Rapid7 – Page 12 – CyberSecurity Confabulation

Rapid7 Sales Director Devin Poulter On Building a Career as an Account Executive

Posted 2 years ago by Rapid7

Devin Poulter is a Sales Director with over 20 years of experience in the tech industry. Recently, we asked him a few questions to learn more about how he built his career, what it’s like to lead a team at Rapid7, and more.

You’ve been in software sales for most of your career, what can you tell us about being successful as an Account Executive?

I’d say building your personal brand is really important for success as an Account Executive. Being able to have open and honest conversations with customers and really focus on where you can (or sometimes, where you can not) add value is something people will remember you by.

Years down the line, when you are either introducing a new product, or representing a different company, that decision maker you are reaching out to will probably remember how you treated them previously. If you took the time to create a positive relationship, they are more likely to take your call and listen because you’ve built that foundation of trust. I’ve seen that play out time and time again, and I think it’s important for people building their career to equally focus on their personal brand as well as the product or company brand you’re representing.

What stands out to you about Rapid7 when it comes to building a sales career?

Well, the cybersecurity market is white hot as threats and bad actors continue to find new ways of exposing vulnerable organizations. It’s a market that is attracting a lot of competition as new companies and startups emerge—but where I see the most value and sustainability is with organizations like Rapid7 that can meet customers where they are—and grow with them.

When we think about our customers, particularly the CISO, their role has become increasingly challenging, and will continue to be so. Between an evolving threat landscape, a struggle to find talent for in-house security teams, and a volatile economic landscape that puts pressure on budgets—they need partners who can help them do more with less resources. At Rapid7, we’re making it everyone's mission to think about these customer challenges and ensure we’re bringing the best and most impactful solutions to the table so we can help customers build a more secure digital future.

Additionally, Rapid7 isn’t a one trick pony for a CISO. Our Account Executives can sell across the full platform of our offerings, enabling them to be a true partner to customers and add value based on their unique needs and challenges. When it comes to building a successful career in sales (and especially in building your personal brand), this is something that helps our reps deliver the utmost value to customers with solutions that can grow and scale with them.

Finally, Rapid7’s mission is inspiring. The need for our products is something that is never going to go away. All around the world, there are bad actors who are constantly trying to take advantage of individuals and businesses to make a quick profit. When you think of the impact a hacker or vulnerability can have, it’s everything from financial losses to entire infrastructure systems and communities getting disrupted. We’re giving organizations the tools and resources to protect themselves from the bad guys, and helping their security teams work more efficiently and keep their data—and more importantly, people, safe from harm.

What’s it like to lead a team at Rapid7?

As a leader, I’m excited for the opportunity to help mature my team and see them succeed. That’s always been a big motivator for me—and it still is today. As I’ve progressed through my career, I’d say it’s equally rewarding to see the growth and success of the business, and the impact we’re making on our customers.

Today, my motivation goes far beyond hitting our numbers and going to Club. Being part of a company that’s creating real impact every day, whether it’s through our products, our open source communities, or our work in public policy and governance, it’s fulfilling to be part of a journey that's being recognized and giving us a reputation in the market for being really innovative.

When people are proactively approaching you at a conference or a show, and commenting on the work Rapid7 is doing, it instills a lot of pride in your work and reminds you of how important our mission is. A company that gives you that kind of fulfillment, along with opportunities to grow, is the real difference between finding your next job and finding a career home.

What do you look for in an Account Executive?

What I look for is genuine curiosity, and the ability to critically think about challenges. I don’t need someone to tell me what they think I want to hear or give a generic answer. In order to uncover this in an interview, I’ll often share a real world situation and ask their opinion on how they would approach it. This gives me an opportunity to see what kind of follow up questions they have, how they think, and how they might approach challenges on the job. As far as their answer, I’m not looking for a right or wrong response, it’s more about learning how they think. Sometimes, I’ll even help coach or give the person feedback to help them understand the context or maybe frame it in a way they weren't thinking about originally. The candidates that stand out the most are the ones who are able to ask the right questions, can articulate their opinion, and who are also coachable and open to feedback. Knowledge of our products and industry can always be taught, but having the right mindset is critical to be able to help them grow and be successful in the role.

At Rapid7, when we say we are open to ideas and encourage people to challenge convention—we really do mean it, and we respect the different perspectives that are brought to the table. This kind of culture is what helps sustain the business and enables you to do some really cool things in your field.

Looking to find your career home as an Account Executive?

Explore what it’s like to work as part of our sales team here: https://careers.rapid7.com/sales

Rapid7 Data Engineers Inspire Future Tech Talent at Summer Search Career Fest

Posted 2 years ago by Rapid7

We are thrilled to share some exciting news from our data engineering team at Rapid7. Earlier this month, our very own data engineers had the honor of being panelists at the technology panel organized by Summer Search, a fantastic organization that our CEO, Corey Thomas, is on the Leadership Council for.

The event, known as the Summer Search Career Fest, aimed to empower and support 100-150 high school and college students from low-income backgrounds. It provided them with invaluable opportunities such as professional mentoring, summer experiences, and post-secondary support. Our team was elated to contribute to this inspiring initiative and connect with these talented young minds.

As panelists, we had the privilege of sharing our experiences, insights, and expertise in the field of data engineering. We discussed various topics related to technology, career paths, and the impact of data-driven decision-making. Our goal was to inspire these aspiring individuals and showcase the incredible possibilities that lie within the tech industry.

Being able to guide and mentor young talent aligns perfectly with our company values and our commitment to fostering growth within the community. We firmly believe that by investing in the next generation of professionals, we can collectively shape a brighter future.

We would like to express our heartfelt gratitude to Summer Search for organizing this remarkable event and for providing us with the opportunity to contribute. We would also like to extend our appreciation to Corey Thomas for his involvement in the Leadership Council, which made our participation possible.

We encourage all of you to join us in celebrating this achievement and the positive impact we are making together. Stay tuned for future updates on our community engagement initiatives and ways you can get involved.

Once again, thank you to everyone involved in making this event a success, and we look forward to continuing to make a difference in the lives of young talent within our community.

Healthcare Orgs: Do You Need an Outsourced SOC?

Posted 2 years ago by Rapid7

Gartner predicts that 50% of organizations will partner with an external MDR (Managed Detection and Response) service by 2025 for around-the-clock monitoring. What determines where healthcare organizations fall on that 50/50 split over using an outsourced SOC? It usually comes down to their ability to adapt to the current needs of the healthcare industry.

A growing demand for improved healthcare services means more healthcare providers are turning to the cloud. But for a world built on strict regulations and literal life-or-death situations, migrating too quickly to the cloud can be a serious challenge. When healthcare teams take on cloud adoption too fast, then run the risk of:

Accumulating cloud services that fall through security cracks—AKA shadow IT
Expanding their organization’s attack surface without a means of defense, opening up more opportunities for breaches and leaks

That’s where the help of an outsourced SOC comes in. With an extra team of experts on board, healthcare organizations can secure new ephemeral environments—without putting their security teams through resource strain or burnout.

Still, it can be tough for healthcare organizations to identify when it’s time to outsource, if ever at all. Here are some tell-tale signs that outsourcing a SOC and investing in managed services is the right call.

Your Teams Are Already Overwhelmed

While most healthcare organizations have a trusted team of a few security experts, they’re usually smaller than most security teams in tech enterprises, snappy startups, or other more cyber-savvy industries. That leads to a tricky cycle of needing to do more with fewer resources.

A day in the life of a security engineer in healthcare is marked by a seemingly endless game of catchup—one that doesn’t support speed, efficiency, or a successful migration to the cloud.

If your organization’s security teams are:

Struggling to find qualified talent
Overwhelmed by firefighting every single incident on their plate
Tired of combing through seas of alerts—some of which are false positives
Burned out by carrying out repetitive and mundane tasks that could be automated

You’re Super New to the Cloud

Healthcare security teams are typically IT or network pros who are well-acquainted and well-trained to defend traditional environments. However, there may be knowledge gaps when it comes to healthcare’s approach to cloud security. But with global cyber attacks on healthcare organizations rising 74% per week in 2022, security teams have no time to waste learning how to protect cloud environments.

Investing in the right education and training for healthcare’s traditional security pros simply takes time and effort that many organizations can’t afford to waste. But with an external SOC, security teams can:

Rely on cloud security experts to handle the trickiest parts of the process
Learn as they go with the guidance of seasoned professionals
Gain strategic guidance and insights to help take their security program to the next level

You’d Benefit From Automated Processes but Struggle To Implement Them

Automation is the key to boosting your cloud security program and iterating it at scale. For healthcare, automation provides the biggest benefit in ensuring that strict compliance regulations—like HIPAA—are met. That spells good news for stakeholders, who are typically most concerned with meeting standards and maintaining compliance.

With automation, security teams in healthcare can:

Configure guardrails ensuring new assets and environments adhere to regulations and compliance standards
Set up automated alerts that indicate when standards are not met

However, implementing automation, especially if your organization’s new at it, can seem like a hefty investment and a daunting task to accomplish. It’s time to enlist the help of an outsourced SOC if your security teams:

Have limited or no experience with automation
Are still manually handling a lot of rote but necessary tasks
Know where duties get repetitive but don’t know what to do about it

That way, external cyber experts can set up automated guardrails, teach your teams how they work, and eliminate tedious, manual work.

Next Steps With Outsourced SOCs

Organizations with limited resources and novice knowledge of the cloud can significantly benefit from teaming up with managed services. But in a sea of possible partners, knowing which experts to go with can be tough—especially when healthcare organizations have various security needs.

That’s why we built Managed Threat Complete, an always-on MDR with vulnerability management in a single subscription. Consolidate your investment in external SOCs by teaming up with our seasoned security pros today.

Learn More

For more information about healthcare cybersecurity, download our new ebook: In Healthcare (and Security) Early Detection is Key

In this eBook, you’ll learn:

The current state of threats in the healthcare industry
The top challenges in addressing those threats
How to overcome those challenges and implement defense strategies

Download it now!

The Velociraptor 2023 Annual Community Survey

Posted 2 years ago by Rapid7

By Dr. Mike Cohen & Carlos Canto

Velociraptor is an open-source project led and shaped by the community. Over the years, Velociraptor has become a real force in the field of DFIR, making it an obvious choice for many operational situations. Rapid7 is committed to continue making Velociraptor the premier open-source DFIR and security tool.

To learn more about how the tool is used in the community and what the community expectations are with regard to capabilities, features, and use cases the Velociraptor team distributed our first community survey in early 2023. We are using this information in order to shape future development direction, set priorities and develop our road map. We are grateful to the community members who took the time to respond.

As an open-source project, we depend on our community to contribute. There are many ways contributors can help the project, from developing code, to filing bugs, to improving documentation. One of the most important ways users can contribute is by providing valuable feedback through channels such as this survey, which helps to shape the future road map and new features.

We’re excited to share some of the responses we received in this blog post.

Who is the Velociraptor community?

Of the 213 survey respondents, the majority were analysts (57%) and managers (26%), indicating that most of the respondents are people who know and use Velociraptor frequently.

We also wanted to get a feel for the type of companies using Velociraptor. Users fell pretty evenly into company sizes, with about 30% of responses from small companies (less than 100 employees) and 20% of responses from very large companies of 10,000 employees or more.

These companies also came from a wide range of industries. While many were primarily in the information security fields such as managed security service providers (MSSPs), consultants, and cybersecurity businesses, we also saw a large number of responses from the government sector, the aerospace industries, education, banking/finance, healthcare, etc.

With such a wide range of users, we were interested in how often they use Velociraptor. About a third said they use Velociraptor frequently, another third use it occasionally, and the final third are in the process of evaluating and learning about the tool.

Velociraptor use cases

Velociraptor is a powerful tool with a wide feature set. We wanted to glimpse an idea of what features were most popular and how users prioritize these features. Specifically, we asked about the following main use cases:

Client monitoring and alerts (detection)
Velociraptor can collect client event queries focused on detection. This allows the client to autonomously monitor the endpoint and send back prioritized alerts when certain conditions are met.

→ 12% of users were actively using this feature to monitor endpoints.

Proactively hunting for indicators (threat intelligence)
Velociraptor’s unique ability to collect artifacts at scale from many systems can be combined with threat-intelligence information (such as hashes, etc.) to proactively hunt for compromises by known actors. This question was specifically related to hunting for threat-feed indicators, such as hashes, IP addresses, etc.

→ 16% of users were utilizing this feature.

Ongoing forwarding of events to another system
Velociraptor’s client monitoring queries can be used to simply forward events (such as ETW feeds).

→ 6% of users were utilizing this feature.

Collecting bulk files for analysis on another system (digital forensics)
Velociraptor can be used to collect bulk files from the endpoint for later analysis by other tools (for example, using the Windows.Collection.KapeFiles artifact).

→ 20% of users were using this feature regularly.

Parsing for indicators on the endpoint (digital forensics)
Velociraptor’s artifacts are used to directly parse files on the endpoint, quickly returning actionable high-value information without the need for lengthy post processing.

→ 21% of users use these types of queries.

Proactive hunting for indicators across many systems (incident response)
Velociraptor can hunt for artifacts from many endpoints at once.

→ 21% of users benefit from this capability.

We further asked for the relative importance of these features. Users most valued the ability to collect bulk files and hunt for artifacts across many systems, followed by the ability to directly parse artifacts on the endpoints.

Backwards compatibility

Some users deployed Velociraptor for limited-time engagements so they did not need backwards compatibility for stored data, as they wouldn’t be upgrading to major versions within the same deployment.

Other users required more stable data migration but were generally happy with removing backwards data compatibility, if necessary. For example, one response stated “I would rather you prioritize improvements over compatibility even if it breaks things.”

Another user explained: “In a typical Incident Response scenario, Digital Forensics data has a shelf life of a few weeks or months at best and I am comfortable with the convertibility and portability of much of the data that Velociraptor collects such that archival data can still be worked with even if newer versions of the server no longer support a deprecated format/archive. I think there will be workarounds if this becomes an issue for folks with mountains of legacy data that hasn’t been exported somewhere more meaningful for longer term storage and historical data analytic/intelligence purposes.”

Generally, most users indicated they rarely or never needed to go back to archived data and reanalyze.

Version compatibility

The Velociraptor support policy officially only supports clients and servers on the same release version. However, in reality it usually takes longer to upgrade clients than servers. While some users are able to upgrade clients promptly, many users estimate between 10-50% of deployed clients are a version (or more) older than the server. Therefore, the Velociraptor team needs to maintain some compatibility with older clients to allow time for users to upgrade their endpoints.

The offline collector

The offline collector gives users a way to use Velociraptor’s artifacts without needing to deploy a server. This feature is used exclusively by about 10% of users, while a further 30% of users employ it frequently.

Most users of the offline collection deploy it manually (50%). Deploying via another EDR tool or via Group Policy are also robust options. Some users have created custom wrappers to deploy the offline collector in the field. The offline collection supports directly uploading the collection to a cloud server using a number of methods.

The most popular upload method is to an AWS S3 bucket (30%) while the SFTP connector in the cloud or a custom SFTP server on a VM are also popular options (20% and 23%, respectively). Uploading directly to Google Cloud Storage is the least popular option at about 5%.

Manual copy methods were also popular, ranging from EDR-based copying to Zoom file copy.

Azure blob storage was a common request that Velociraptor currently does not support. Many responses indicate that SFTP is currently a workaround to the lack of direct Azure support. The Velociraptor team should prioritize supporting Azure blob storage.

Data analysis

Velociraptor supports collecting raw files (e.g. Event log files, $MFT etc.) for analysis in other tools. Alternatively, Velociraptor already contains extensive parsers for most forensic artifacts that can be used directly on the endpoint.

Most users do use the built-in forensic parsing and analysis artifacts (55%) but many users also collect raw files (e.g. via the Windows.Collection.KapeFiles artifact).

VQL artifacts

Velociraptor uses the Velociraptor Query Language to perform collections and analysis. The VQL is usually shared with the community via an artifact. Most users utilize the built-in artifacts as well as the artifact exchange. However, over 60% of users report they develop their own artifacts, as well. For those users who develop their own artifacts, we asked about limitations and difficulties in this process.

A common theme that arose was around debugging artifacts and the lack of a VQL debugger and better error reporting. Training and documentation were also pointed out as needing improvement. A suggestion was made to enhance documentation with more examples of how each VQL plugin can be used in practice.

In a related note, the Velociraptor team is running a training course at BlackHat 2023. Developers will impart detailed information on how to deploy Velociraptor and write effective custom VQL.

Role-based access controls

Velociraptor has a role-based access control (RBAC) mechanism where users can be assigned roles from administrator, to investigator, to read-only access provided by the reader role. Users generally found this feature useful—40% found it “moderately useful,” 20% “very useful” and 15% “extremely useful”.The main suggestions for improvements include:

Easier management through the GUI (as of version 0.6.8 all user ACLs are managed through the GUI)
Custom roles with more granular permissions
Better logging and auditing
The ability to allow a specific role to only run a pre-approved subset of artifacts
A way to only run signed/hashed VQL / prevent a malicious artifact being dropped on the server
Making it clearer what each permission grants the user

Multi-tenant support

Velociraptor offers a fully multi-tenanted mode, where organizations can be created or decommissioned quickly with minimal resource overhead. This feature is used by 25% of respondents, who are mainly consultants and service providers using it to support multiple customers. Some companies use multi-tenancy to separate different divisions or subsidiaries of the business.

Client monitoring and alerting

Velociraptor can run event queries on a client. These VQL queries run continuously and stream results to the server when certain conditions are met. Common use cases for these are to generate alerts and enhanced detection.

Some users deploy client monitoring artifacts frequently while others see it as an alternative to EDR tools, when these are available. The primary use-case breakdown was:

Detection (e.g. alert when an anomalous event occurs): 27% of users
Collection of client events (e.g. forward process event logs to an external system): 18% of users
Remediation (e.g. quarantine or remove files automatically): 15% of users

→ 30% of users do not use client monitoring at all.

The most common pain point with client monitoring is the lack of integrated alerting capability (an issue currently being worked on). Some useful feedback on this feature included:

Better support for integration with business tools (e.g., Teams, Slack, etc.)
Easier to manage event data
Not having to build a server side artifact for each client_event artifact
A dashboard that lists all alerts
An easier way to forward alerts based on severity
Lack of pre-built detection rules/packs—in other words, it would be easier to tune down, than to build up

The Quarantine feature

Velociraptor can quarantine an endpoint by collecting the Windows.Remediation.Quarantine artifact. This artifact tunes the firewall rules on the endpoint to block all external network communication while maintaining connectivity to the Velociraptor host. This allows for an endpoint to be isolated during investigation.

The feature is fairly popular—it was “sometimes used” by about 30% of users and “always used” by another 12%.

How is Velociraptor deployed?

Velociraptor is a very lightweight solution, typically taking a few minutes to provision a new deployment. For many of our users, Velociraptor is used in an incident response context on an as-needed basis (46%). Other users prefer a more permanent deployment (25%).

For larger environments, Velociraptor also supports multi-server configuration (13% of users), as well as the more traditional single-server deployment option (70% of users). While some users leverage very short-lived deployments of several days or less (13%), most users keep their deployment for several weeks (27%) to months or permanently (44%).

Velociraptor is designed to work efficiently with many endpoints. We recommend a maximum of 15-20k endpoints on a single server before switching to a multi-server architecture (although users reported success with larger deployment sizes on a single server). This level of performance is adequate in practice for the majority of users.

Many users run deployments of less than 250 endpoints (44%) while a further 40% of users deploy to less than 5,000 endpoints.

Approximately 10% of users have deployment sizes larger than 25,000 endpoints, with 2% of users over 100,000 endpoints.

Popular operating systems

Among Velociraptor’s supported operating systems, Windows 64-bit is the most popular (with 82% of users ranking it the most-deployed OS type), while Linux is the next most popular deployed endpoint OS. Mac is the third popular choice for Velociraptor’s users. Finally, 32-bit Windows systems are still prevalent, as well.

Resources and references

Velociraptor’s website at https://docs.velociraptor.app/ contains a wealth of reference material, training courses, and presentations. We also have an active YouTube channel with many instructional videos.

While some users ranked the website as “extremely useful” (25%), there is clearly room for improvement. 42% of users rated it as only “very useful” or “moderately useful” (28%).Suggestions for improvements included:

More in-depth YouTube videos breaking down the tool’s features with workflows
More detailed “how to” with practical examples
Improved documentation about functions and plugins, with a slightly more detailed explanation and a small example
Updates to the documentation to reflect the new versions and features

Testimonials

Finally, I wanted to share with you some of the testimonials that users wrote in the survey. We are humbled with the encouraging and positive words we read, and are excited to be making an impact on the DFIR field:

"I have to congratulate you and thank you for developing such an amazing tool. It’s the future of DFIR."
"Awesome product, can’t wait to use it in prod!"
"This is a game-changer for the DFIR industry. Keep up the great work."
"Keep the file system based backend, its simplicity makes chain of custody/court submissions possible."
"I thoroughly love Velociraptor. The team and community are absolutely fantastic. I would go as far as to say that Mike and Matthew Green are my favorite infosec gentlemen in the industry."
"Y’all are awesome. I feel like I was pretty critical, but that’s because this is an amazing software, and I want to see it continue to grow and improve."
"We have been deploying Velociraptor to client environments almost since it was released. Our DFIR business model is entirely centered around it and it works very well for us. It is a great solution that just keeps getting better and better."

Conclusions

This is our first Velociraptor community survey, and it has proven to be extremely useful. Since Velociraptor is a community-led, open-source project, we need an open feedback loop to our users. This helps us understand where things need improvement and which features should be prioritized.

At the same time, since Velociraptor is an open-source project, I hope this survey will inspire contributions from the community. We value all contributions, from code to documentation, testing, and bug reports.

Finally, for all of our US-based users, we hope to see you all in person this year at BlackHat 2023! Join us for an in-depth Velociraptor training and to geek out with VQL for 4 days, learning practical, actionable skills and supporting this open-source project.

Keep Digging!

Cloud Security Strategies for Manufacturing

Posted 2 years ago by Rapid7

Protecting production while supporting growing cloud initiatives

Cloud Security Strategies for Manufacturing

The manufacturing industry is in limbo as organizations shift to cloud services. Many organizations are transitioning services to the cloud, but the vast majority maintain hybrid network environments that lean heavily on on-prem elements. During the pandemic, some companies were forced to expand their cloud services quickly to keep up with an influx of end users accessing network services remotely. However, few manufacturers are really pursuing a cloud-first approach.

This leaves most manufacturing organizations struggling to address issues of visibility in their hybrid cloud environments. There's also a growing concern about compliance in the industry, with manufacturers setting internal standards to provide crucial oversight for themselves and their third-party partners. All of this is occurring during an industry-wide push to implement smart factory initiatives and a persistent IT/OT skills gap in manufacturing organizations.

An effective cloud security strategy is key for manufacturing companies. As they transition their services, implementing cloud security will ensure they're able to monitor their growing attack surfaces, establish the necessary auditing processes and assessments for compliance, and support smart factory initiatives.

Major challenges of cloud security in manufacturing

Ensuring consistent production is paramount for manufacturing organizations. Cloud security strategy for this industry enables hybrid networks to function without disruption, while still supporting developing compliance regulations and smart factory initiatives. Without an effective cloud security strategy, manufacturers jeopardize their entire hybrid network as well as the operational elements and software integral to their manufacturing processes. Let's look at a few of the obstacles keeping manufacturers from implementing an effective cloud security strategy.

Lack of visibility into the cloud

The manufacturing industry is unique in that organizations are not only monitoring an environment populated with their own cloud and on-prem elements, but they're also tasked with tracking the elements of the third-party vendors that they partner with. These additional endpoints increase the overall attack surface and can be tricky to secure.

Lack of visibility into the cloud applications and elements in a manufacturing company's network impacts root-cause analysis, anomaly detection, and the other processes that affect availability, performance, and security across the entire network.

Network disruptions often translate to supply chain issues that can affect production and availability. This ultimately translates to lost revenue and negatively impacts a manufacturer's brand reputation. In fact, in a Supply Chain Resilience Report, 16.7% of business owners reported a “severe loss of income” due to a supply chain disruption. The report also revealed that the average cost of a disruption was around $610,000 dollars. Cloud security strategy, then, should include visibility across the entire infrastructure as well as third-party dependencies and the necessary context to bring clarity to third-party risk.

Failure to achieve and maintain cloud compliance

Unlike other highly regulated industries like healthcare and financial services, manufacturing organizations don't have much external guidance when it comes to cloud compliance. In the absence of government regulation, manufacturing companies need a way to validate network configurations and changes in their cloud applications and infrastructure.

The lack of compliance standards for cloud applications prevents many manufacturers from properly deploying cloud-controlled elements, as well as detecting and remediating issues. This leads to system-wide vulnerabilities and greater exposure in the threat landscape. For example, without proper compliance standards in place, an organization may fail to update their service-level agreements (SLAs) or security patches in their cloud environments, which can be exploited by malicious threat actors.

Manufacturing organizations require a cloud security strategy that includes automated detection and remediation assistance, as well as support in adopting and implementing the few regulatory recommendations available, such as those set forth by the National Institute of Standards and Technology (NIST).

Inability to bridge the IT/OT knowledge gap

According to a Gartner survey, 64% of IT executives view talent shortages as the most significant barrier to adoption of emerging technologies. In the manufacturing industry, this translates specifically to a lack of IT/OT specialist knowledge on network teams.

IT/OT refers to the integration of information technology (IT) systems with operational technology (OT) systems. This particular combination of systems is used by manufacturing organizations to balance cloud network infrastructure that controls information and data with industrial equipment, assets, and processes.

Without specialist knowledge of these systems and how they interact, manufacturers struggle with IT and OT silos that lead to system disruption, downtime, and increased vulnerability. Manufacturers often misunderstand that OT systems are critical to their production process, but not necessarily the source of risk in their infrastructure. IT systems, however, may represent a smaller point of entry to their system, but pose a much larger risk as they connect to the larger OT systems. To combat this, manufacturers need a toolkit that will fill this skill gap on their teams, automate processes for increased efficiency, and consolidate data to break down silos between teams.

Where to start with a cloud security strategy in manufacturing

When looking to build a strong cloud security strategy, manufacturers should focus their efforts in the following areas:

Visibility
Compliance
Managed Services

Prioritize cloud visibility

Though the transition to cloud services is slower in the manufacturing industry, it is still an inevitability. Consequently, the best way for manufacturing organizations to adequately protect their cloud infrastructure, and by extension their overall environment, is to focus on visibility.

Visibility reduces risk and allows companies to effectively monitor their attack surfaces. This begins with manufacturers collecting monitoring data from across their cloud infrastructure. Drawing connections between the data, end-user experiences, and supply chain interaction can help manufacturers find weak or vulnerable points in their cloud infrastructure.

The right cloud security tools will help teams continuously monitor both public cloud and container environments. Manufacturers also need real-time visibility and context to find and fix issues quickly. InsightCloudSec offers all of these features and more to manufacturing companies—effectively eliminating network blind spots and giving teams the confidence they need to move forward with their cloud initiatives.

Consider cloud compliance solutions

Many manufacturers struggle with finding and adopting regulatory best practices in their cloud environments. While NIST offers guidance on network security, and the Center for Internet Security (CIS) offers frameworks and CIS Benchmarks, many manufacturers are unsure of which guidelines make the most sense for their organization's needs. Moreover, manufacturers need guidance on how to implement compliance monitoring, which ensures that their cloud elements are operating securely.

Without compliance, manufacturers are essentially managing their cloud environments in the dark, with little governance on how to deploy applications, configure their cloud environments, and update their elements. This can lead to lapsed security updates and serious vulnerabilities that increase risk across the entire infrastructure.

Enter cloud compliance solutions. These tools can enable manufacturing organizations to automate compliance monitoring and management. For example, InsightCloudSec checks an organization's multi-cloud environments against dozens of industry and regulatory best practices. Moreover, cloud compliance solutions enable manufacturers to customize external compliance checks to sync with internal compliance regulations. This eliminates frustration and false alarms.

Teams can also take advantage of InsightCloudSec's embedded automation, which automatically detects compliance drift and returns cloud environments to a secure state within 60 seconds.

Outsource with managed services

Manufacturing teams struggling to hire and retain skilled IT workers often find themselves with a gap in IT/OT oversight. This gap can result in greater silos between IT and OT teams, which can disrupt smart factory initiatives and the adoption of cloud services, and lead to increased unchecked system vulnerabilities.

After all, it's hard to contextualize risk without a complete understanding of IT/OT cloud elements and how risk in one arena affects the other. Instead of an organization redoubling their hiring efforts or overwhelming their existing team members, managed services allow manufacturers to effectively outsource this role and add a virtual IT/OT specialist to their team.

Rapid7's managed services team offers regular assessments, handles the operational requirements of incident detection and response, and performs vulnerability scanning. This frees up crucial time for IT/OT teams and streamlines the scanning and reporting process, which encourages greater collaboration. Contextualization, or the process of analyzing threats and gathering relevant supplemental information, is simple with Rapid7's InsightVM. InsightVM works in partnership with SCADAfence to assess vulnerabilities and leverage insight into OT networks to accurately prioritize risk.

The bottom line

Establishing cloud security strategies in manufacturing organizations often seems like an insurmountable task. Common struggles of visibility, compliance, and IT/OT knowledge gaps plague manufacturing companies who are transitioning to cloud services. This can lead to network blind spots, slowdowns, and increased risk.

Building a toolkit of cloud security solutions can help manufacturers reduce their overall risk in the cloud and optimize their performance by improving internal compliance. Making the most of this toolkit requires specialized knowledge, but leveraging managed services enables manufacturing organizations to streamline reporting and assessments without hiring additional in-house staff.

Manufacturing organizations are evolving to keep up with production demands, changing technology, and an ever-broadening threat landscape. By strengthening cloud security, manufacturing companies can focus on providing a superb product, assured that their cloud environment is secure. Get in touch with us to learn more about how Rapid7 is helping manufacturing companies navigate security during every phase of the cloud transition process.

Starting a Career in Tech? Learn How Rapid7’s Emerging Talent Programmes Foster Long-Term Success

Posted 2 years ago by Rapid7

Rapid7’s Emerging Talent Programmes pave the way for early career professionals to have a successful career in tech. In Belfast, we offer both an Apprentice Programme and a Placement Programme to support new talent coming into the tech field.

The Apprentice Programme is designed for individuals with established careers that want to pivot into the cybersecurity field. In our Placement Programme, students spend a full year working as a member of one of our teams while enrolled in university, gaining valuable experience working on real projects.

Cybersecurity is constantly evolving, and we work diligently to stay ahead of attackers and create a more secure digital future for all. Emerging Talent Programme participants bring fresh and valuable perspectives to our business and are equipped with the resources and opportunities to develop valuable industry knowledge and experience.

We spoke with several team members who went through these programmes and went on to pursue full time roles at Rapid7, and invited them to share their experiences.

What was the biggest hurdle you have had to overcome when starting your career?

When I joined Rapid7, I had no prior IT experience. My background was in mechanics. I was initially very nervous that my lack of IT experience would put me at a disadvantage. However, I was fortunate to be offered an opportunity with Rapid7 and Belfast Met. Rapid7 provided me with exceptional training and a support programme with ongoing mentoring. This ensured that I never felt left behind.

In the last 2 years working with Rapid7, my knowledge and skills have grown far beyond what I had ever hoped for. This is a testament to the talented individuals I work with and their willingness to share their expertise and help others.

Mark Gottschalk, Technical Support Engineer II

Coming from university and other experiences where I would have completed projects in smaller groups, understanding how information is stored and communicated across a large company and stakeholders took some time. I look at it as a valuable learning opportunity as you gain insight into how decisions are made in software companies and how stakeholders in all areas of Rapid7’s business interact with each other.

Christopher Jennings, Assistant Product Manager, Platform

How did you know you wanted to work at Rapid7?

I was interested in the culture at Rapid7 when looking for placement opportunities. The effort by the company to look after employee welfare was very attractive, and quite unique compared to other companies.

Kate Wilson, User Experience Designer I

My software engineering placement at Rapid7 was a pivotal experience in my career journey, as it helped me to determine my desired career path and confirm my interest in the company. Rapid7 impressed me with its position as a leader in the cybersecurity industry, as well as its ownership of the highly regarded tool, Metasploit.

The company’s focus on culture and values during the hiring process, and the positive experience I had with the people I met made a strong impression on me. These factors, combined with my passion for software engineering, led me to conclude that Rapid7 would be an ideal place for me to continue my professional development and pursue my career goals.

Jonathan Hume, Software Engineer I

How has this programme helped you determine your career path?

This placement programme has been instrumental in helping me determine my career path. I now have a better understanding of what product managers do and how different stakeholders within a software business interact to progress Rapid7 forward.

Christopher Jennings, Assistant Product Manager, Platform

The apprenticeship programme at Rapid7 has been a transformative experience for me. I have a strong interest in technology and a drive to learn and grow. I am surrounded by colleagues who are supportive and inclusive, and I have the opportunity to work on real-world projects that are challenging and rewarding. The programme provides a perfect balance between work and education, allowing me to complete my degree while gaining valuable experience.

Toni Ashe, Technical Support Engineer I

What has been your proudest accomplishment at Rapid7 so far?

My proudest accomplishment within Rapid7 has been the success of the Apprentice team I started with. At the end of our first year working within the Support team, we received the top three highest average customer survey ratings globally, as well as the top team globally. This was a moment of immense pride for all of us and serves as a testament to the effectiveness of the training and development programme for Support Engineers and the Apprenticeship programme!

Mark Gottschalk, Technical Support Engineer II, Support Coordinator Apprentice

My proudest accomplishment so far has been successfully completing my first coding project, which was a command palette modal that utilized hotkeys and other actions. Despite the challenges, I have worked hard and pushed myself to learn, and the reward of completing the project was worth all the effort.

Toni Ashe, Technical Support Engineer I

What piece of advice would you give someone entering a similar position?

I would advise anyone who is thinking about applying for an internship to be confident in their ability, ask lots of questions, and build a good knowledge base on the work and environment of the company and role you are applying to.

Kate Wilson, User Experience Designer I

For anyone considering a career move, my advice is: Take advantage of the opportunities for learning and growth, be open to feedback, and don't be afraid to ask questions. Pursuing a career in this field can be challenging, but the results are rewarding if you are passionate about technology and have a drive to constantly learn and grow.

Toni Ashe, Technical Support Engineer I

Looking for a place where you can gain hands-on experience and drive real impact? Explore all our Emerging Talent programmes and opportunities here.

Secrets of a cybersecurity employer-of-choice

Posted 2 years ago by Rapid7

By Jay Prescott, Director, Global SOC Operations

While the staffing crisis is real, our global MDR SOCs are thriving with top-notch analysts, DFIR talent, and no revolving doors (they like it here). In a high-pressure, high-stakes business, these are our lessons learned.

Measure your staffing performance meticulously and publicly

In an industry plagued by burnout, churn, and open jobs everywhere, be obsessed with your metrics to retain top talent. We do.

Last year, we grew our global Managed Detection and Response (MDR) teams by 68%
Our voluntary attrition for SOC analysts is under 5%
Since the start of Rapid7 MDR seven years ago, we've only lost about one to two analysts per year (as competition for cybersecurity talent went white-hot)

Rapid7 recruits talent from all over the world to join us in our state-of-the-art SOC locations. Each SOC has incredibly high retention rates.

We prioritize investments in training, competitive pay, project work and extracurricular activities, and ensuring analysts are doing the work they enjoy. The leadership team is in tune with job satisfaction and directly attacks any aspect of the analyst duties that causes friction.

Peter Drucker said it best: “Culture eats strategy for breakfast.”

According to a survey by Mimecast, 84% of security professionals are experiencing burnout due to the constant barrage of threats, the talent shortage, and other employees’ mistakes (as a result of burnout). And, while everyone battles “The Great Resignation” and our collective 5-year skills crisis, ZDNet reports it’s going to get worse. Nearly a third of the global cybersecurity workforce plans to leave the industry—not their jobs, but the entire industry—within two years.

To prevent burnout, we encourage a culture of friendship and after-hours socialization. People who work alongside friends help more and perform better. They trust one another. Like just about anyone in our line of work, Rapid7 MDR employees know they can go anywhere and do what they do. They also know we greatly appreciate the fact they choose to do it here.

A member of one of our SOC had his car in the shop for far too long due to a supply chain shortage of the missing part. There was only one thing to do for April Fool’s day:

As one member of the team stated, “we work at a place that crowdsourced a $700 prank!”

You don’t need budget for team-building consultants and “trust exercises.” Camaraderie is created in Slack channels and karaoke nights at the bar on the first floor of the Rapid7 Arlington , VA office.

Create a learning organization

We’ve heard it called “alphabet soup after your name.” While certifications are important, real-world experience and constant learning trumps a course any day of the week. And the best way for the SOC to learn? By doing first-hand and sharing those learnings with everyone. Here’s some of the lessons learned:

First, eliminate silos. Each of our MDR SOCs are composed of three tiers of analysts, working together on customer environments. There’s complete threat detection coverage, multiple layers of escalation and validation, and redundant knowledge. Additionally, the technology used by the SOC captures relevant details of the environment, detected threats, and analysis notes which are available to all analysts.

Second, train constantly. Rapid7 has a robust training program: a combination of external live training (SANS, Chris Sanders courses), self-paced learning (TCM malware analysis & forensics courses), as well as a robust internal security training program (modeled after specific incidents Rapid7 MDR has handled) to train our analysts quickly and effectively. All training is heavily focused on endpoint forensics, incident response, threat hunting, coding/scripting, and foundational security concepts. All analysts have the chance to attend external training every year. Internally, analysts learn from each other with weekly “lunch n’ learns” to level up their stills by learning from others around them and show off the latest threat they were able to thwart for our customers.

Third, we organized around learning in new ways. Over a year ago, Rapid7 merged our Incident Response Consulting Team with our MDR SOC to create an integrated team of Detection and Response experts. If an incident investigation appears to be major, analysts simply (and literally) swivel their chairs and tap Senior IR consultants and DFIR practitioners on the shoulder.

For major incidents, Rapid7’s TIDE Team (Threat Intelligence and Detections Engineering) is right there too. “We ride along with them and are watching what they're discovering and we develop new detections,” says Eoin Miller, Manager of Detection and Response Services. “It helps not only that customer but any other customer that may be a current or future victim of that same attacker.”

Rapid7 MDR also created a "Tactical Operations" (TacOps) team, which is primarily used as a “farm system” for analyst development. Typically, Associate Analysts at other Security Operation Centers are relegated to Tier 1 roles, focusing on low severity alert triage with little exposure to actual malicious activity or complex investigations. Rapid7 takes a different approach by throwing these Associate Analysts into the deep end to deal with real, high priority threats (the things we know are evil), which accelerates their learning curve. They’re actually looking at malicious activity all day, not just hundreds of benign alerts.

Our Associate level analysts have even gone on to publish their work and were tapped to lead a technical malware deep dive on one of the most popular security webinars in the world (Ultimate IT Security). Not too shabby for "entry level" folks to be presenting to a broad audience after only a year working in our SOC. Not surprisingly, we focus on promoting from within, with many analysts taking on advanced roles in forensic analysis and IR.

Finally, we’ve reorganized our services organization to bring our penetration testing team SOC analysts under one roof. We feel the best way to learn (and improve our ability to detect and respond effectively) is to encourage collaboration and knowledge sharing between both our offensive-minded and defensive-minded security practitioners. Iron sharpens iron.

Never compromise your standards

MDR analyst candidates go through an initial technical assessment (live on phone responses) with our Talent Acquisition partners in order to pre-screen candidates before the live technical interview panel.

During the interview Technical Panel, our interviewers' goal is to push the candidate to the edge of their knowledge. We ask a series of questions which are progressively more difficult using real-world scenarios: "If you see XYZ behavior, walk me through the process from start to finish:

What technology and methodology would you use?
What data are you looking for?
Deep dive into why and how you're looking at it?
How do you come to the determination that the behavior is malicious or benign?

This allows us to question various tools and techniques used in the course of an investigation. We then hire based on the candidate's knowledge, skill set, and culture fit.

More questions like these and other best practices we use can be found in our guide, the 13 Tips for Overcoming the Cybersecurity Talent Shortage.

Say what your values are

Rapid7 has company core values. We’ve added to it with our “Culture Code for the MDR SOC.” Every organization and each SOC’s values are different. These are ours:

Ownership: Know what you’re responsible for and own it. We expect you to own your mission fully. Don’t make excuses, and don’t point fingers at others.
Customer-Centric: We are here for one reason—to deliver the managed security services our customers expect and deserve.
Passion and Purpose: Love what you do. While not everything you do every day is exciting, our team members genuinely enjoy their work and understand the importance of it.
Don’t Just ‘Turn The Wheel’: We’re not here just to handle alerts, run scans, perform hunts, or throw alerts over the fence for our customers to handle. We’re here to bring our security expertise to bear in the most effective way to better protect our customers at scale.
Risk Taking: Choosing not to take a risk is often the biggest risk. We will never fault someone for taking a well informed risk in order to better serve our customers.
Integrity: We never mislead customers or prospects or act against their best interests, and we are open and honest with our fellow Moose.
Never Done: This is not a clock-in / clock-out kind of job. While many days are predictable, others are not. Our North Star is customer outcomes, not time-based.
Glass Half Full: Security operations can be unforgiving—but we will remain positive and optimistic.
Have Fun: Get your job done, but have fun doing it.

We’re always looking for great security professionals to join our team. If the above piques your interest and you’re looking to join a part of something special, come check out our open Career opportunities.

Automating Qakbot Detection at Scale With Velociraptor

Posted 2 years ago by Rapid7

By Matt Green, Principal Software Engineer

In this blog, you will learn a practical methodology to extract configuration data from recent Qakbot samples. I will provide some background on Qakbot, then walk through decode themes in an easy to visualize manner. Additionally, I'll share a Velociraptor artifact to detect and automate the decode process at scale.

QakBot or QBot, is a modular malware first observed in 2007 that has been historically known as a banking Trojan. Qakbot is used to steal credentials, financial, or other endpoint data, and in recent years, regularly a loader for other malware leading to hands-on-keyboard ransomware.

Malicious emails typically include a zipped attachment, LNK, Javascript, Documents, or an embedded executable. The example shown in this post was delivered by an email with an attached pdf file:

Qakbot has some notable defense evasion capabilities including:

Checking for Windows Defender sandbox and terminating on discovery.
Checking for the presence of running anti-virus or analysis tools, then modifying its later stage behavior for evasion.
Dynamic corruption of payload on startup and rewrite on system shutdown.

Due to the commodity nature of Qakbot delivery, capabilities, and end game, it is worth extracting configuration from observed samples to scope impact from a given campaign. Hunting enterprise-wide and finding a previously missed machine or discovering an ineffective control can prevent a domain-wide ransomware event or similar cyber attacks.

Configuration

Qakbot has an RC4 encoded configuration, located inside two resources of the unpacked payload binary. The decryption process has not changed significantly in recent times, but for some minor key changes. It uses a SHA1 of a hard coded key that can typically be extracted as an encoded string in the .data section of the payload binary. This key often remains static across campaigns, which can speed up analysis if we maintain a recent key list.

Current samples undergo two rounds of RC4 decryption with validation built in. The validation bytes dropped from the data for the second round.

After the first round:

The first 20 bytes in hex is for validation and is compared with the SHA1 of the remaining decoded data
Bytes [20:40] is the key used for the second round of decoding.
The Data to decode is byte [40:] onwards
The same validation process occurs for the second round decoded data
Verification = data[:20]
DecodedData = data[20:]

Campaign information is located inside the smaller resource where, after this decoding and verification process, data is clear text.

The larger resource stores Command and Control configuration. This is typically stored in netaddress format with varying separators. A common technique for finding the correct method is searching for common ports and separator patterns in the decoded data.

Encoded strings

Qakbot stores blobs of xor encoded strings inside the .data section of its payload binary. The current methodology is to extract blobs of key and data from the referenced key offset which similarly is reused across samples.

Current samples start at offset 0x50, with an xor key, followed by a separator of 0x0000 before encoded data. In recent samples, we have observed more than one string blob and these have occurred in the same format after the separator.

Next steps are splitting on separators, decode expected blob pairs and drop any non printable. Results are fairly obvious when decoding is successful as Qakbot produces clean strings. I typically have seen two well defined groups with strings aligning to Qakbot capabilities.

Payload

Qakbot samples are typically packed and need execution or manual unpacking to retrieve the payload for analysis. It's very difficult to obtain this payload remotely at scale, in practice the easiest way is to execute the sample in a VM or sandbox that enables extracting the payload with correct PE offsets.

When executing locally Qakbot typically injects its payload into a Windows process, and can be detected with yara targeting the process for an unbacked section with `PAGE_EXECUTE_READWRITE` protections.

Below, we have an example of running PE-Sieve / Hollows Hunter tool from Hasherezade. This helpful tool enables detection of several types of process injection, and the dumping of injected sections with appropriately aligned headers. In this case, the injected process is `wermgr.exe` but it's worth to note, depending on variant and process footprint, your injected process may vary.

Automation at scale

Now I have explained the decode process, time to enable both detection and decode automation in Velociraptor.

I have recently released Windows.Carving.Qakbot which leverages a PE dump capability in Velociraptor 0.6.8 to enable live memory analysis. The goal of the artifact was to automate my decoding workflow for a generic Qakbot parser and save time for a common analysis. I also wanted an easy to update parser to add additional keys or decode nuances when changes are discovered.

This artifact uses Yara to detect an injected Qakbot payload, then attempts to parse the payload configuration and strings. Some of the features in the artifact cover changes observed in the past in the decryption process to allow a simplified extraction workflow:

Automatic PE extraction and offset alignment for memory detections.
StringOffset: the offset of the string xor key and encoded strings is reused regularly.
PE resource type: the RC4 encoded configuration is typically inside 2 resources, I’ve observed BITMAP and RCDATA
Unescaped key string: this field is typically reused over samples.
Type of encoding: single or double, double being the more recent.
Hidden TargetBytes parameter to enable piping payload in for analysis.
Worker threads: for bulk analysis / research use cases.

Research

The Qakbot parser can also be leveraged for research and run bulk analysis. One caveat is the content requires payload files that have been dumped with offsets intact. This typically requires some post collection filtering or PE offset realignment but enables Velociraptor notebook to manipulate post processed data.

Some techniques I have used to bulk collect samples:

Sandbox with PE dumping features: api based collection
Virustotal search: crowdsourced_yara_rule:0083a00b09|win_qakbot_auto AND tag:pedll AND NOT tag:corrupt (not this will collect some broken payloads)

Some findings from a small data set ~60 samples:

Named campaigns are typically short and not longer than a few samples over a few days.
IP addresses are regularly reused and shared across campaigns
Most prevalent campaigns are “BB” and “obama” prefixed
Minor campaigns observed: “azd”, “tok” and “rds” with only one or two observed payload samples each.

Strings analysis can also provide insights to sample behavior over time to assist analysis. A great example is the adding to process name list for anti-analysis checks.

Conclusion

PE dumping, which is not available in expensive paid tools, is a useful capability and enables advanced capability at enterprise scale. For widespread threats like Qakbot, this kind of content can significantly improve response for blue teams, or even provide insights into threats when analyzed in bulk. In the coming months, we will be publishing a series of similar blog posts, offering a sneak peek at some of the types of memory analysis enabled by Velociraptor and incorporated into our training courses.

I also would like to thank Jakob Denlinger and James Dunne for their assistance in writing this post.

References

Malpedia, QakBot
Elastic, QBOT Malware Analysis
@hasherezade. Hollows Hunter, https://github.com/hasherezade/hollows_hunter

Anarchy in the UK? Not Quite: A look at the cyber health of the FTSE 350

Posted 2 years ago by Rapid7

The attack surface of the United Kingdom's 350 largest publicly traded companies has—drum roll, please—improved. But it could be better. Those are the high level findings of the latest in Rapid7's looks at the cybersecurity health of companies tied to some of the globe's largest stock indices. This is the second time in more than two years that we looked at the FTSE 350 to gauge how well the entire UK's business arena is faring against cyber threats. Turns out, they've improved in that time, and are on par with the other big indices we've looked at, though in some specific places, there is definitely room for improvement.

We chose the FTSE 350 as a benchmark in determining the cyber health of UK businesses because they are by and large some of the largest companies in the country and are not as resource constrained as some other, smaller, companies might be. This gives us a pretty even playing field on which to analyze their health and extrapolate out to the overall health of the region. We've done this with several other indices (most recently the ASX 200) and find it works well to provide a snapshot of what's going on in the region.

In this report, we looked first at the overall attack surface of the FTSE 350 companies, broken down by industry. We also looked at the overall health of their email and web server security. All three areas showed improvement, as well as points for concern.

Attack Surface

By and large, the attack surfaces of the companies that make up the FTSE 350 was quite limited and in line with other major indices around the world. But, when you look at the individual industries that make up the FTSE you start to see some red flags.

For instance, financial and technology companies have by far the largest vulnerability through high risk ports exposed to the internet. Technology companies averaged well over 1000 ports with internet exposure and financial companies averaged nearly 800. That is 4 and 5 times the next highest industry (respectively). When it comes to particularly high risk ports, the financial sector is the biggest offender with an average of 12 high risk ports. For comparison, the technology sector had three.

Email Security

Email security is one area where we've seen some laudable improvement over the last time we looked at the FTSE 350. For instance, use of Domain-based Message Authentication, Reporting & Conformance (DMARC) policy is up 29%. However, the implementation of Domain Name System Security Extensions (DNSSEC) is at just 4% of the 350 companies that make up the index. Sadly, this too is on par with other indices. They should all seek improvements (alright, we'll get off our soapbox).

Web Server Security

Going after vulnerable web servers is a favorite vector for attackers. When looking at the status of FTSE 350 company web servers we found that of the three most common types (NGinx, Apache, and IIS), not all were running high enough percentages of supported or fully patched versions. For instance, some 40% of NGinx servers were supported or fully patched, whereas 89% of Apache and 80% of IIS servers were. That's a pretty big discrepancy. Thankfully, Apache and IIS are the dominant servers in this region, minimizing the overall risk.

If you want to take a look at our report you can read it here. If you'd like to check out the report we conducted for Australia's ASX 200 it is available here.

7 Rapid Questions: Lindsey Searle

Posted 2 years ago by Rapid7

Welcome back to 7 Rapid Questions, our blog series where we ask passionate leaders at Rapid7 to give us an inside look at what it’s like to work on their team, and how they’re creating an impact every day.

In this installment, we talk to Lindsey Searle, Senior Manager, Customer Advisors on how her team helps solve customer challenges, and how candidates can stand out in the interview process.

What kind of challenges are you/your team responsible for solving for customers?

The security space is evolving every day as hackers continue to advance. Many customer teams find themselves overwhelmed and in need of more customized services to stay ahead, and that’s where we can help support.

Our team is the face of Rapid7 for Managed Services customers. We provide advisory services for clients of all shapes and sizes and at all levels of their security maturity journeys. The Customer Advisor team works closely with the Security Operations Center (SOC) to monitor customers’ in-scope environments and provide custom tailored guidance to enhance their security posture. Many of our customers consider us an extension of their in-house security team, and we strive to build close knit working relationships and trust with each and every one of them.

In addition to day to day monitoring, our Customer Advisors work with our clients to understand their security goals, make recommendations to achieve those goals, and are personally invested in seeing those initiatives through to completion.

What does your team look like (team size, types of teams etc.), what growth has there been?

The Customer Advisor organization at Rapid7 grew by 30% last year—we added 35 new people to the team in 2022, including Advisors at all levels, four new managers, and a Vice President.

Our team is composed of all levels of security professionals, from associate CAs at the start of their career to tenured Lead and Principal Advisors. We have CAs supporting all three branches of Managed Services, and our teams are blended across Managed Detection and Response (MDR), Managed Vulnerability Management (MVM), and Managed Application Security (MAS) to allow for cross functional collaboration and learning.

We are fortunately in a position where as our Managed Services business grows, our Customer Advisor team has continued to expand, as it is a standard part of the service offering.

What makes the culture at R7 different from other tech / cyber security companies?

I always find it difficult to describe the Rapid7 culture when I interview candidates because it’s something that you really have to see to understand and believe. The underlying fact is that all Rapid7 employees are passionate about security—we are here because we want to help our customers succeed, and we truly enjoy working together for that common goal.

At the same time, every single person is unapologetically unique and does not hesitate to bring their own perspective to the table. We have a great balance of external hires bringing in fresh ideas, as well as internal hires that provide a different approach to a situation when you’ve worked on the other side of the curtain.

What 3 biggest things have you learned in your time at Rapid7?

One: Take the time to thank people for helping you out! We do ‘guitar picks’ at Rapid7—it’s an internal website where you can give fellow moose a virtual kudos and recognition, whether it be for a great presentation they gave, or for filling in for you on an assignment, or for just being awesome. Everyone in the company can see it, and the recipient gets a notification that they’ve received one. Sending a pick takes minutes but can make someone’s day! Our Chief People Officer selects a guitar pick submission and sends it out to the whole company every morning. It’s a quick and meaningful way to thank those around us.

Two: Don’t be afraid to ask questions—we are all constantly learning and there is definitely someone out there who can help.

Three: There is a Slack emoji for just about every situation, and if it doesn’t exist—make one! In fact, our recent Slack migration took longer than expected due to the 10,000+ custom emojis that Rapid7 employees have created. One of our core values is ‘Bring You’ so this is just one example of how people are getting creative to express themselves in different ways and build camaraderie in a globally distributed organization.

How does Rapid7 set you up for success in your role?

I was incredibly impressed with the corporate onboarding provided by Rapid7 when I went through it myself in late 2021. You attend your onboarding sessions with all new hires starting at the company that week and already start to build a network within your first few hours here.

Rapid7 is big on encouraging Insight Coffees—an informal 30 minute meeting with another Rapid7 employee to get to know them on a personal and professional level. Those connections stick with you throughout your time here and only strengthen your ability to work together down the road.

Our company culture is built around helping each other and working together as a team, which puts you in a great spot to be successful in your role.

What can a candidate do to stand out in the interview process?

Honestly, just be yourself—Bring You is a core value at Rapid7 and something that truly sets us apart from other companies. Finding people who embrace our collaborative culture and partner well to share ideas is a major piece of the Rapid7 interview process. These soft skills weigh as heavily as prior work experience and technical competency. Your individuality will set you apart from other candidates—so let your true self shine!

What advice would you give someone thinking about coming to work here?

Bring energy and enthusiasm, and take the time to build meaningful relationships with the people you work with. It is much easier to wake up and log on for the day when you are looking forward to interacting with your team members and your customers. At Rapid7 we live by the core value of ‘Impact Together’—teamwork makes the dream work! We have a far greater chance at success when working together than we do when trying to climb the ladder individually.

To learn more about Rapid7 Managed Services:

CLICK HERE