You are evaluating the asset inventory in a hybrid cloud environment monitored by CrowdStrike Falcon. An unregistered virtual machine (VM) in the cloud inventory is running outdated software with known vulnerabilities and accepting inbound connections from public IPs. What is the best action to mitigate the risks associated with this asset?

The most effective risk mitigation strategy is a comprehensive, multi-step approach that addresses all identified issues. Deploying the Falcon sensor is the first critical step to gain visibility and control over the unregistered asset. Concurrently, restricting network access from public IPs immediately contains the threat and reduces the attack surface. Finally, updating the outdated software remediates the known vulnerabilities, addressing the root cause of the risk. This layered approach ensures the asset is secured, monitored, and brought into compliance without causing unnecessary business disruption.

B. An unregistered VM does not have the Falcon sensor installed, so it is not a managed asset within the CrowdStrike platform and cannot be assigned to any group.
C. Ignoring a known vulnerable and publicly exposed asset is a negligent security practice that invites a breach, directly contradicting the goal of risk mitigation.
D. While termination eliminates the threat, it is an extreme measure that may disrupt critical business functions. Mitigation (Option A) is preferable to elimination when possible.

1. CrowdStrike Falcon® Cloud Security Documentation: The workflow for securing cloud environments involves discovering assets, assessing their posture, and protecting workloads. For an unmanaged workload (unregistered VM), the standard procedure is to deploy the Falcon sensor to enable Cloud Workload Protection (CWP). CSPM findings, such as public network exposure, would trigger recommendations to restrict access.

Source: CrowdStrike Tech Center, "Falcon Cloud Security: Cloud Workload Protection (CWP) Deployment," Section: Deploying the Falcon Sensor. (This documentation outlines the necessity of sensor deployment for visibility and protection of cloud workloads).

2. CrowdStrike Falcon® Discover Documentation: Falcon Discover for Cloud is designed to identify unmanaged assets in cloud environments. The primary remediation action for a discovered, unprotected VM is to install the Falcon sensor to bring it under management and apply security policies.

Source: CrowdStrike Falcon Platform Documentation, "Falcon Discover for Cloud," Section: Unmanaged Assets. (This section explains that the goal for unmanaged assets is to move them to a managed state by deploying the sensor).

3. NIST Special Publication 800-53 (Rev. 5), Security and Privacy Controls for Information Systems and Organizations: This framework outlines security best practices. Control families like AC (Access Control), RA (Risk Assessment), and SI (System and Information Integrity) support the actions in option A. Specifically, AC-4 (Information Flow Enforcement) supports restricting network access, and SI-2 (Flaw Remediation) supports updating software.

Source: NIST SP 800-53 (Rev. 5), Controls: AC-4, RA-5, SI-2. (This standard provides the foundational security principles for the actions described).