armis is our collective asset intelligence engine. It's the largest cybersecurity AI engine in the world. We've got over 3,000,000,000 assets that we're watching right now, over 320,000,000,000 micro behavior models. We're adjusting 500,000,000,000 events today. We see 850,000,000 vulnerabilities and more every hour of every day. This is the biggest asset intelligence engine in the world. It's 10 times the size of all of our competitors combined. And as I'm going to show you, if you don't know what your asset is, you cannot prioritize vulnerabilities and remediation appropriately. So here are our advantages. We fill in coverage gaps and consolidate vulnerabilities. We enrich what we show you with asset context and recommendations. We prioritize the vulnerabilities. We help you remediate them, and we track the progress and manage the process. This gives you a single source of truth with a baseline of all the vulnerabilities, including their associated assets. You can leverage our passive assessment capability to detect vulnerabilities against your full asset inventory, not just the devices you can scan, and we can help you eliminate inefficiencies in scanner overlap of or unnecessary agent and asset scans. Armis allows you to assign asset context to every vulnerability, seeing what the asset is doing, where it's located, who's using it, and what the business impact is. This is a absolute essential in today's, vulnerability filled world. We need to prioritize not just based on the severity of the CVE, but of the importance to you of the asset that the CVE is on. We also save vulnerability time teams tons of time in hunting down the assets to try to understand them. It's typically a highly manual process to prioritize remediation Armis automates it. So we combine our real world threat intelligence and analytics with your own business landscape and allow you to drill down to a a manageable amount of critically vulnerable assets and what you need to do about them. You can figure out with Armis what matters the most to you, and that's what's important for vulnerability prioritization. And we help you remediate them. We connect to your existing tools and workflows to make the mean time to resolution as small as we can. We generate and share contextual data with other IT security and soft tools. We can automate ticket creation. We can update open existing open tickets automatically, and this is with Jira and ServiceNow. And we can even set remediation and mitigation actions, including updating firewall rules, changing security tags, configuration changes. We can do enforcement using network admission control and microsegmentation tools. And then when we hear back from Jira or ServiceNow that the vulnerability has been remediated, you can, by policy, reverse any containment actions you took with the network admission control or microsegmentation tool and get the machine fully back online. And how you do that is up to you. We also help you track the progress and manage the process of vulnerability management. We have fully customizable dashboards and reports and suitable for every, level, every role in your organization. They can be shared. They can be customized to your heart's content. They can be exported to people who don't have Armis lock ins. We can track service level agreements, demonstrate progress on exposure reduction, and provide executive reporting on the status of vulnerability remediation. So in summary, Armis fills in coverage gaps and consolidates vulnerabilities, enriches with asset context and recommendations. We track progress and manage the process, remediate the vulnerabilities, and prioritize the vulnerabilities. And I did that out of order, Antonio. This is gonna be another do. In summary, we fill in coverage gaps and consolidate the vulnerabilities. We enrich the data with asset context and recommendations, prioritize the vulnerabilities based on your business risk, remediate the vulnerabilities, and track the progress and manage the process of getting it done. And our customers love it. Thank you. We're gonna transition now to the demo. So this is the a a demo environment of the Armis console. You can see total and new devices, high risk devices, threat activities, unhandled alerts are found here. We have a conception of the physical location of a device. We call it a site. Sites can be as broad or as granular as you need them to be. We also allow logical segmentation of devices by boundary. That allows you to decide what logically makes the most sense for how you manage devices, how you view them. And finally, we show up to thirty days of metadata in this user interface, and I do wanna emphasize that word metadata. Your payload data never leaves your network because of Armis. Here you can see we have a vulnerabilities dashboard with 10 dashlets on it. We can see vulnerabilities, severity for industrial control system devices, vulnerability by impact score, and more information. Let's take a look at a few devices. It's important to understand that with Armis, you don't have to decide what type of device something is. If it's a virtual machine, a personal computer, or a PLC, we understand that. And that's super important for vulnerabilities. If you don't know what a device is, you cannot possibly prioritize correctly what you want to remediate and when. Let's take a look at a couple of devices and, how Armis helps you remediate vulnerabilities on them. This is the overview screen for a laptop, and I wanna go over what it's showing us. We have a lot of great device basics here. We know, quite a bit about risk. We know what it's doing on the network. We know where it is. We know what tags and boundaries it's part of. We see all of the data sources for it. Now this is very interesting. We see Active Directory, CrowdStrike, Palo Alto Networks GlobalProtect, Qualys, a leading vulnerability scanner, SCCM, ServiceNow, and SPAN Tap are all giving us information about this device. We also see it's a high risk device with three alerts. Coming over to the inventory screen, we get a lot of detail that might be very helpful for you. For example, if your vulnerability team needs to know who is associated with an asset, Well, here we can see that this asset is being used by mister Harrison Ford. We do also see the network activity on the device. This can be very valuable for tracking down what kinds of things are happening, during a security incident. We can see the connections over time and slice and dice them a bunch of different ways to understand exactly what the machine's been doing on the network. We see that it has three alerts, all related to Coinhive mining. We see the activities it's undertaking on the network. This is incredibly valuable. We're tracking a 34 different types of activities both in real time and over the last ninety days to understand what this asset has been doing and why in a lot of cases. We detect all the applications on this device. You can't remediate all your vulnerabilities if you don't know what applications are. Finally, let's take a look at risks. We can see that this has a device risk score of eight, which is high. We automatically score devices by risk, but it's entirely customizable and up to you as to how you want things prioritized. We also see just on the summary screen, this overview screen, that CrowdStrike is enabled on this endpoint. So here are the risk factors as we seeing them. Unencrypted credentials detected. So unsafe unsafe device behavior. That's not a CVE, but it's certainly a risk factor. We have high risk applications again, not a CVE, end of life operating system being used, and then we still get to the other, components. Vulnerabilities are shown here, and you can see the status of each of them. So here's a CVSS score. You know what that is. The risk score is an Armas risk score, and the AVM rating is the rating for Armis vulnerability management. Let's take a look at one other asset and see what you would see for a device that doesn't have any integrations. So similar to before, but the only data source we have for this is, our SPAN tap capability. We have no integrations feeding us data about this device. We still get all the great inventory information, all the great network information. We have one alert of a botnet infection attempt detected. It's important to pay attention to the fact that we also see what operating system this camera is running. Most people don't think of this. They think of a camera as a purpose built device. Most of them aren't. Most of them are Linux computers or other types of computers connected up to a camera as a as a peripheral. This has some advantages for the device manufacturer. It's easy to develop new features. It's easy to develop the product in the first place, but it may change the threat landscape for the device. There may be an additional attack surface available for devices running, general purpose operating system. We also see the applications running on this IP camera, and that's important too. Applications impact vulnerability and risk quite a bit. We still see all the great activity data that I showed you previously on the laptop. Let's take a look at risk factors and vulnerabilities. So we do have that threat detected as, both an alert and a risk factor, and we are seeing unencrypted HTTP traffic. But the vulnerabilities on this device are significant. Remember, our data sources do not include any vulnerability scanners. Armis has passively determined all of these vulnerabilities on this device. We can open this up to get deeper into it. We can look at any of the CVEs involved. We can go directly to the NIST page here for the for the for this specific vulnerability. We have a lot of capacity to see what's happening and what we need to do about it. We can also go directly to the devices that this vulnerability is on from within the vulnerability here. So all of these dashboards and dashlets that you see are customizable. We have a huge dashlet library that allows you to find the information that you're looking for and visualize it as quickly as possible. Take a look at vulnerability gap analysis, and you can see that we have a lot of capability here. You can also customize any of the dashlets to your heart's content or create a custom dashlet from scratch. So just looking at this prepackaged, dashboard for vulnerabilities, you can see that we go into depth based on what you might be interested in, what might be important in your environment. But how do you get to that information? How can we see what's important to you? Well, let's start here. Here, we're showing the information and basically bringing into a funnel of everything, in this case, over 7,000 CVEs on over 800 assets in the last seven days, down to the most vulnerable assets here. And this is based on our rating of everything that's important. We can click on this and go directly to a view of the assets in question and their vulnerabilities. We can see CVEs in the headlines here and be able to see immediately what devices are affected by them. We can show you NHS cyber alerts if that's important to your environment. And we can just get a list of all the vulnerabilities. But, again, a list of all the vulnerabilities is not nearly as useful. Every customer I speak with has limited resources to address risk. And, frankly, vulnerability should not be a proxy for risk. Vulnerabilities are an important input to risk, but they're not risk themselves. We wanna prioritize vulnerabilities by risk. So let's talk about how we need to do how we can do that. This is the Armis advanced search or search builder. And here we're searching for vulnerabilities. Everything to the right of it is going to be a, a filter. So confidence level confirmed and high. Only show me vulnerabilities that I'm highly confident are accurate or that I'm completely confident or active are accurate. Let's now only show CVSS scores that are high and critical. And if we stop here and do the search, we can see we have a lot fewer vulnerabilities. This is still too many for us to reasonably prioritize them. So what else might be important to us? How exploitable is this? Maybe we wanna start with attacks that are low complexity, but also have a big impact on confidentiality. Maybe confidentiality is what's most important in your environment compared to integrity and availability. Let's also make sure that this doesn't require user interaction. That might be a good way of prioritizing vulnerabilities in your environment. There might be other criteria that matter to you. But now we're down to a far, far more manageable number of vulnerabilities and devices. Let's sort this by the affected devices. And now if we want, if these are the correct criteria in your environment to prioritize vulnerabilities, let's start with this one, which is on the most number of devices. So how do we get all of this information? Well, there are two ways that we get the information. Way number one is with our passive network SPAN port, but the other manner is through integrations. We have 33 connected integrations in this demo environment and a hundred nine available out of about a total of a 30 integrations that we can use. Some of these integrations are not vulnerability related, obviously. For example, Lansweeper doesn't really help us with vulnerabilities, but we do integrate with vulnerability management systems, including Expos, Rapid seven, Qualys, and Tenable. This allows us to take the strengths of these vulnerability scanners along with our strengths of being passive, being continuous vulnerability scanners when we show you what they know in a point of time, and most importantly, our asset intelligence to determine risk and vulnerability on these devices. In addition to these integrations that allow us to bring in vulnerabilities from vulnerability scanning tools, we also integrate with Jira and ServiceNow for automated ticketing. That means that Armis can open tickets for vulnerabilities discovered, monitor those ticket status, and then reverse any, any changes that were made by policy once the remediation has occurred and the vulnerability is resolved. Armis can fully integrate into any vulnerability management program. Antonio, sir, that's the end of my planned demo. I'm more than happy to take questions. Yes. We had a couple question in the chat. Can you address that? Absolutely. So I see in the chat, how can Armis help us automate vulnerability management? Well, we do this a few different ways. The first thing that to understand is that we help you automate vulnerability management by business risk, the business risk to your environment. That's really important to understand. If you're not doing that, you're not prioritizing correctly. And then in addition to that, we can integrate with ticketing tools in order to help you get those vulnerabilities remediated. And then I see in the chat, does your vulnerability prioritization remediation product integrate with other tools? Yes. It integrates with approximately a 30 other tools, things that give us information about the asset, things that give us information about the risks that we're seeing on the asset, and allowing us to share the information that we put together and make it more useful, make your other tools better. Hey, Antonio. That's all I had. Back to you, sir. Thank you. It is now the end of the session, and we have received many questions. We will answer the rest of your question via email. I want to thank everyone for joining us today. Thank you so much, Michael, for your amazing presentation, and thank you so much everyone for your time. For more information about Armis, please visit armys.com. Have a great day. Thank you. Thanks, everyone.