Configure Risks in Exposure Management
One of the primary objectives of the Censys Exposure Management platform is to shrink your organization’s attackable surface area. The Exposure Management platform proactively flags risks to draw your attention to vulnerable places.
Start by tuning risk default settings to fit your organization’s needs. Then investigate and remediate risks in your network to improve your security posture.
Configure All Risks
As Censys maps and monitors your attack surface, it detects more than 250 different risk types.
You can set each type’s default severity to fit your security policies and investigative priorities. You can disable a risk type if you do not want the platform to detect any instances of it.
Click the Configure Risks button in upper right of the Risks page. Here you can view all risks that Censys detects.
Search, Sort, and Filter Your Risk for Easy Editing
As you're refining your risk configurations, you can search, sort, and filter the risks based on when the risk was added to the Censys list of detections, Severity, Status, Category, Asset Type, and Edited Status. You can also sort risks by their prevalence in your attacks surface.
Click View Only Edited Risks to refine the list to previously edited risks. Sort the columns to bring important rows to the top of your view.
You can customize the risk severity to suit your organization's needs. You can also disable the risk type entirely.
Select from the list to see details and remediation recommendations.
The Censys-recommended severity for each risk type is noted with the Recommended text. Use the Severity Selection menu to specify the severity classification that fits your organization’s policies. From highest to lowest, the options include:
Critical: Indicates a severe risk which may result in compromise of the affected system or interruption of business objectives. Remediate critical risks as soon as possible.
High: Indicates a risk which can result in remote code execution or sensitive information disclosure. Prioritize high risks when creating a risk remediation roadmap.
Medium: Indicates a risk which can be exploited in combination with other vulnerabilities to perform an attack. Treat medium risks as standard priority on a risk roadmap.
Low: Indicates a vulnerability which can provide an attacker with some information about or access to the affected system. Deal with low risks at the lowest priority.
The default severity set for a type is assigned to any instance of that risk type found on any of your assets.
After you configure your risk settings, open the Risks page to start investigating.
Further Reading on Risks
See this reference article for a description of the risk categories that the Censys Exposure Management platform detects.