Post Syndicated from Rapid7 original https://blog.rapid7.com/2023/12/05/a-trusted-voice-in-a-crowded-market-meet-joanne-guariglia-senior-channel-account-manager-at-rapid7/

When you’re a seller, it’s important to represent a reputable brand and products you can stand behind. For many companies, their partners act as an extension of the sales team to help identify and engage new customers. As a Senior Channel Account Manager, Joanne Guariglia shares what she loves most about her role, Rapid7, and why now is a great time to join the team.

What is it that initially attracted you to Rapid7?

In my previous role, I was with a company that had an integration with Rapid7 so I had been working in tandem with some of the leadership team. They were always down to earth, very genuine,open and honest about the great things happening, and what some of the challenges were. My partners also enjoyed working with the Rapid7 team and I could see they were making waves in the partner community.

Aside from that, Rapid7 is not just a single solution. Our products can meet customers where they are in their security journey, and grow and scale with them. So having that ability to grow alongside customers was something that I was really interested in.

Would you say a cybersecurity background is required for your role? What skills or knowledge is most important?

I wouldn’t necessarily say a cyber background is a must have before joining Rapid7. We have a comprehensive onboarding program that can help give you a strong foundation in cyber security knowledge as well as our products and services. What’s most important is your ability to grow relationships with our partners and to bring the best technology and solutions to the customer. This is a role where you have to be an effective communicator and a bridge between cross functional teams including Sales, Marketing, Customer Success, Sales Operations, Finance, and the Renewals team to make sure we are aligned on business decisions moving forward. Having that collaboration between teams and knowing we are all working towards the same goal has been really rewarding.

What does the cybersecurity landscape look like, and how does Rapid7 differentiate itself from competitors?

When it comes to the landscape, cyber criminals are always evolving their tactics and continue to increase efforts against businesses of all sizes. Security is not a ‘nice to have’; It’s  a priority for all businesses and industries, so it’s a field that’s very stable and always growing.

Cybersecurity can also be challenging because it is a crowded market but where Rapid7 has a competitive advantage is in consolidation. Our customers don’t have to work with multiple vendors to satisfy all aspects of their security needs, we can consolidate multiple products and offerings into one cost with one vendor. We’ve come a long way in growing our portfolio and responding to the customers needs, and we are well positioned to continue that growth into 2024 and beyond.

What do you find most rewarding about your role?

What I enjoy most is being able to build lasting relationships with our partners. Partners want to work with trusted brands that are leaders in the space and we have that here at Rapid7. Being that trusted voice and growing the relationship, while educating them about our offerings, enables me to have a positive impact.

Another thing I find rewarding is the ability to create change and outcomes that our partners find valuable. We are a large company, but we are still agile enough to pivot when needed and our culture is one that is supportive of asking questions and sharing new ideas that we can bring to fruition.

What are you most excited for in 2024?

2024 is exciting because our channel team is at the forefront of impacting growth across the organization. We are investing heavily in our partnerships and partner programs, and are making strides with the channel community more than ever. Our company strategy and goals are really clear, and we’re all excited to execute and drive positive impact for the business.

With incredible product offerings and an opportunity to foster and grow partner relationships, there is no better time to be a part of this journey. 2024 is going to be a huge year for us!

Interested in learning more about working for Rapid7? Click here for our careers page, or view all open sales opportunities.

Post Syndicated from Rapid7 original https://blog.rapid7.com/2023/11/27/building-our-team-in-prague-meet-martin-votruba/

From developing driver-assistance software for a luxury car brand to jumping on board an NFT startup, Martin Votruba, Lead Software Engineer, is not one to shy away from a challenge. In September of 2023, joined Rapid7 as the first hire in its new Prague office. Martin is leveraging Rapid7’s excitement and energy of a startup while having the resources and support of an established organization to build a new team in Prague. He sat down to share his experience as one of the first employees in Prague, and discuss how Rapid7’s culture of collaboration and continuous learning helped him build a successful foundation on which to grow his team.

How have your past experiences contributed to how you approach your role today?

At Rapid7, my team’s job is to search for reported vulnerabilities and communicate those within our product (InsightVM) so that our customers can determine whether or not they are at risk. With different software vulnerabilities, each case is unique. This makes our job different from traditional engineering where you follow one recipe or code path and deploy it. I’m constantly drawing inspiration from past challenges and experiences to think about how to approach each new case here. I enjoy the opportunity to be creative in identifying solutions and helping our product deliver the best outcomes to our customers.

What was it that initially attracted you to Rapid7?

To be honest, I had never heard of the company before. It was exciting to see that it was starting a new office in Prague, while also having an established team globally to collaborate and partner with. I was looking for an opportunity to grow and learn from others and was interested in a global company. Being able to maintain the excitement and energy of a startup environment by being part of a new office is a unique opportunity. It also is a really fun environment building its own organic culture as new people are excited about working for Rapid7 and joining us every week.

What is something you didn’t realize or expect about Rapid7’s culture?

As far as culture, it was a nice surprise to see that even though Rapid7 is a global company and has larger structures in place, it isn’t so rigid that you are bogged down by processes or unable to feel you are  making an impact. For example, right after I joined I had an opportunity to be a part of the interview team for some new roles. I was given that trust automatically to help shape what the office looks like and who we are bringing on board.

Another thing that may be surprising to a lot of people is that even though we are a cybersecurity company, you don’t have to be a cybersecurity expert to have a successful career here. I’m still a software engineer – not a cybersecurity expert (although I’ve learned a lot). What I’m responsible for is still core to my expertise as an engineer, I’m just working within a domain and product that happens to be cybersecurity.

How have you been able to build relationships as a new employee?

We have a really interesting program called “Insight Coffee” that encourages people from around the company to set up 1:1s and get to know one another. There’s no agenda, and it’s truly just to learn about another person’s background, experience, or role. The program opens the door for you to reach out and form relationships in a way that is really approachable and encouraged. If I know I’m going to be working closely with someone on a different team, I’ll set up a quick Insight Coffee to get to know them before diving into a project. That way, when we are working together, it helps open up that avenue of communication and understanding, making the entire process or project run more smoothly.

What was your interview experience like?

After talking with the recruiter about the opportunity, my interview consisted of a call with the Hiring Manager, an interview where we talked about the role and Rapid7’s culture, and a technical challenge. The technical challenge was interesting, and is designed to see how you approach solving a specific problem. Even though I was being assessed on my skills, I felt I was supported and encouraged to ask questions if I was stuck or unsure of something. Now that I am on the other side of this process and helping others with their technical challenge, I know it’s important to understand how someone thinks, what questions they ask, and how they approach the challenge. Of course, getting to the right answer or resolution is the goal, but how they get there and how they approach it is equally important when assessing if someone is the right person for the job. As a manager, I want to bring that same level of support to my team, so they know no matter what challenge they are up against, we are all here to work together and find the best solution as a team.

To learn more about Rapid7’s new office in Prague, click here.
View and apply to Rapid7 jobs in Prague here.

Post Syndicated from Rapid7 original https://blog.rapid7.com/2023/07/06/user-enumeration-is-not-a-vulnerability-i-beg-to-differ/

At Rapid7 we love a good pentest story. So often they show the cleverness, skill, resilience, and dedication to our customer’s security that can only come from actively trying to break it! In this series, we’re going to share some of our favorite tales from the pen test desk and hopefully highlight some ways you can improve your own organization’s security.

This is a story of how a well defended network was compromised through user enumeration; a vulnerability which many organizations do not consider to be a “real” vulnerability. For the uninitiated, user enumeration vulnerabilities are application behaviors that could allow a malicious actor to determine valid usernames on a service. They are commonly exploited to set up follow-on attempts to guess users’ passwords.

I was tasked with performing an external penetration test for a midsize company. I began the engagement by performing port scanning and service enumeration, and discovered a small number of accessible web services. This led to a wonderful discovery: Outlook Web Access (OWA) was exposed! OWA suffers from a user enumeration vulnerability in which authentication requests involving valid usernames produce different responses than authentication requests involving invalid usernames. This could allow a malicious actor to submit unlimited authentication requests with different usernames, and use the responses to determine whether a given user exists in Exchange or not. We believe that Microsoft has been aware of this problem since 2014 but has not yet patched it. Some security professionals speculate that this may be because Microsoft (like many other companies) does not consider user enumeration to be a vulnerability.

I quickly began user enumeration against this service. After harvesting employee names from LinkedIn, marketing databases, and password breach databases, I coerced the employee names into a username format and verified them against OWA. Once done, I pulled popular names from US Census data and found additional valid usernames. When all was finished I was in possession of hundreds of usernames I could employ for password spray attacks set up through Metasploit. It took just one attempt to find success: a support engineer was using a classic weak password which is compliant with most password policies, [season][year][special character]!

I logged into this user’s email, enumerated their inbox, and found users sending support requests that contained passwords and sensitive information over plaintext! If a malicious actor were to obtain these, they could potentially log into other accounts owned by this company’s clients or employees given the prevalence of password reuse. I also extracted the Exchange Global Address List that contained every email address in the company which would prove incredibly useful for further password spray attacks (or in the hands of a malicious actor, for a business email compromise attack).

Finally, I observed that VMware Horizon, a system used to provide remote access to employee workstations, was accessible to the public internet. When attempting to log in using the compromised credentials it was discovered that multifactor authentication was not being employed. I identified an active Windows virtual machine and logged in over RDP, giving me a foothold in the client’s internal network. This entire attack chain took less than an hour and the ingress into internal systems went undetected by my client.

My client was stunned to say the least, but through our partnership we identified a set of controls which would mitigate all of the identified vulnerabilities. Our subsequent conversations also were able to surface other issues outside of the pentest scope which we helped address, and together we were able to dramatically reduce their organization’s attack surface.

We believe this assessment demonstrates the value of a penetration test: vulnerability scans will not flag findings such as OWA user enumeration, users employing weak passwords that still comply with password policies, and a lack of MFA. Through our penetration testing assessments, we can also demonstrate a more holistic picture of the risks that our clients face by identifying and chaining disparate vulnerabilities together in the way that only a skilled human can. We can then partner with them to ensure swift mitigation using a strategy that is tailor made for the client’s individual environment.