Xpanse Exposure Triage After an Acquisition
Arclight Health acquires a 900-employee clinic network with 15 domains, 22 public IP ranges, and three AWS accounts. Cortex Xpanse discovers 3,200 internet-facing assets; 210 are unknown and not assigned to a business unit. The acquisition's IT team has no complete CMDB. Xpanse flags 47 critical exposures: 12 exposed RDP services, 8 unpatched Citrix ADC gateways, 5 public S3 buckets containing patient documents, and 22 expired TLS certificates on patient portals. The CISO's remediation SLA is 72 hours for critical findings, but ownership is unclear because the acquired company uses different tags. The security team has three analysts. The cloud team can act only on AWS accounts after change approval, which takes 24 hours. Two of the 15 domains are not in the acquired company's DNS inventory.
1. Rank the 47 critical exposures for remediation and justify the order using the facts in the setup.
Read the worked answer
Rank by harm and exploitability, not by scanner severity alone. First are the 5 public S3 buckets containing patient documents: confirmed sensitive data exposure creates regulatory and breach risk, and containment can be fast through bucket policy or account-level public-access block. Second are the 8 unpatched Citrix ADC gateways: internet-facing edge devices are initial-access targets and can lead to ransomware or credential theft; the end-of-life firmware increases urgency. Third are the 12 exposed RDP services: high ransomware risk, but often mitigable quickly with security-group or firewall restrictions. Fourth are the 22 expired TLS certificates: a trust and availability problem, not direct compromise. The unknown ownership does not justify delay. Apply temporary containment to the top two groups while ownership is resolved, and document the compensating control. If a Citrix gateway has a known exploited vulnerability, it may move ahead of a public bucket that contains no sensitive data, but here the bucket contents are stated to include patient documents.
2. How would you resolve the 210 unknown assets and unclear ownership without a complete CMDB? Include Xpanse features and process.
Read the worked answer
Use Xpanse as the inventory of record until the CMDB improves. Group unknown assets by public IP range, domain, certificate subject, and cloud account. Configure cloud connectors for the three AWS accounts so owned elastic IPs and load balancers are attributed automatically. Use certificate and DNS metadata to infer the owning clinic or application, then validate with the acquired IT team. Create business-unit tags and an ownership field in Xpanse, and assign a default owner, likely security operations, for any asset that remains unclaimed after a fixed period. Do not let 'unknown' become a permanent state: run a weekly reconciliation, compare new assets against the prior week, and require each new internet-facing asset to have an owner tag. Two domains missing from DNS inventory are a signal to reconcile DNS records, not to ignore the assets.
3. Can the 72-hour SLA be met with a 24-hour change approval and three analysts? Describe the operating model and compensating controls.
Read the worked answer
Yes, if the team separates containment from permanent remediation. Use the first two hours to validate the exposure, confirm data sensitivity, and identify an owner. Apply low-risk compensating controls within four hours: account-level public-access block for S3, security-group or firewall restriction for RDP, and WAF virtual patching for Citrix where a patch cannot be applied immediately. These controls may not need the same 24-hour approval as a destructive change; pre-authorize them for critical exposures. The three analysts split roles: one triages and validates, one coordinates cloud containment, one drives owner outreach and ticketing. The 24-hour approval clock runs in parallel, not after triage. Escalate at 48 hours if no owner claims the asset. Track time from validation to containment, not time to permanent fix. The SLA can be met for containment even when the final patch lands later.