In this episode of Security Nation, Jen and Tod chat with academics Omer Akgul and Richard Roberts about their recent paper, “Investigating Influencer VPN Ads on YouTube.” They talk about the over-promising and obfuscation that’s commonplace in advertisements for commercial VPN services on the video streaming platform and what these tactics reveal about communication around security tools and ideas to laypeople.
Stick around for our Rapid Rundown, where our hosts talk with Rapid7’s public policy guru Harley Geiger about the recent news that the US Department of Justice will stop prosecuting ethical hackers.
Omer Akgul
Omer Akgul is a fifth-year Computer Science Ph.D. student at the University of Maryland, College Park. Advised by Michelle Mazurek, Omer works on several human factors in security and privacy problems. Most recently, he has been investigating harmful mental models of secure communication tools. His research regularly appears in prominent security and privacy venues and can be found here.
Richard Roberts
Richard Roberts is a Ph.D. student at the University of Maryland studying computer science with Dr. Dave Levin. There is often a disconnect between technical specification and lay user perception. Richard is interested in how those cracks form, how they are leveraged by malicious actors, and how to design technical solutions that meet users where they are. Richard's other research interests include authentication and impersonation on the internet, measurements and unintended consequences of the web's PKI, and how security is depicted in media.
You can find links to his publications and more information about his work here.
Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like Apple Podcasts.
Want More Inspiring Stories From the Security Community?
In this episode of Security Nation, Jen and Tod sit down with Jim O’Gorman and Ben “g0tmi1k” Wilson of Offensive Security to chat about Kali Linux. They walk our hosts through the vision behind Kali and how they understand the uses, advantages, and challenges of open-source security tools.
Stick around for our Rapid Rundown, where producer Jesse joins Tod to talk about an upcoming change in security protocols across the internet that might make passwords obsolete (eventually).
Jim O’Gorman
Jim O’Gorman (Elwood) began his tech career as a network administrator with a particular talent for network intrusion simulation, digital investigations, and malware analysis. Jim started teaching for OffSec in 2009 as an instructor for the Penetration Testing with Kali (PWK) course — a role he still enjoys. He went on to co-author Metasploit: The Penetration Tester’s Guide and Kali Linux: Revealed, and has developed and curated a number of OffSec courses. As the Chief Content and Strategy officer, he currently oversees the open source Kali Linux development project and participates with OffSec’s Penetration Testing Team.
Ben “g0tmi1k” Wilson
Ben "g0tmi1k" Wilson has been in the information security world for nearly two decades. Since joining Offensive Security nine years ago, he has applied his experience in a number of roles including live instructor, content developer, and security administrator. He is currently managing the day-to-day activity as well as developing Kali Linux, pushing it forward. He has worked on various vulnerabilities, which are published on Exploit-DB that he also works on. Furthermore he created and still runs VulnHub, allowing for hands-on experience.
Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like Apple Podcasts.
Want More Inspiring Stories From the Security Community?
No one wants their company to be named in the latest headline-grabbing data breach. Luckily, there are steps you can take to keep your organization from becoming another security incident statistic — chief among them, avoiding misconfigurations in the cloud.
Our 2022 Cloud Misconfigurations Report found some key commonalities across publicly reported data exposure incidents last year. Check out some of the highlights here, in our latest infographic.
Want to learn more about the cloud misconfigurations and breaches that happened last year? Check out the full 2022 Cloud Misconfigurations Report.
In this episode of Security Nation, Jen and Tod chat with Whitney Merrill, Data Protection Officer at Asana, about her work on the Crypto & Privacy Village and data privacy more broadly. She talks about how she keeps up with both the excitement and the effort of running the village, a mainstay at DEF CON each year – including the curveballs thrown by COVID-19. Whitney also takes Jen and Tod’s questions about the major data privacy topics of the day, touching on everything from vaccine passports to new legislation in California, targeted advertising, and the overlap between security and privacy.
Stick around for our Rapid Rundown, where Tod and Jen talk about psychic signatures in Java – which doesn’t involve ghosts, but does involve Dr. Who.
Whitney Merrill
Whitney Merrill is Asana's Data Protection Officer and heads up the growing privacy team. Previously she was Privacy, eCommerce & Consumer Protection Counsel at Electronic Arts (EA) and an attorney at the Federal Trade Commission. In her spare time, she runs the Crypto & Privacy Village, a nonprofit, which appears at DEF CON & BSidesSF each year.
Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like Apple Podcasts.
Want More Inspiring Stories From the Security Community?
In this episode of Security Nation, Jen and Tod chat with Kate Stewart, VP of Dependable Embedded Systems at the Linux Foundation, about the open-source security projects she’s working on, including the Zephyr project. They chat about strategies for dealing with bugs and vulnerabilities in today's complex tech landscape, including the much talked-about software bill of materials (SBOM), so we can reap the benefits of open source while avoiding the downsides as much as possible.
Stick around for our Rapid Rundown, where Tod and Jen talk about a recent piece of news in the open-source community: A developer used the “event-source-polyfill” npm package to write a piece of “protestware” decrying Russia’s aggression in Ukraine. They also pay homage to healthcare cybersecurity stalwart Mike Murray, who recently passed away.
Kate Stewart
Kate Stewart works with the safety, security, and license compliance communities to advance the adoption of best practices into embedded open-source projects. With over 30 years of experience in the software industry, she has held a variety of roles and worked as a developer in Canada, Australia, and the US and for the last 20 years has managed international software development teams and activities. Kate was one of the founders of SPDX and is currently the specification coordinator. She is also the co-lead for the NTIA SBOM formats and tooling working group. Since joining The Linux Foundation, she has launched the ELISA and Zephyr Projects among others, as well as supporting other embedded projects.
Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like Apple Podcasts.
Want More Inspiring Stories From the Security Community?
Welcome back to 7 Rapid Questions, our blog series where we ask passionate leaders at Rapid7 how they’re challenging convention and making an impact. In this installment, we talk to Adrian Stewart, a product manager working on InsightAppSec, Rapid7’s dynamic application security testing (DAST) tool.
Adrian Stewart, Lead Product Manager, VRM - Belfast
How have you grown professionally since joining Rapid7?
The majority of my career has been as an individual contributor, which is where I’ve felt most comfortable. I’m now becoming more involved with the people management side, and at Rapid7, I’ve been lucky enough to work for some amazing leaders. I’ve really learned a lot, and Rapid7 as an organization has also been incredibly proactive for my career progression and continued learning.
What 3 words would you use to describe the culture at Rapid7?
Inclusive, supportive, and surprising. Every organization should strive to be inclusive and supportive, but Rapid7 nails it. Whatever is happening in your day to day, whatever inevitable misunderstandings occur when communication might not be optimal, Rapid7 and the herd have your back, always and without question. I’ve been around long enough to know this is the exception, not the rule. My expectations are constantly exceeded when Rapid7 puts the herd first.
What advice would you give a candidate to stand out in the interview process?
Know your audience. Research on the company executives, products, and locations is a start but not what makes Rapid7 an amazing place to work. Look at the Rapid7 core values and ask how your own values align, because that is where the win-win will come from.
When (or where) are you most productive?
In the office, without a doubt. One chat is worth a thousand Slack conversations.
Which of our core values do you embody the most?
Challenge Convention is the most obvious one. I am constantly asking, “Why is it like this, and how could it be better?” The key is to take a breath and listen to the answers.
What is it that makes cybersecurity such an exciting field?
There are a couple of things to call out, the first being the steep learning curve. It’s impossible to stagnate or become bored as the world realizes why cybersecurity is actually important. The second is, we actually help people. I don’t do this job purely for altruism – I do get paid as well – but knowing that helping our customers protect themselves and their customers is incredibly important for me as a person.
What did you want to be when you grew up?
A pilot, but my colorblindness put paid to that. Weirdly, believe it or not, my second choice was programmer, which was almost as unlikely as pilot because this was in the pre-internet days.
Want to join Adrian and his team? We're hiring! Browse our open roles at Rapid7 here.
We have been continuously monitoring for Spring4Shell exploit attempts in our environment and have been urgently investigating the implications for our corporate and production systems. We are actively remediating vulnerabilities as we find them and monitoring for any anomalous activity in our environment.
We will update this page as we learn more. At this time, customers do not need to take any action.
Further reading and recommendations
Our Emergent Threat Response team has put together a detailed blog post with general guidance about how to mitigate and remediate Spring4Shell. We will continue updating that post as we learn more about Spring4Shell and new remediation and mitigation approaches.
NEVER MISS A BLOG
Get the latest stories, expertise, and news about security today.
In this episode of Security Nation, Jen and Tod chat with David Rogers, CEO at Copper Horse Ltd., about the Product Security and Telecommunications Infrastructure (PSTI) bill, a new piece of IoT security legislation in the UK. He runs through the new regulations that the bill includes for manufacturers of connected smart devices – including everything from home products to health devices – and details all the many steps it takes to get legislation like this signed into law.
Stick around for our Rapid Rundown, where Tod and Jen talk about the latest edition of Rapid7’s Vulnerability Intelligence Report, which covers all the need-to-know vulnerabilities from 2021, a year that began with SolarWinds and ended with Log4j (i.e. a VERY busy year for this sort of thing).
David Rogers
David is a mobile phone and IoT security specialist who runs Copper Horse Ltd, a software and security company based in Windsor, UK. His company is currently focusing on product security for the Internet of Things, as well as future automotive cybersecurity.
David chairs the Fraud and Security Group at the GSMA and sits on the Executive Board of the Internet of Things Security Foundation. He authored the UK’s Code of Practice for Consumer IoT Security, in collaboration with UK government and industry colleagues, and is a member of the UK’s Telecoms Supply Chain Diversification Advisory Council.
He has worked in the mobile industry for over 20 years in security and engineering roles. Prior to this, he worked in the semiconductor industry. David holds an MSc in Software Engineering from the University of Oxford and a HND in Mechatronics from the University of Teesside. He lectured in Mobile Systems Security at the University of Oxford from 2012-2019 and served as a Visiting Professor in Cyber Security and Digital Forensics at York St John University.
He was awarded an MBE for services to Cyber Security in the Queen’s Birthday Honours 2019.
Listen to Caitlin Condon, lead author of the report, on Duo’s Decipher podcast.Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like Apple Podcasts.
Want More Inspiring Stories From the Security Community?
It’s with immense pleasure that we announce today the winners of the Rapid7 Partner of the Year Awards 2022. All our category winners have achieved exceptional growth, demonstrating dedication and collaboration to the Rapid7 Partner Program throughout the year.
We’re very proud to share our complete list of winners. Please join us in congratulating them all.
APAC Awards
Rapid7 APAC Partner of the Year: Cythera Pty Ltd
APAC Distributor of the Year: Netpoleon Solutions Pte Ltd
APAC Emerging Partner of the Year: Murdoch Webster Technology Group Pty Ltd
APAC Fastest Growth Partner of the Year: Blue Apache Information Systems
APAC Best Customer Retention of the Year: Content Security Pty Ltd
APAC Detection & Response Partner of the Year: DGplex Pty Ltd
APAC Vulnerability Management Partner of the Year: The Missing Link
EMEA Awards
EMEA Partner of the Year: Softcat Plc
EMEA Distributor of the Year: Infinigate Deutschland GmbH
EMEA Emerging Partner of the Year: Telonic GmbH
EMEA Fastest Growth Partner of the Year: Caretower Limited
EMEA Best Customer Retention of the Year: Saepio Solutions Ltd
EMEA MSSP Partner of the Year: Tesorion
EMEA Detection & Response Partner of the Year: Orange CyberDefense
EMEA Threat Intelligence Partner of the Year: Sorint.SEC
EMEA Vulnerability Management Partner of the Year: Tieto
North America Awards
Rapid7 North America Partner of the Year: SHI International Corp.
North America Distribution Partner of the Year: Liquid PC
North America Emerging Partner of the Year: AccessIT Group, Inc.
“We are pleased to be recognized as North America Emerging Partner of the Year, and we value our evolving partnership with Rapid7,'' said Bob Reilly, Vice President of Sales at AccessIT Group. "Rapid7 is a great partner that allows us to deliver shared visibility, analytics, and automation to unite our customers' security, IT, and DevOps teams."
North America Fastest Growth Partner of the Year: CDW Corporation
North America Best Customer Retention of the Year: Carahsoft Technology Corp.
“We are pleased to be recognized as the 2022 North America Best Customer Retention Partner,” said Alex Whitworth, Sales Director, who leads the Rapid7 Team at Carahsoft. “Carahsoft and our reseller partners enable customers to unlock more value from their Rapid7 investments through our proactive customer onboarding, nurture, and support process. We combine dedicated Rapid7 expertise, customer success technology and automation, and a constant communication approach to build valuable relationships with customers. We thank Rapid7 and our reseller partners for this amazing award.”
North America MSSP Partner of the Year: RKON Technologies
“RKON is honored and grateful to receive the MSSP of the Year for North America award from Rapid7. This award is a testament that the RKON and Rapid7 teams’ shared vision, strong working partnership, and endless determination have been fruitful in driving aggressive growth and adding value to our client’s security programs.”
- Chris Hueneke, Chief Information Security Officer at RKON Technologies
North America Detection & Response Partner of the Year: CyberWatch Systems
North America Threat Intelligence Partner of the Year: Deepwatch, Inc.
North America Vulnerability Management Partner of the Year: GuidePoint Security LLC
North America AppSec Partner of the Year: GuidePoint Security LLC
North America Cloud Security Partner of the Year: SHI International Corp.
Rapid7 Canadian Partner of the Year: Forecight
“This is a big honor for our entire team, who supported the company to attain its overwhelming success over the past few years. Our mutual achievements are truly a testament to our partnership and our ability to work together to give our clients the best cybersecurity solutions. We look forward to continuing our robust and fruitful partnership with Rapid7.”
- Arezou Marzara, LL.M., Director, Strategy & Operations at Forecight
Congratulations again to all our winners!
More about our partner program
The Rapid7 PACT Program is built to inspire our partners to grow with us and achieve mutual success through accountability, consistency, and transparency. By participating in the program, partners can offer powerful, industry-leading solutions to our joint customers, resulting in mutual success for all. If you’re interested in becoming a Rapid7 partner, you can learn more here.
NEVER MISS A BLOG
Get the latest stories, expertise, and news about security today.
During Women’s History Month, we invited some of our team members to share their best advice for other women in technology, celebrate their strengths, and reflect on how they’ve challenged convention within their roles and built their networks.
What is the best advice that someone has given you in your career?
Nino Nardize, Director, Technical Customer Success: One piece of advice that resonated with me early on was that you have to be comfortable making decisions with only 80% of the information available. That stuck with me because I think, as women, sometimes we feel we need to have all of the information, be 100% qualified for a role, or be able to achieve perfection. In reality, things don’t always work out that way. I’ve found it’s important to ask ourselves, “Have we done our best to gather the right information in relation to this decision?” Even if that means we still have things outstanding, that’s OK. We have to be comfortable with taking risks and feeling good about moving forward with what we have in front of us.
Jane Man, Director, Product Management - VRM: The most important advice I got early on was to be open and always look for opportunities to grow. If you are at a point in your career where you think to yourself, “I’ve got this,” and you know exactly what you are doing every day, you probably aren’t being challenged enough. This perspective has always pushed me to look for areas where I don’t feel comfortable and to seek out areas to grow my career — and myself as a person.
Jessica Reinne, Account Executive, Large: As a sales executive, the best advice I received was that buying is emotional, and people buy products most often from people they trust and have a relationship with. I’ve found firsthand that once you establish that rapport, people will want to engage with you and either communicate what they need in order to move forward or — just as valuable — tell you why they aren’t moving forward or why something isn’t actually working. When you have that open dialogue, you can really be a better partner to them, versus trying to sell them something they aren’t bought into.
Noreen Camelo, VP Enterprise Applications: One piece of advice I heard was to be brave, be brilliant, but be brief. I think this is important because sometimes we can get caught up in explaining our ideas or spend too much time setting the stage. As you progress in your career and are working with executives, it’s important that your key message comes across very clearly, as everyone is pressed for time. Be brave and speak up when you see opportunities, be brilliant and always keep challenging convention, but be brief and make sure to get your thoughts across in a succinct way.
Sarah Sidford, Manager, Commercial Sales: In life, and especially for women, it sometimes can feel like you’re trying to juggle a bunch of different balls in the air. You have your career as one ball, your travel plans as another, your family as another, your social life, and so on. It’s important to remember that most of those balls are rubber, if you drop them, they will bounce right back and be OK. But family and health are two that are glass — and you can never, ever drop them. Keeping perspective about what’s really important with a focus on family and health being most important can help you prioritize and know when you need to let go of another one of those rubber balls.
Paola Chadwell, VP, Customer Success Management: Always advocate for yourself — especially when negotiating your salary. I think, as women, we hesitate to ask for more because we’re afraid we will lose the offer that’s already on the table. In reality, the worst someone can say is no, or maybe they don’t go as high as you ask but are able to meet you in the middle somewhere. I’ve negotiated every salary throughout my career, and I think it’s helped me to own my voice and advocate for my worth.
Turning that around, what advice would you give to women who are early in their career and looking to challenge convention?
Jane Man: I would say to be confident in your own voice. At the end of the day, the goal is to create a better solution and work more effectively, and that means that when you have something to add, it’s your responsibility to speak up and you shouldn’t be afraid to do that — because it makes all of us better and stronger.
Paola Chadwell: When I was younger, I moved around a lot. The process of putting myself out there and making friends throughout childhood has translated into my ability to build strong relationships in my career. I’m in customer success, so I have to not only build strong relationships with our customers, but I also be able to have internal and cross-functional relationships so that I can be a better advocate for our customer needs and deliver the right solutions for their needs.
Nino Nardize: In the workplace, there are a number of different ways that each individual can contribute at a given time. Whether it’s in meetings or through a one-to-one conversation, each person’s ability to influence others can be a little bit different. Find where you are most comfortable and can create impact in a meaningful way and lean into that — don’t fight it to be something you are not.
How are you challenging convention in your role at Rapid7?
Sarah Sidford: I think one way that I challenge convention is that I am very vocal about the need to hire more women in sales. There are still so many double standards for women in sales — we might describe a male as being assertive and have a positive association with that behavior, but when a woman is assertive, we’re quick to judge her as being pushy. The more we can prioritize diversifying our teams, the more we can start to challenge these stereotypes. I think a lot of times, people hire people who remind them of themselves — so if we have more men in leadership positions doing the hiring, how does it hurt those efforts if they are carrying that internal bias? I’m working closely with our talent acquisition team to really change the traditional landscape of sales and prioritize bringing a more balanced workforce into the field.
Jessica Rennie: I’m someone who is really open-minded and willing to try new things. One example is that when I joined the company, I saw an opportunity and went out on a limb to create a new program. At first, it can be challenging to get something like this that is new up and running, but we were able to create this network of give and get with our prospects that has ultimately benefited our business and our sales organization. It was great to be able to formulate a vision and strategy and be supported along the way by my manager and peers.
Nino Nardize: I challenge convention by encouraging different perspectives. Diversity of thought and experiences is a crucial component to any team. I can only be one voice, and my voice is reflective of my own personal journey. Whenever we are having a crucial conversation, we need to have the representation of multiple perspectives in order to make educated decisions. Asking ourselves, “What else are we missing? Are there too many voices from one business group and not enough from another?” can lead to a better decision and product in the end.
What strengths do you believe your identity and personal experiences bring to your role?
Jane Man: I come from an immigrant family. My parents immigrated from the big city of Hong Kong to the tiny island nation of New Zealand. Through my experiences, I’ve become interested in what makes people think a certain way, and I often find myself asking questions that dig into what we are doing and the purpose or “why'' behind it. That natural curiosity is something that comes from being part of that small island community.
Jessica Reinne: I didn’t come from a cybersecurity background prior to Rapid7, but I was in the startup world. Some of the places I worked earlier in my career were so new that on some days the heat didn’t even work or the lights wouldn’t turn on — so I experienced the early growth grind that happens in the technology world where you have this pressure to prove yourself and everyone’s work has such a direct impact on the company. I developed almost this chip on my shoulder where I really want to push myself and always have that grit and determination. Doing it at Rapid7, where we are so established and have not only a great team and product but great amenities and support systems, really just puts it on a whole new level.
Noreen Camelo: I bring a lot of optimism to my team, and I think some of that comes from my past roles and being able to put things into perspective. Earlier in my career I worked in Oncology, so there was a lot of pressure around our decisions because of the impact it had on patients’ lives. When we feel stressed out or a task seems too big for us to tackle, I try to help my team keep things in perspective so they can prioritize, while encouraging them to find creative solutions. I really do believe that there is no challenge we cannot solve as long as we are willing to take the right amount of time and work together.
It’s often said that an important part of being successful is building a supportive network around you. How have you built your own personal network, and how has it helped you be successful?
Paola Chadwell: I think, first off, women sometimes have a tendency to look at other women as competition rather than allies. That’s not a mindset I ever want to have or that I want to encourage people to challenge, because we all have so much to add and to contribute to one another. I’ve been so lucky to have been surrounded by such strong and powerful women at Rapid7 and at previous companies. I’ve been monitored by them and have also been able to be a mentor to them at times. The beautiful thing about building a network and having a mentor is that it becomes a two-way street. We have so much to learn from one another and can really help each other grow.
Noreen Camelo: I’ve built my network through the different roles and companies I’ve been at. It’s been a proactive experience of reaching out and staying in touch, and the result is a diverse network of people to lean on where we can all give guidance to each other at different points. What I’ve experienced is that your network is a huge part of advancing your career, as well as rounding you out as the leader you are.
Sarah Sidford: I’m grateful to have been able to create such a great network of women around me. In sales, it’s important to have relationships where you can be honest about what you’re going through and can talk about when you are having a hard day or when things are also going well. As women, we don’t want to share our struggles and appear weak, but then at the same time, you don’t want to celebrate or you will be seen as braggadocious — so you need to have a safe space to share that vulnerability and the highs and the lows, especially when it’s people who have also been through it and who can share their experiences with you, too. Whether it’s asking about what to wear to a client onsite or working through a unique challenge with a customer, having that safe space can help you feel so much more prepared and empowered. As a leader, that’s the kind of space I want to create with my team.
Want join our team? We're hiring! Browse our open roles at Rapid7 here.