Question

A security operations team at a multinational firm has been relying on quarterly authenticated internal vulnerability scans of its known asset inventory. During a recent breach investigation, responders discovered that the initial foothold was an internet-facing marketing microsite spun up by a business unit on a third-party cloud account that IT never inventoried. Leadership wants a program change that will systematically reduce the chance of another unknown internet-exposed asset being exploited. Which approach best addresses the underlying gap?

Accepted Answer

Implement a continuous external attack surface management (ASM) capability that discovers and monitors internet-facing assets from an outside-in perspective, including unsanctioned and shadow deployments

Answer

Increase the frequency of authenticated internal vulnerability scans from quarterly to weekly against the existing asset inventory

Answer

Deploy endpoint EDR agents to every server in the corporate data center and enforce agent health reporting to the SIEM

Answer

Require all business units to submit change tickets before deploying new applications and audit the change management system monthly