All posts by Rapid7

Rapid7 Sales Director Devin Poulter On Building a Career as an Account Executive

Post Syndicated from Rapid7 original https://blog.rapid7.com/2023/06/01/rapid7-sales-director-devin-poulter-on-building-a-career-as-an-account-executive/

Rapid7 Sales Director Devin Poulter On Building a Career as an Account Executive

Devin Poulter is a Sales Director with over 20 years of experience in the tech industry. Recently, we asked him a few questions to learn more about how he built his career, what it’s like to lead a team at Rapid7, and more.

You’ve been in software sales for most of your career, what can you tell us about being successful as an Account Executive?

I’d say building your personal brand is really important for success as an Account Executive. Being able to have open and honest conversations with customers and really focus on where you can (or sometimes, where you can not) add value is something people will remember you by.

Years down the line, when you are either introducing a new product, or representing a different company, that decision maker you are reaching out to will probably remember how you treated them previously. If you took the time to create a positive relationship, they are more likely to take your call and listen because you’ve built that foundation of trust. I’ve seen that play out time and time again, and I think it’s important for people building their career to equally focus on their personal brand as well as the product or company brand you’re representing.

What stands out to you about Rapid7 when it comes to building a sales career?

Well, the cybersecurity market is white hot as threats and bad actors continue to find new ways of exposing vulnerable organizations. It’s a market that is attracting a lot of competition as new companies and startups emerge—but where I see the most value and sustainability is with organizations like Rapid7 that can meet customers where they are—and grow with them.

When we think about our customers, particularly the CISO, their role has become increasingly challenging, and will continue to be so. Between an evolving threat landscape, a struggle to find talent for in-house security teams, and a volatile economic landscape that puts pressure on budgets—they need partners who can help them do more with less resources. At Rapid7, we’re making it everyone’s mission to think about these customer challenges and ensure we’re bringing the best and most impactful solutions to the table so we can help customers build a more secure digital future.

Additionally, Rapid7 isn’t a one trick pony for a CISO. Our Account Executives can sell across the full platform of our offerings, enabling them to be a true partner to customers and add value based on their unique needs and challenges. When it comes to building a successful career in sales (and especially in building your personal brand), this is something that helps our reps deliver the utmost value to customers with solutions that can grow and scale with them.

Finally, Rapid7’s mission is inspiring. The need for our products is something that is never going to go away. All around the world, there are bad actors who are constantly trying to take advantage of individuals and businesses to make a quick profit. When you think of the impact a hacker or vulnerability can have, it’s everything from financial losses to entire infrastructure systems and communities getting disrupted. We’re giving organizations the tools and resources to protect themselves from the bad guys, and helping their security teams work more efficiently and keep their data—and more importantly, people, safe from harm.

What’s it like to lead a team at Rapid7?

As a leader, I’m excited for the opportunity to help mature my team and see them succeed. That’s always been a big motivator for me—and it still is today. As I’ve progressed through my career, I’d say it’s equally rewarding to see the growth and success of the business, and the impact we’re making on our customers.

Today, my motivation goes far beyond hitting our numbers and going to Club. Being part of a company that’s creating real impact every day, whether it’s through our products, our open source communities, or our work in public policy and governance, it’s fulfilling to be part of a journey that’s being recognized and giving us a reputation in the market for being really innovative.

When people are proactively approaching you at a conference or a show, and commenting on the work Rapid7 is doing, it instills a lot of pride in your work and reminds you of how important our mission is. A company that gives you that kind of fulfillment, along with opportunities to grow, is the real difference between finding your next job and finding a career home.

What do you look for in an Account Executive?

What I look for is genuine curiosity, and the ability to critically think about challenges. I don’t need someone to tell me what they think I want to hear or give a generic answer. In order to uncover this in an interview, I’ll often share a real world situation and ask their opinion on how they would approach it. This gives me an opportunity to see what kind of follow up questions they have, how they think, and how they might approach challenges on the job. As far as their answer, I’m not looking for a right or wrong response, it’s more about learning how they think. Sometimes, I’ll even help coach or give the person feedback to help them understand the context or maybe frame it in a way they weren’t thinking about originally. The candidates that stand out the most are the ones who are able to ask the right questions, can articulate their opinion, and who are also coachable and open to feedback. Knowledge of our products and industry can always be taught, but having the right mindset is critical to be able to help them grow and be successful in the role.

At Rapid7, when we say we are open to ideas and encourage people to challenge convention—we really do mean it, and we respect the different perspectives that are brought to the table. This kind of culture is what helps sustain the business and enables you to do some really cool things in your field.

Looking to find your career home as an Account Executive?

Explore what it’s like to work as part of our sales team here: https://careers.rapid7.com/sales

Rapid7 Data Engineers Inspire Future Tech Talent at Summer Search Career Fest

Post Syndicated from Rapid7 original https://blog.rapid7.com/2023/05/31/rapid7-data-engineers-inspire-future-tech-talent-at-summer-search-career-fest/

Rapid7 Data Engineers Inspire Future Tech Talent at Summer Search Career Fest

We are thrilled to share some exciting news from our data engineering team at Rapid7. Earlier this month, our very own data engineers had the honor of being panelists at the technology panel organized by Summer Search, a fantastic organization that our CEO, Corey Thomas, is on the Leadership Council for.

The event, known as the Summer Search Career Fest, aimed to empower and support 100-150 high school and college students from low-income backgrounds. It provided them with invaluable opportunities such as professional mentoring, summer experiences, and post-secondary support. Our team was elated to contribute to this inspiring initiative and connect with these talented young minds.

Rapid7 Data Engineers Inspire Future Tech Talent at Summer Search Career Fest

As panelists, we had the privilege of sharing our experiences, insights, and expertise in the field of data engineering. We discussed various topics related to technology, career paths, and the impact of data-driven decision-making. Our goal was to inspire these aspiring individuals and showcase the incredible possibilities that lie within the tech industry.

Being able to guide and mentor young talent aligns perfectly with our company values and our commitment to fostering growth within the community. We firmly believe that by investing in the next generation of professionals, we can collectively shape a brighter future.

We would like to express our heartfelt gratitude to Summer Search for organizing this remarkable event and for providing us with the opportunity to contribute. We would also like to extend our appreciation to Corey Thomas for his involvement in the Leadership Council, which made our participation possible.

We encourage all of you to join us in celebrating this achievement and the positive impact we are making together. Stay tuned for future updates on our community engagement initiatives and ways you can get involved.

Once again, thank you to everyone involved in making this event a success, and we look forward to continuing to make a difference in the lives of young talent within our community.

Rapid7 Data Engineers Inspire Future Tech Talent at Summer Search Career Fest

Healthcare Orgs: Do You Need an Outsourced SOC?

Post Syndicated from Rapid7 original https://blog.rapid7.com/2023/05/24/healthcare-orgs-do-you-need-an-outsourced-soc/

Healthcare Orgs: Do You Need an Outsourced SOC?

Gartner predicts that 50% of organizations will partner with an external MDR (Managed Detection and Response) service by 2025 for around-the-clock monitoring. What determines where healthcare organizations fall on that 50/50 split over using an outsourced SOC? It usually comes down to their ability to adapt to the current needs of the healthcare industry.

A growing demand for improved healthcare services means more healthcare providers are turning to the cloud. But for a world built on strict regulations and literal life-or-death situations, migrating too quickly to the cloud can be a serious challenge. When healthcare teams take on cloud adoption too fast, then run the risk of:

  • Accumulating cloud services that fall through security cracks—AKA shadow IT
  • Expanding their organization’s attack surface without a means of defense, opening up more opportunities for breaches and leaks

That’s where the help of an outsourced SOC comes in. With an extra team of experts on board, healthcare organizations can secure new ephemeral environments—without putting their security teams through resource strain or burnout.

Still, it can be tough for healthcare organizations to identify when it’s time to outsource, if ever at all. Here are some tell-tale signs that outsourcing a SOC and investing in managed services is the right call.

Your Teams Are Already Overwhelmed

While most healthcare organizations have a trusted team of a few security experts, they’re usually smaller than most security teams in tech enterprises, snappy startups, or other more cyber-savvy industries. That leads to a tricky cycle of needing to do more with fewer resources.

A day in the life of a security engineer in healthcare is marked by a seemingly endless game of catchup—one that doesn’t support speed, efficiency, or a successful migration to the cloud.

If your organization’s security teams are:

  • Struggling to find qualified talent
  • Overwhelmed by firefighting every single incident on their plate
  • Tired of combing through seas of alerts—some of which are false positives
  • Burned out by carrying out repetitive and mundane tasks that could be automated

You’re Super New to the Cloud

Healthcare security teams are typically IT or network pros who are well-acquainted and well-trained to defend traditional environments. However, there may be knowledge gaps when it comes to healthcare’s approach to cloud security. But with global cyber attacks on healthcare organizations rising 74% per week in 2022, security teams have no time to waste learning how to protect cloud environments.

Investing in the right education and training for healthcare’s traditional security pros simply takes time and effort that many organizations can’t afford to waste. But with an external SOC, security teams can:

  • Rely on cloud security experts to handle the trickiest parts of the process
  • Learn as they go with the guidance of seasoned professionals
  • Gain strategic guidance and insights to help take their security program to the next level

You’d Benefit From Automated Processes but Struggle To Implement Them

Automation is the key to boosting your cloud security program and iterating it at scale. For healthcare, automation provides the biggest benefit in ensuring that strict compliance regulations—like HIPAA—are met. That spells good news for stakeholders, who are typically most concerned with meeting standards and maintaining compliance.

With automation, security teams in healthcare can:

  • Configure guardrails ensuring new assets and environments adhere to regulations and compliance standards
  • Set up automated alerts that indicate when standards are not met

However, implementing automation, especially if your organization’s new at it, can seem like a hefty investment and a daunting task to accomplish. It’s time to enlist the help of an outsourced SOC if your security teams:

  • Have limited or no experience with automation
  • Are still manually handling a lot of rote but necessary tasks
  • Know where duties get repetitive but don’t know what to do about it

That way, external cyber experts can set up automated guardrails, teach your teams how they work, and eliminate tedious, manual work.

Next Steps With Outsourced SOCs

Organizations with limited resources and novice knowledge of the cloud can significantly benefit from teaming up with managed services. But in a sea of possible partners, knowing which experts to go with can be tough—especially when healthcare organizations have various security needs.

That’s why we built Managed Threat Complete, an always-on MDR with vulnerability management in a single subscription. Consolidate your investment in external SOCs by teaming up with our seasoned security pros today.

Learn More

For more information about healthcare cybersecurity, download our new ebook: In Healthcare (and Security) Early Detection is Key

In this eBook, you’ll learn:

  • The current state of threats in the healthcare industry
  • The top challenges in addressing those threats
  • How to overcome those challenges and implement defense strategies

Download it now!

The Velociraptor 2023 Annual Community Survey

Post Syndicated from Rapid7 original https://blog.rapid7.com/2023/05/10/the-velociraptor-2023-annual-community-survey/

The Velociraptor 2023 Annual Community Survey

By Dr. Mike Cohen & Carlos Canto

Velociraptor is an open-source project led and shaped by the community. Over the years, Velociraptor has become a real force in the field of DFIR, making it an obvious choice for many operational situations. Rapid7 is committed to continue making Velociraptor the premier open-source DFIR and security tool.

To learn more about how the tool is used in the community and what the community expectations are with regard to capabilities, features, and use cases the Velociraptor team distributed our first community survey in early 2023. We are using this information in order to shape future development direction, set priorities and develop our road map. We are grateful to the community members who took the time to respond.

As an open-source project, we depend on our community to contribute. There are many ways contributors can help the project, from developing code, to filing bugs, to improving documentation. One of the most important ways users can contribute is by providing valuable feedback through channels such as this survey, which helps to shape the future road map and new features.

We’re excited to share some of the responses we received in this blog post.

Who is the Velociraptor community?

Of the 213 survey respondents, the majority were analysts (57%) and managers (26%), indicating that most of the respondents are people who know and use Velociraptor frequently.

We also wanted to get a feel for the type of companies using Velociraptor. Users fell pretty evenly into company sizes, with about 30% of responses from small companies (less than 100 employees) and 20% of responses from very large companies of 10,000 employees or more.

These companies also came from a wide range of industries. While many were primarily in the information security fields such as managed security service providers (MSSPs), consultants, and cybersecurity businesses, we also saw a large number of responses from the government sector, the aerospace industries, education, banking/finance, healthcare, etc.

With such a wide range of users, we were interested in how often they use Velociraptor. About a third said they use Velociraptor frequently, another third use it occasionally, and the final third are in the process of evaluating and learning about the tool.

Velociraptor use cases

Velociraptor is a powerful tool with a wide feature set. We wanted to glimpse an idea of what features were most popular and how users prioritize these features. Specifically, we asked about the following main use cases:

Client monitoring and alerts (detection)
Velociraptor can collect client event queries focused on detection. This allows the client to autonomously monitor the endpoint and send back prioritized alerts when certain conditions are met.

→ 12% of users were actively using this feature to monitor endpoints.

Proactively hunting for indicators (threat intelligence)
Velociraptor’s unique ability to collect artifacts at scale from many systems can be combined with threat-intelligence information (such as hashes, etc.) to proactively hunt for compromises by known actors. This question was specifically related to hunting for threat-feed indicators, such as hashes, IP addresses, etc.

→ 16% of users were utilizing this feature.

Ongoing forwarding of events to another system
Velociraptor’s client monitoring queries can be used to simply forward events (such as ETW feeds).

→ 6% of users were utilizing this feature.

Collecting bulk files for analysis on another system (digital forensics)
Velociraptor can be used to collect bulk files from the endpoint for later analysis by other tools (for example, using the Windows.Collection.KapeFiles artifact).

→ 20% of users were using this feature regularly.

Parsing for indicators on the endpoint (digital forensics)
Velociraptor’s artifacts are used to directly parse files on the endpoint, quickly returning actionable high-value information without the need for lengthy post processing.

→ 21% of users use these types of queries.

Proactive hunting for indicators across many systems (incident response)
Velociraptor can hunt for artifacts from many endpoints at once.

→ 21% of users benefit from this capability.

We further asked for the relative importance of these features. Users most valued the ability to collect bulk files and hunt for artifacts across many systems, followed by the ability to directly parse artifacts on the endpoints.

Backwards compatibility

Some users deployed Velociraptor for limited-time engagements so they did not need backwards compatibility for stored data, as they wouldn’t be upgrading to major versions within the same deployment.

Other users required more stable data migration but were generally happy with removing backwards data compatibility, if necessary. For example, one response stated “I would rather you prioritize improvements over compatibility even if it breaks things.”

Another user explained: “In a typical Incident Response scenario, Digital Forensics data has a shelf life of a few weeks or months at best and I am comfortable with the convertibility and portability of much of the data that Velociraptor collects such that archival data can still be worked with even if newer versions of the server no longer support a deprecated format/archive. I think there will be workarounds if this becomes an issue for folks with mountains of legacy data that hasn’t been exported somewhere more meaningful for longer term storage and historical data analytic/intelligence purposes.”

Generally, most users indicated they rarely or never needed to go back to archived data and reanalyze.

Version compatibility

The Velociraptor support policy officially only supports clients and servers on the same release version. However, in reality it usually takes longer to upgrade clients than servers. While some users are able to upgrade clients promptly, many users estimate between 10-50% of deployed clients are a version (or more) older than the server. Therefore, the Velociraptor team needs to maintain some compatibility with older clients to allow time for users to upgrade their endpoints.

The offline collector

The offline collector gives users a way to use Velociraptor’s artifacts without needing to deploy a server. This feature is used exclusively by about 10% of users, while a further 30% of users employ it frequently.

Most users of the offline collection deploy it manually (50%). Deploying via another EDR tool or via Group Policy are also robust options. Some users have created custom wrappers to deploy the offline collector in the field. The offline collection supports directly uploading the collection to a cloud server using a number of methods.

The most popular upload method is to an AWS S3 bucket (30%) while the SFTP connector in the cloud or a custom SFTP server on a VM are also popular options (20% and 23%, respectively). Uploading directly to Google Cloud Storage is the least popular option at about 5%.

Manual copy methods were also popular, ranging from EDR-based copying to Zoom file copy.

Azure blob storage was a common request that Velociraptor currently does not support. Many responses indicate that SFTP is currently a workaround to the lack of direct Azure support. The Velociraptor team should prioritize supporting Azure blob storage.

Data analysis

Velociraptor supports collecting raw files (e.g. Event log files, $MFT etc.) for analysis in other tools. Alternatively, Velociraptor already contains extensive parsers for most forensic artifacts that can be used directly on the endpoint.

Most users do use the built-in forensic parsing and analysis artifacts (55%) but many users also collect raw files (e.g. via the Windows.Collection.KapeFiles artifact).

VQL artifacts

Velociraptor uses the Velociraptor Query Language to perform collections and analysis. The VQL is usually shared with the community via an artifact. Most users utilize the built-in artifacts as well as the artifact exchange. However, over 60% of users report they develop their own artifacts, as well. For those users who develop their own artifacts, we asked about limitations and difficulties in this process.

A common theme that arose was around debugging artifacts and the lack of a VQL debugger and better error reporting. Training and documentation were also pointed out as needing improvement. A suggestion was made to enhance documentation with more examples of how each VQL plugin can be used in practice.

In a related note, the Velociraptor team is running a training course at BlackHat 2023. Developers will impart detailed information on how to deploy Velociraptor and write effective custom VQL.

Role-based access controls

Velociraptor has a role-based access control (RBAC) mechanism where users can be assigned roles from administrator, to investigator, to read-only access provided by the reader role. Users generally found this feature useful—40% found it “moderately useful,” 20% “very useful” and 15% “extremely useful”.The main suggestions for improvements include:

  • Easier management through the GUI (as of version 0.6.8 all user ACLs are managed through the GUI)
  • Custom roles with more granular permissions
  • Better logging and auditing
  • The ability to allow a specific role to only run a pre-approved subset of artifacts
  • A way to only run signed/hashed VQL / prevent a malicious artifact being dropped on the server
  • Making it clearer what each permission grants the user

Multi-tenant support

Velociraptor offers a fully multi-tenanted mode, where organizations can be created or decommissioned quickly with minimal resource overhead. This feature is used by 25% of respondents, who are mainly consultants and service providers using it to support multiple customers. Some companies use multi-tenancy to separate different divisions or subsidiaries of the business.

Client monitoring and alerting

Velociraptor can run event queries on a client. These VQL queries run continuously and stream results to the server when certain conditions are met. Common use cases for these are to generate alerts and enhanced detection.

Some users deploy client monitoring artifacts frequently while others see it as an alternative to EDR tools, when these are available. The primary use-case breakdown was:

  • Detection (e.g. alert when an anomalous event occurs): 27% of users
  • Collection of client events (e.g. forward process event logs to an external system): 18% of users
  • Remediation (e.g. quarantine or remove files automatically): 15% of users

→ 30% of users do not use client monitoring at all.

The most common pain point with client monitoring is the lack of integrated alerting capability (an issue currently being worked on). Some useful feedback on this feature included:

  • Better support for integration with business tools (e.g., Teams, Slack, etc.)
  • Easier to manage event data
  • Not having to build a server side artifact for each client_event artifact
  • A dashboard that lists all alerts
  • An easier way to forward alerts based on severity
  • Lack of pre-built detection rules/packs—in other words, it would be easier to tune down, than to build up

The Quarantine feature

Velociraptor can quarantine an endpoint by collecting the Windows.Remediation.Quarantine artifact. This artifact tunes the firewall rules on the endpoint to block all external network communication while maintaining connectivity to the Velociraptor host. This allows for an endpoint to be isolated during investigation.

The feature is fairly popular—it was “sometimes used” by about 30% of users and “always used” by another 12%.

How is Velociraptor deployed?

Velociraptor is a very lightweight solution, typically taking a few minutes to provision a new deployment. For many of our users, Velociraptor is used in an incident response context on an as-needed basis (46%). Other users prefer a more permanent deployment (25%).

For larger environments, Velociraptor also supports multi-server configuration (13% of users), as well as the more traditional single-server deployment option (70% of users). While some users leverage very short-lived deployments of several days or less (13%), most users keep their deployment for several weeks (27%) to months or permanently (44%).

Velociraptor is designed to work efficiently with many endpoints. We recommend a maximum of 15-20k endpoints on a single server before switching to a multi-server architecture (although users reported success with larger deployment sizes on a single server). This level of performance is adequate in practice for the majority of users.

Many users run deployments of less than 250 endpoints (44%) while a further 40% of users deploy to less than 5,000 endpoints.

Approximately 10% of users have deployment sizes larger than 25,000 endpoints, with 2% of users over 100,000 endpoints.

Popular operating systems

Among Velociraptor’s supported operating systems, Windows 64-bit is the most popular (with 82% of users ranking it the most-deployed OS type), while Linux is the next most popular deployed endpoint OS. Mac is the third popular choice for Velociraptor’s users. Finally, 32-bit Windows systems are still prevalent, as well.

Resources and references

Velociraptor’s website at https://docs.velociraptor.app/ contains a wealth of reference material, training courses, and presentations. We also have an active YouTube channel with many instructional videos.

While some users ranked the website as “extremely useful” (25%), there is clearly room for improvement. 42% of users rated it as only “very useful” or “moderately useful” (28%).Suggestions for improvements included:

  • More in-depth YouTube videos breaking down the tool’s features with workflows
  • More detailed “how to” with practical examples
  • Improved documentation about functions and plugins, with a slightly more detailed explanation and a small example
  • Updates to the documentation to reflect the new versions and features

Testimonials

Finally, I wanted to share with you some of the testimonials that users wrote in the survey. We are humbled with the encouraging and positive words we read, and are excited to be making an impact on the DFIR field:

  • "I have to congratulate you and thank you for developing such an amazing tool. It’s the future of DFIR."
  • "Awesome product, can’t wait to use it in prod!"
  • "This is a game-changer for the DFIR industry. Keep up the great work."
  • "Keep the file system based backend, its simplicity makes chain of custody/court submissions possible."
  • "I thoroughly love Velociraptor. The team and community are absolutely fantastic. I would go as far as to say that Mike and Matthew Green are my favorite infosec gentlemen in the industry."
  • "Y’all are awesome. I feel like I was pretty critical, but that’s because this is an amazing software, and I want to see it continue to grow and improve."
  • "We have been deploying Velociraptor to client environments almost since it was released. Our DFIR business model is entirely centered around it and it works very well for us. It is a great solution that just keeps getting better and better."

Conclusions

This is our first Velociraptor community survey, and it has proven to be extremely useful. Since Velociraptor is a community-led, open-source project, we need an open feedback loop to our users. This helps us understand where things need improvement and which features should be prioritized.

At the same time, since Velociraptor is an open-source project, I hope this survey will inspire contributions from the community. We value all contributions, from code to documentation, testing, and bug reports.

Finally, for all of our US-based users, we hope to see you all in person this year at BlackHat 2023! Join us for an in-depth Velociraptor training and to geek out with VQL for 4 days, learning practical, actionable skills and supporting this open-source project.

Keep Digging!

Cloud Security Strategies for Manufacturing

Post Syndicated from Rapid7 original https://blog.rapid7.com/2023/05/03/cloud-security-strategies-for-manufacturing/

Protecting production while supporting growing cloud initiatives

Cloud Security Strategies for Manufacturing

The manufacturing industry is in limbo as organizations shift to cloud services. Many organizations are transitioning services to the cloud, but the vast majority maintain hybrid network environments that lean heavily on on-prem elements. During the pandemic, some companies were forced to expand their cloud services quickly to keep up with an influx of end users accessing network services remotely. However, few manufacturers are really pursuing a cloud-first approach.

This leaves most manufacturing organizations struggling to address issues of visibility in their hybrid cloud environments. There’s also a growing concern about compliance in the industry, with manufacturers setting internal standards to provide crucial oversight for themselves and their third-party partners. All of this is occurring during an industry-wide push to implement smart factory initiatives and a persistent IT/OT skills gap in manufacturing organizations.

An effective cloud security strategy is key for manufacturing companies. As they transition their services, implementing cloud security will ensure they’re able to monitor their growing attack surfaces, establish the necessary auditing processes and assessments for compliance, and support smart factory initiatives.

Major challenges of cloud security in manufacturing

Ensuring consistent production is paramount for manufacturing organizations. Cloud security strategy for this industry enables hybrid networks to function without disruption, while still supporting developing compliance regulations and smart factory initiatives. Without an effective cloud security strategy, manufacturers jeopardize their entire hybrid network as well as the operational elements and software integral to their manufacturing processes. Let’s look at a few of the obstacles keeping manufacturers from implementing an effective cloud security strategy.

Lack of visibility into the cloud

The manufacturing industry is unique in that organizations are not only monitoring an environment populated with their own cloud and on-prem elements, but they’re also tasked with tracking the elements of the third-party vendors that they partner with. These additional endpoints increase the overall attack surface and can be tricky to secure.

Lack of visibility into the cloud applications and elements in a manufacturing company’s network impacts root-cause analysis, anomaly detection, and the other processes that affect availability, performance, and security across the entire network.

Network disruptions often translate to supply chain issues that can affect production and availability. This ultimately translates to lost revenue and negatively impacts a manufacturer’s brand reputation. In fact, in a Supply Chain Resilience Report, 16.7% of business owners reported a “severe loss of income” due to a supply chain disruption. The report also revealed that the average cost of a disruption was around $610,000 dollars. Cloud security strategy, then, should include visibility across the entire infrastructure as well as third-party dependencies and the necessary context to bring clarity to third-party risk.

Failure to achieve and maintain cloud compliance

Unlike other highly regulated industries like healthcare and financial services, manufacturing organizations don’t have much external guidance when it comes to cloud compliance. In the absence of government regulation, manufacturing companies need a way to validate network configurations and changes in their cloud applications and infrastructure.

The lack of compliance standards for cloud applications prevents many manufacturers from properly deploying cloud-controlled elements, as well as detecting and remediating issues. This leads to system-wide vulnerabilities and greater exposure in the threat landscape. For example, without proper compliance standards in place, an organization may fail to update their service-level agreements (SLAs) or security patches in their cloud environments, which can be exploited by malicious threat actors.

Manufacturing organizations require a cloud security strategy that includes automated detection and remediation assistance, as well as support in adopting and implementing the few regulatory recommendations available, such as those set forth by the National Institute of Standards and Technology (NIST).

Inability to bridge the IT/OT knowledge gap

According to a Gartner survey, 64% of IT executives view talent shortages as the most significant barrier to adoption of emerging technologies. In the manufacturing industry, this translates specifically to a lack of IT/OT specialist knowledge on network teams.

IT/OT refers to the integration of information technology (IT) systems with operational technology (OT) systems. This particular combination of systems is used by manufacturing organizations to balance cloud network infrastructure that controls information and data with industrial equipment, assets, and processes.

Without specialist knowledge of these systems and how they interact, manufacturers struggle with IT and OT silos that lead to system disruption, downtime, and increased vulnerability. Manufacturers often misunderstand that OT systems are critical to their production process, but not necessarily the source of risk in their infrastructure. IT systems, however, may represent a smaller point of entry to their system, but pose a much larger risk as they connect to the larger OT systems. To combat this, manufacturers need a toolkit that will fill this skill gap on their teams, automate processes for increased efficiency, and consolidate data to break down silos between teams.

Where to start with a cloud security strategy in manufacturing

When looking to build a strong cloud security strategy, manufacturers should focus their efforts in the following areas:

  • Visibility
  • Compliance
  • Managed Services

Prioritize cloud visibility

Though the transition to cloud services is slower in the manufacturing industry, it is still an inevitability. Consequently, the best way for manufacturing organizations to adequately protect their cloud infrastructure, and by extension their overall environment, is to focus on visibility.

Visibility reduces risk and allows companies to effectively monitor their attack surfaces. This begins with manufacturers collecting monitoring data from across their cloud infrastructure. Drawing connections between the data, end-user experiences, and supply chain interaction can help manufacturers find weak or vulnerable points in their cloud infrastructure.

The right cloud security tools will help teams continuously monitor both public cloud and container environments. Manufacturers also need real-time visibility and context to find and fix issues quickly. InsightCloudSec offers all of these features and more to manufacturing companies—effectively eliminating network blind spots and giving teams the confidence they need to move forward with their cloud initiatives.

Consider cloud compliance solutions

Many manufacturers struggle with finding and adopting regulatory best practices in their cloud environments. While NIST offers guidance on network security, and the Center for Internet Security (CIS) offers frameworks and CIS Benchmarks, many manufacturers are unsure of which guidelines make the most sense for their organization’s needs. Moreover, manufacturers need guidance on how to implement compliance monitoring, which ensures that their cloud elements are operating securely.

Without compliance, manufacturers are essentially managing their cloud environments in the dark, with little governance on how to deploy applications, configure their cloud environments, and update their elements. This can lead to lapsed security updates and serious vulnerabilities that increase risk across the entire infrastructure.

Enter cloud compliance solutions. These tools can enable manufacturing organizations to automate compliance monitoring and management. For example, InsightCloudSec checks an organization’s multi-cloud environments against dozens of industry and regulatory best practices. Moreover, cloud compliance solutions enable manufacturers to customize external compliance checks to sync with internal compliance regulations. This eliminates frustration and false alarms.

Teams can also take advantage of InsightCloudSec’s embedded automation, which automatically detects compliance drift and returns cloud environments to a secure state within 60 seconds.

Outsource with managed services

Manufacturing teams struggling to hire and retain skilled IT workers often find themselves with a gap in IT/OT oversight. This gap can result in greater silos between IT and OT teams, which can disrupt smart factory initiatives and the adoption of cloud services, and lead to increased unchecked system vulnerabilities.

After all, it’s hard to contextualize risk without a complete understanding of IT/OT cloud elements and how risk in one arena affects the other. Instead of an organization redoubling their hiring efforts or overwhelming their existing team members, managed services allow manufacturers to effectively outsource this role and add a virtual IT/OT specialist to their team.

Rapid7’s managed services team offers regular assessments, handles the operational requirements of incident detection and response, and performs vulnerability scanning. This frees up crucial time for IT/OT teams and streamlines the scanning and reporting process, which encourages greater collaboration. Contextualization, or the process of analyzing threats and gathering relevant supplemental information, is simple with Rapid7’s InsightVM. InsightVM works in partnership with SCADAfence to assess vulnerabilities and leverage insight into OT networks to accurately prioritize risk.

The bottom line

Establishing cloud security strategies in manufacturing organizations often seems like an insurmountable task. Common struggles of visibility, compliance, and IT/OT knowledge gaps plague manufacturing companies who are transitioning to cloud services. This can lead to network blind spots, slowdowns, and increased risk.

Building a toolkit of cloud security solutions can help manufacturers reduce their overall risk in the cloud and optimize their performance by improving internal compliance. Making the most of this toolkit requires specialized knowledge, but leveraging managed services enables manufacturing organizations to streamline reporting and assessments without hiring additional in-house staff.

Manufacturing organizations are evolving to keep up with production demands, changing technology, and an ever-broadening threat landscape. By strengthening cloud security, manufacturing companies can focus on providing a superb product, assured that their cloud environment is secure. Get in touch with us to learn more about how Rapid7 is helping manufacturing companies navigate security during every phase of the cloud transition process.

Starting a Career in Tech? Learn How Rapid7’s Emerging Talent Programmes Foster Long-Term Success

Post Syndicated from Rapid7 original https://blog.rapid7.com/2023/04/25/starting-a-career-in-tech-learn-how-rapid7s-emerging-talent-programmes-foster-long-term-success/

Starting a Career in Tech? Learn How Rapid7’s Emerging Talent Programmes Foster Long-Term Success

Rapid7’s Emerging Talent Programmes pave the way for early career professionals to have a successful career in tech. In Belfast, we offer both an Apprentice Programme and a Placement Programme to support new talent coming into the tech field.

The Apprentice Programme is designed for individuals with established careers that want to pivot into the cybersecurity field. In our Placement Programme, students spend a full year working as a member of one of our teams while enrolled in university, gaining valuable experience working on real projects.

Cybersecurity is constantly evolving, and we work diligently to stay ahead of attackers and create a more secure digital future for all. Emerging Talent Programme participants bring fresh and valuable perspectives to our business and are equipped with the resources and opportunities to develop valuable industry knowledge and experience.

We spoke with several team members who went through these programmes and went on to pursue full time roles at Rapid7, and invited them to share their experiences.

What was the biggest hurdle you have had to overcome when starting your career?

When I joined Rapid7, I had no prior IT experience. My background was in mechanics. I was initially very nervous that my lack of IT experience would put me at a disadvantage. However, I was fortunate to be offered an opportunity with Rapid7 and Belfast Met. Rapid7 provided me with exceptional training and a support programme with ongoing mentoring. This ensured that I never felt left behind.

In the last 2 years working with Rapid7, my knowledge and skills have grown far beyond what I had ever hoped for. This is a testament to the talented individuals I work with and their willingness to share their expertise and help others.

Mark Gottschalk, Technical Support Engineer II

Coming from university and other experiences where I would have completed projects in smaller groups, understanding how information is stored and communicated across a large company and stakeholders took some time. I look at it as a valuable learning opportunity as you gain insight into how decisions are made in software companies and how stakeholders in all areas of Rapid7’s business interact with each other.

Christopher Jennings, Assistant Product Manager, Platform

How did you know you wanted to work at Rapid7?

I was interested in the culture at Rapid7 when looking for placement opportunities. The effort by the company to look after employee welfare was very attractive, and quite unique compared to other companies.

Kate Wilson, User Experience Designer I

My software engineering placement at Rapid7 was a pivotal experience in my career journey, as it helped me to determine my desired career path and confirm my interest in the company. Rapid7 impressed me with its position as a leader in the cybersecurity industry, as well as its ownership of the highly regarded tool, Metasploit.

The company’s focus on culture and values during the hiring process, and the positive experience I had with the people I met made a strong impression on me. These factors, combined with my passion for software engineering, led me to conclude that Rapid7 would be an ideal place for me to continue my professional development and pursue my career goals.

Jonathan Hume, Software Engineer I

How has this programme helped you determine your career path?

This placement programme has been instrumental in helping me determine my career path. I now have a better understanding of what product managers do and how different stakeholders within a software business interact to progress Rapid7 forward.

Christopher Jennings, Assistant Product Manager, Platform

The apprenticeship programme at Rapid7 has been a transformative experience for me. I have a strong interest in technology and a drive to learn and grow. I am surrounded by colleagues who are supportive and inclusive, and I have the opportunity to work on real-world projects that are challenging and rewarding. The programme provides a perfect balance between work and education, allowing me to complete my degree while gaining valuable experience.

Toni Ashe, Technical Support Engineer I

What has been your proudest accomplishment at Rapid7 so far?

My proudest accomplishment within Rapid7 has been the success of the Apprentice team I started with. At the end of our first year working within the Support team, we received the top three highest average customer survey ratings globally, as well as the top team globally. This was a moment of immense pride for all of us and serves as a testament to the effectiveness of the training and development programme for Support Engineers and the Apprenticeship programme!

Mark Gottschalk, Technical Support Engineer II, Support Coordinator Apprentice

My proudest accomplishment so far has been successfully completing my first coding project, which was a command palette modal that utilized hotkeys and other actions. Despite the challenges, I have worked hard and pushed myself to learn, and the reward of completing the project was worth all the effort.

Toni Ashe, Technical Support Engineer I

What piece of advice would you give someone entering a similar position?

I would advise anyone who is thinking about applying for an internship to be confident in their ability, ask lots of questions, and build a good knowledge base on the work and environment of the company and role you are applying to.

Kate Wilson, User Experience Designer I

For anyone considering a career move, my advice is: Take advantage of the opportunities for learning and growth, be open to feedback, and don’t be afraid to ask questions. Pursuing a career in this field can be challenging, but the results are rewarding if you are passionate about technology and have a drive to constantly learn and grow.

Toni Ashe, Technical Support Engineer I

Looking for a place where you can gain hands-on experience and drive real impact? Explore all our Emerging Talent programmes and opportunities here.

Secrets of a cybersecurity employer-of-choice

Post Syndicated from Rapid7 original https://blog.rapid7.com/2023/04/19/secrets-of-a-cybersecurity-employer-of-choice/

Secrets of a cybersecurity employer-of-choice

By Jay Prescott, Director, Global SOC Operations

While the staffing crisis is real, our global MDR SOCs are thriving with top-notch analysts, DFIR talent, and no revolving doors (they like it here). In a high-pressure, high-stakes business, these are our lessons learned.

Measure your staffing performance meticulously and publicly

In an industry plagued by burnout, churn, and open jobs everywhere, be obsessed with your metrics to retain top talent. We do.

  • Last year, we grew our global Managed Detection and Response (MDR) teams by 68%
  • Our voluntary attrition for SOC analysts is under 5%
  • Since the start of Rapid7 MDR seven years ago, we’ve only lost about one to two analysts per year (as competition for cybersecurity talent went white-hot)

Rapid7 recruits talent from all over the world to join us in our state-of-the-art SOC locations. Each SOC has incredibly high retention rates.

We prioritize investments in training, competitive pay, project work and extracurricular activities, and ensuring analysts are doing the work they enjoy. The leadership team is in tune with job satisfaction and directly attacks any aspect of the analyst duties that causes friction.

Peter Drucker said it best:  “Culture eats strategy for breakfast.”

According to a survey by Mimecast, 84% of security professionals are experiencing burnout due to the constant barrage of threats, the  talent shortage, and other employees’ mistakes (as a result of burnout).  And, while everyone battles “The Great Resignation” and our collective 5-year skills crisis, ZDNet reports it’s going to get worse. Nearly a third of the global cybersecurity workforce plans to leave the industry—not their jobs, but the entire industry—within two years.

To prevent burnout, we encourage a culture of friendship and after-hours socialization. People who work alongside friends help more and perform better. They trust one another.  Like just about anyone in our line of work, Rapid7 MDR employees know they can go anywhere and do what they do. They also know we greatly appreciate the fact they choose to do it here.

A member of one of our SOC had his car in the shop for far too long due to a supply chain shortage of the missing part.  There was only one thing to do for April Fool’s day:

Secrets of a cybersecurity employer-of-choice

As one member of the team stated, “we work at a place that crowdsourced a $700 prank!”

You don’t need budget for team-building consultants and “trust exercises.”  Camaraderie is created in Slack channels and karaoke nights at the bar on the first floor of the Rapid7 Arlington , VA office.

Create a learning organization

We’ve heard it called “alphabet soup after your name.” While certifications are important, real-world experience and constant learning trumps a course any day of the week. And the best way for the SOC to learn? By doing first-hand and sharing those learnings with everyone. Here’s some of the lessons learned:

First, eliminate silos. Each of our MDR SOCs are  composed of three tiers of analysts, working together on customer environments. There’s complete threat detection coverage, multiple layers of escalation and validation, and redundant knowledge. Additionally, the technology used by the SOC captures relevant details of the environment, detected threats, and analysis notes which are available to all analysts.

Second, train constantly. Rapid7 has a robust training program: a combination of external live training (SANS, Chris Sanders courses), self-paced learning (TCM malware analysis & forensics courses), as well as a robust internal security training program (modeled after specific incidents Rapid7 MDR has handled) to train our analysts quickly and effectively. All training is heavily focused on endpoint forensics, incident response, threat hunting, coding/scripting, and foundational security concepts. All analysts have the chance to attend external training every year. Internally, analysts learn from each other with weekly “lunch n’ learns” to level up their stills by learning from others around them and show off the latest threat they were able to thwart for our customers.

Third, we organized around learning in new ways. Over a year ago, Rapid7 merged our Incident Response Consulting Team with our MDR SOC to create an integrated team of Detection and Response experts. If an incident investigation appears to be major, analysts simply (and literally) swivel their chairs and tap Senior IR consultants and DFIR practitioners on the shoulder.

For major incidents, Rapid7’s TIDE Team (Threat Intelligence and Detections Engineering) is right there too. “We ride along with them and are watching what they’re discovering and we develop new detections,” says Eoin Miller, Manager of Detection and Response Services. “It helps not only that customer but any other customer that may be a current or future victim of that same attacker.”

Rapid7 MDR  also created a “Tactical Operations” (TacOps) team, which is primarily used as a “farm system” for analyst development. Typically, Associate Analysts at other Security Operation Centers are relegated to Tier 1 roles, focusing on low severity alert triage with little exposure to actual malicious activity or complex investigations. Rapid7 takes a different approach by throwing these Associate Analysts into the deep end to deal with real, high priority threats (the things we know are evil), which accelerates their learning curve. They’re actually looking at malicious activity all day, not just hundreds of benign alerts.

Our Associate level analysts have even gone on to publish their work and were tapped to lead a technical malware deep dive on one of the most popular security webinars in the world (Ultimate IT Security). Not too shabby for “entry level” folks to be presenting to a broad audience after only a year working in our SOC. Not surprisingly, we focus on promoting from within, with many analysts taking on advanced roles in forensic analysis and IR.

Finally, we’ve reorganized our services organization to bring our penetration testing team SOC analysts under one roof. We feel the best way to learn (and improve our ability to detect and respond effectively) is to encourage collaboration and knowledge sharing between both our offensive-minded and defensive-minded security practitioners. Iron sharpens iron.

Never compromise your standards

MDR analyst candidates go through an initial technical assessment (live on phone responses) with our Talent Acquisition partners in order to pre-screen candidates before the live technical interview panel.

During the interview Technical Panel, our interviewers’ goal is to push the candidate to the edge of their knowledge. We ask a series of questions which are progressively more difficult using real-world scenarios: “If you see XYZ behavior, walk me through the process from start to finish:

  • What technology and methodology would you use?
  • What data are you looking for?
  • Deep dive into why and how you’re looking at it?
  • How do you come to the determination that the behavior is malicious or benign?

This allows us to question various tools and techniques used in the course of an investigation. We then hire based on the candidate’s knowledge, skill set, and culture fit.

More questions like these and other best practices we use can be found in our guide, the 13 Tips for Overcoming the Cybersecurity Talent Shortage.

Say what your values are

Rapid7 has company core values. We’ve added to it with our “Culture Code for the MDR SOC.” Every organization and each SOC’s values are different. These are ours:

  • Ownership: Know what you’re responsible for and own it. We expect you to own your mission fully. Don’t make excuses, and don’t point fingers at others.
  • Customer-Centric: We are here for one reason—to deliver the managed security services our customers expect and deserve.
  • Passion and Purpose: Love what you do. While not everything you do every day is exciting, our team members genuinely enjoy their work and understand the importance of it.
  • Don’t Just ‘Turn The Wheel’: We’re not here just to handle alerts, run scans, perform hunts, or throw alerts over the fence for our customers to handle. We’re here to bring our security expertise to bear in the most effective way to better protect our customers at scale.
  • Risk Taking: Choosing not to take a risk is often the biggest risk. We will never fault someone for taking a well informed risk in order to better serve our customers.
  • Integrity: We never mislead customers or prospects or act against their best interests, and we are open and honest with our fellow Moose.
  • Never Done: This is not a clock-in / clock-out kind of job. While many days are predictable, others are not. Our North Star is customer outcomes, not time-based.
  • Glass Half Full: Security operations can be unforgiving—but we will remain positive and optimistic.
  • Have Fun: Get your job done, but have fun doing it.

We’re always looking for great security professionals to join our team. If the above piques your interest and you’re looking to join a part of something special, come check out our open Career opportunities.

Automating Qakbot Detection at Scale With Velociraptor

Post Syndicated from Rapid7 original https://blog.rapid7.com/2023/04/18/automating-qakbot-detection-at-scale-with/

Automating Qakbot Detection at Scale With Velociraptor

By Matt Green, Principal Software Engineer

In this blog, you will learn a practical methodology to extract configuration data from recent Qakbot samples. I will provide some background on Qakbot, then walk through decode themes in an easy to visualize manner. Additionally, I’ll share a Velociraptor artifact to detect and automate the decode process at scale.

QakBot or QBot, is a modular malware first observed in 2007 that has been historically known as a banking Trojan. Qakbot is used to steal credentials, financial, or other endpoint data, and in recent years, regularly a loader for other malware leading to hands-on-keyboard ransomware.

Malicious emails typically include a zipped attachment, LNK, Javascript, Documents, or an embedded executable. The example shown in this post was delivered by an email with an attached pdf file:

Automating Qakbot Detection at Scale With Velociraptor
An example Qakbot infection chain

Qakbot has some notable defense evasion capabilities including:

  1. Checking for Windows Defender sandbox and terminating on discovery.
  2. Checking for the presence of running anti-virus or analysis tools, then modifying its later stage behavior for evasion.
  3. Dynamic corruption of payload on startup and rewrite on system shutdown.

Due to the commodity nature of Qakbot delivery, capabilities, and end game,  it is worth extracting configuration from observed samples to scope impact from a given campaign. Hunting enterprise-wide and finding a previously missed machine or discovering an ineffective control can prevent a domain-wide ransomware event or similar cyber attacks.

Configuration

Qakbot has an RC4 encoded configuration, located inside two resources of the unpacked payload binary. The decryption process has not changed significantly in recent times, but for some minor key changes. It uses a SHA1 of a hard coded key that can typically be extracted as an encoded string in the .data section of the payload binary. This key often remains static across campaigns, which can speed up analysis if we maintain a recent key list.

Current samples undergo two rounds of RC4 decryption with validation built in. The validation bytes dropped from the data for the second round.

After the first round:

  • The first 20 bytes in hex is for validation and is compared with the SHA1 of the remaining decoded data
  • Bytes [20:40] is the key used for the second round of decoding.
  • The Data to decode is byte [40:] onwards
  • The same validation process occurs for the second round decoded data
  • Verification = data[:20]
  • DecodedData = data[20:]
Automating Qakbot Detection at Scale With Velociraptor
First round of Qakbot decode and verification

Campaign information is located inside the smaller resource where, after this decoding and verification process, data is clear text.

Automating Qakbot Detection at Scale With Velociraptor

The larger resource stores Command and Control configuration. This is typically stored in netaddress format with varying separators. A common technique for finding the correct method is searching for common ports and separator patterns in the decoded data.

Automating Qakbot Detection at Scale With Velociraptor
Easy to spot C2 patterns: port 443

Encoded strings

Qakbot stores blobs of xor encoded strings inside the .data section of its payload binary. The current methodology is to extract blobs of key and data from the referenced key offset which similarly is reused across samples.

Current samples start at offset 0x50, with an xor key, followed by a separator of 0x0000 before encoded data. In recent samples, we have observed more than one string blob and these have occurred in the same format after the separator.

Automating Qakbot Detection at Scale With Velociraptor
Encoded strings .data

Next steps are splitting on separators, decode expected blob pairs and drop any non printable. Results are fairly obvious when decoding is successful as Qakbot produces clean strings. I typically have seen two well defined groups with strings aligning to Qakbot capabilities.

Automating Qakbot Detection at Scale With Velociraptor
Decoded strings: RC4 key highlighted‌‌

Payload

Qakbot samples are typically packed and need execution or manual unpacking to retrieve the payload for analysis. It’s very difficult to obtain this payload remotely at scale, in practice the easiest way is to execute the sample in a VM or sandbox that enables extracting the payload with correct PE offsets.

When executing locally Qakbot typically injects its payload into a Windows process, and can be detected with yara targeting the process for an unbacked section with `PAGE_EXECUTE_READWRITE` protections.

Below, we have an example of running PE-Sieve / Hollows Hunter tool from Hasherezade. This helpful tool enables detection of several types of process injection, and the dumping of injected sections with appropriately aligned headers. In this case, the injected process is `wermgr.exe` but it’s worth to note, depending on variant and process footprint, your injected process may vary.

Automating Qakbot Detection at Scale With Velociraptor
Automating Qakbot Detection at Scale With Velociraptor
Dumping Qakbot payload using pe-sieve

Automation at scale

Now I have explained the decode process, time to enable both detection and decode automation in Velociraptor.

I have recently released Windows.Carving.Qakbot which leverages a PE dump capability in Velociraptor 0.6.8 to enable live memory analysis. The goal of the artifact was to automate my decoding workflow for a generic Qakbot parser and save time for a common analysis. I also wanted an easy to update parser to add additional keys or decode nuances when changes are discovered.

Automating Qakbot Detection at Scale With Velociraptor
Windows.Carving.Qakbot: parameters

This artifact uses Yara to detect an injected Qakbot payload, then attempts to parse the payload configuration and strings. Some of the features in the artifact cover changes observed in the past in the decryption process to allow a simplified extraction workflow:

  • Automatic PE extraction and offset alignment for memory detections.
  • StringOffset: the offset of the string xor key and encoded strings is reused regularly.
  • PE resource type: the RC4 encoded configuration is typically inside 2 resources, I’ve observed BITMAP and RCDATA
  • Unescaped key string: this field is typically reused over samples.
  • Type of encoding: single or double, double being the more recent.
  • Hidden TargetBytes parameter to enable piping payload in for analysis.
  • Worker threads: for bulk analysis / research use cases.
Automating Qakbot Detection at Scale With Velociraptor
Windows.Carving.Qakbot: live decode 

Research

The Qakbot parser can also be leveraged for research and run bulk analysis. One caveat is the content requires payload files that have been dumped with offsets intact. This typically requires some post collection filtering or PE offset realignment but enables Velociraptor notebook to manipulate post processed data.

Some techniques I have used to bulk collect samples:

  • Sandbox with PE dumping features: api based collection
  • Virustotal search: crowdsourced_yara_rule:0083a00b09|win_qakbot_auto AND tag:pedll AND NOT tag:corrupt (not this will collect some broken payloads)
Automating Qakbot Detection at Scale With Velociraptor
Bulk collection: IPs seen across multiple campaign names and ports

Some findings from a small data set ~60 samples:

  • Named campaigns are typically short and not longer than a few samples over a few days.
  • IP addresses are regularly reused and shared across campaigns
  • Most prevalent campaigns are “BB” and  “obama” prefixed
  • Minor campaigns observed: “azd”, “tok”  and “rds” with only one or two observed payload samples each.

Strings analysis can also provide insights to sample behavior over time to assist analysis. A great example is the adding to process name list for anti-analysis checks.

Automating Qakbot Detection at Scale With Velociraptor
Bulk collection: Strings highlighting anti-analysis check additions over time

Conclusion

PE dumping, which is not available in expensive paid tools, is a useful capability and enables advanced capability at enterprise scale. For widespread threats like Qakbot, this kind of content can significantly improve response for blue teams, or even provide insights into threats when analyzed in bulk. In the coming months, we will be publishing a series of similar blog posts, offering a sneak peek at some of the types of memory analysis enabled by Velociraptor and incorporated into our training courses.

I also would like to thank Jakob Denlinger and James Dunne for their assistance in writing this post.

References

  1. Malpedia, QakBot
  2. Elastic, QBOT Malware Analysis
  3. @hasherezade.  Hollows Hunter, https://github.com/hasherezade/hollows_hunter

Anarchy in the UK? Not Quite: A look at the cyber health of the FTSE 350

Post Syndicated from Rapid7 original https://blog.rapid7.com/2023/04/13/anarchy-in-the-uk-not-quite-a-look-at-the-cyber-health-of-the-ftse-350/

Anarchy in the UK? Not Quite: A look at the cyber health of the FTSE 350

The attack surface of the United Kingdom’s 350 largest publicly traded companies has—drum roll, please—improved. But it could be better. Those are the high level findings of the latest in Rapid7’s looks at the cybersecurity health of companies tied to some of the globe’s largest stock indices. This is the second time in more than two years that we looked at the FTSE 350 to gauge how well the entire UK’s business arena is faring against cyber threats. Turns out, they’ve improved in that time, and are on par with the other big indices we’ve looked at, though in some specific places, there is definitely room for improvement.

We chose the FTSE 350 as a benchmark in determining the cyber health of UK businesses because they are by and large some of the largest companies in the country and are not as resource constrained as some other, smaller, companies might be. This gives us a pretty even playing field on which to analyze their health and extrapolate out to the overall health of the region. We’ve done this with several other indices (most recently the ASX 200) and find it works well to provide a snapshot of what’s going on in the region.

In this report, we looked first at the overall attack surface of the FTSE 350 companies, broken down by industry. We also looked at the overall health of their email and web server security. All three areas showed improvement, as well as points for concern.

Attack Surface

By and large, the attack surfaces of the companies that make up the FTSE 350 was quite limited and in line with other major indices around the world. But, when you look at the individual industries that make up the FTSE you start to see some red flags.

For instance, financial and technology companies have by far the largest vulnerability through high risk ports exposed to the internet. Technology companies averaged well over 1000 ports with internet exposure and financial companies averaged nearly 800. That is 4 and 5 times the next highest industry (respectively). When it comes to particularly high risk ports, the financial sector is the biggest offender with an average of 12 high risk ports. For comparison, the technology sector had three.

Email Security

Email security is one area where we’ve seen some laudable improvement over the last time we looked at the FTSE 350. For instance, use of Domain-based Message Authentication, Reporting & Conformance (DMARC) policy is up 29%. However, the implementation of Domain Name System Security Extensions (DNSSEC) is at just 4% of the 350 companies that make up the index. Sadly, this too is on par with other indices. They should all seek improvements (alright, we’ll get off our soapbox).

Web Server Security

Going after vulnerable web servers is a favorite vector for attackers. When looking at the status of FTSE 350 company web servers we found that of the three most common types (NGinx, Apache, and IIS), not all were running high enough percentages of supported or fully patched versions. For instance, some 40% of NGinx servers were supported or fully patched, whereas 89% of Apache and 80% of IIS servers were. That’s a pretty big discrepancy. Thankfully, Apache and IIS are the dominant servers in this region, minimizing the overall risk.

If you want to take a look at our report you can read it here. If you’d like to check out the report we conducted for Australia’s ASX 200 it is available here.

7 Rapid Questions: Lindsey Searle

Post Syndicated from Rapid7 original https://blog.rapid7.com/2023/04/11/7-rapid-questions-lindsey-searle/

7 Rapid Questions: Lindsey Searle

Welcome back to 7 Rapid Questions, our blog series where we ask passionate leaders at Rapid7 to give us an inside look at what it’s like to work on their team, and how they’re creating an impact every day.

In this installment, we talk to Lindsey Searle, Senior Manager, Customer Advisors on how her team helps solve customer challenges, and how candidates can stand out in the interview process.

What kind of challenges are you/your team responsible for solving for customers?

The security space is evolving every day as hackers continue to advance. Many customer teams find themselves overwhelmed and in need of more customized services to stay ahead, and that’s where we can help support.

Our team is the face of Rapid7 for Managed Services customers. We provide advisory services for clients of all shapes and sizes and at all levels of their security maturity journeys. The Customer Advisor team works closely with the Security Operations Center (SOC) to monitor customers’ in-scope environments and provide custom tailored guidance to enhance their security posture. Many of our customers consider us an extension of their in-house security team, and we strive to build close knit working relationships and trust with each and every one of them.

In addition to day to day monitoring, our Customer Advisors work with our clients to understand their security goals, make recommendations to achieve those goals, and are personally invested in seeing those initiatives through to completion.

What does your team look like (team size, types of teams etc.), what growth has there been?

The Customer Advisor organization at Rapid7 grew by 30% last year—we added 35 new people to the team in 2022, including Advisors at all levels, four new managers, and a Vice President.

Our team is composed of all levels of security professionals, from associate CAs at the start of their career to tenured Lead and Principal Advisors. We have CAs supporting all three branches of Managed Services, and our teams are blended across Managed Detection and Response (MDR), Managed Vulnerability Management (MVM), and Managed Application Security (MAS) to allow for cross functional collaboration and learning.

We are fortunately in a position where as our Managed Services business grows, our Customer Advisor team has continued to expand, as it is a standard part of the service offering.

What makes the culture at R7 different from other tech / cyber security companies?

I always find it difficult to describe the Rapid7 culture when I interview candidates because it’s something that you really have to see to understand and believe. The underlying fact is that all Rapid7 employees are passionate about security—we are here because we want to help our customers succeed, and we truly enjoy working together for that common goal.

At the same time, every single person is unapologetically unique and does not hesitate to bring their own perspective to the table. We have a great balance of external hires bringing in fresh ideas, as well as internal hires that provide a different approach to a situation when you’ve worked on the other side of the curtain.

What 3 biggest things have you learned in your time at Rapid7?

One: Take the time to thank people for helping you out! We do ‘guitar picks’ at Rapid7—it’s an internal website where you can give fellow moose a virtual kudos and recognition, whether it be for a great presentation they gave, or for filling in for you on an assignment, or for just being awesome. Everyone in the company can see it, and the recipient gets a notification that they’ve received one. Sending a pick takes minutes but can make someone’s day! Our Chief People Officer selects a guitar pick submission and sends it out to the whole company every morning. It’s a quick and meaningful way to thank those around us.

Two: Don’t be afraid to ask questions—we are all constantly learning and there is definitely someone out there who can help.

Three: There is a Slack emoji for just about every situation, and if it doesn’t exist—make one! In fact, our recent Slack migration took longer than expected due to the 10,000+ custom emojis that Rapid7 employees have created. One of our core values is ‘Bring You’ so this is just one example of how people are getting creative to express themselves in different ways and build camaraderie in a globally distributed organization.

How does Rapid7 set you up for success in your role?

I was incredibly impressed with the corporate onboarding provided by Rapid7 when I went through it myself in late 2021. You attend your onboarding sessions with all new hires starting at the company that week and already start to build a network within your first few hours here.

Rapid7 is big on encouraging Insight Coffees—an informal 30 minute meeting with another Rapid7 employee to get to know them on a personal and professional level. Those connections stick with you throughout your time here and only strengthen your ability to work together down the road.

Our company culture is built around helping each other and working together as a team, which puts you in a great spot to be successful in your role.

What can a candidate do to stand out in the interview process?

Honestly, just be yourself—Bring You is a core value at Rapid7 and something that truly sets us apart from other companies. Finding people who embrace our collaborative culture and partner well to share ideas is a major piece of the Rapid7 interview process. These soft skills weigh as heavily as prior work experience and technical competency. Your individuality will set you apart from other candidates—so let your true self shine!

What advice would you give someone thinking about coming to work here?

Bring energy and enthusiasm, and take the time to build meaningful relationships with the people you work with. It is much easier to wake up and log on for the day when you are looking forward to interacting with your team members and your customers. At Rapid7 we live by the core value of ‘Impact Together’—teamwork makes the dream work! We have a far greater chance at success when working together than we do when trying to climb the ladder individually.

To learn more about Rapid7 Managed Services:

CLICK HERE

Raptor Technologies Volunteer Management Client-Side Security Controls (FIXED)

Post Syndicated from Rapid7 original https://blog.rapid7.com/2023/04/11/raptor-technologies-volunteer-management-client-side-security-controls-fixed/

Raptor Technologies Volunteer Management Client-Side Security Controls (FIXED)

Prior to Mar 18, 2023, due to a reliance on client-side controls, authorized users of Raptor Technologies Volunteer Management SaaS products could effectively enumerate authorized users, and could modify restricted and unrestricted fields in the accounts of other users associated with the same Raptor Technologies customer.  

Product description

Raptor Technologies Volunteer Management for Schools product is used by school districts to authenticate pre-approved volunteers, and print badges for the volunteers to use for entry to the school.  

Each volunteer has an account in the Raptor Technologies system, and the account contains information about the volunteer, a photo which matches the volunteer’s photo ID,  details of what buildings access is allowed to, and for what activities.  This account is set up and populated by school officials after a potential volunteer submits an online application for access.

Credit

This issue was discovered by Tony Porterfield, Principal Cloud Solutions Architect at Rapid7, while using the application as an end-user.  It is being disclosed in accordance with Rapid7’s vulnerability disclosure policy.

Exploitation

Prior to the fix deployed by Raptor Technologies on March 18, 2023,  lack of server-side authorization checks allowed an authenticated user to edit restricted fields in the user’s own account and other users’ accounts.  There are client-side controls in place to prevent these accesses, but there were gaps in the server-side checking that allowed crafted API requests to make these changes to user records.

There is a PersonID field in the profile update request payload, and it was possible to modify another user’s account by using a PersonID field that did not match that of the authenticated user.   The PersonID is observed to be a relatively short decimal number that may have been prone to enumeration.  The Community feature provides a list of all users with access to the same schools who have agreed to have their contact information shared.  The user list returned by the server contains the PersonID for each user listed, which would have allowed an adversary to make targeted changes to specific user accounts within the community.  

An example of a user’s profile page is shown below. The areas highlighted in yellow contain identity and access information sourced from the application submitted by the user. Controls in the browser client prevent a user from editing these fields when updating the profile.

Raptor Technologies Volunteer Management Client-Side Security Controls (FIXED)

When the Save button is clicked, a POST to
apps.raptortech.com/Portal/Profile/Save

Is initiated, with a payload of content type:
Content-Type: application/x-www-form-urlencoded

The payload includes all of the fields visible on the page (along with some that are not). The fields in this POST request’s payload are listed below, with personal information redacted.

Person.ImageName=<redacted>&
Person.PersonId=<redacted>&
Person.PersonaType=<redacted>&
Person.RequireDateOfBirth=True&
Person.RequireIdNumber=False&
Person.IdNumber_Short=<redacted>&
Scope=Client&
Person.IsOfficial=True&
Person.FirstName=<redacted>
Person.MiddleName=<redacted>&
Person.LastName=<redacted>&
Person.DateOfBirth=<redacted>&
Person.IdType=<redacted>DLID
&Person.IdNumber=<redacted>&
MaidenName=&
Gender=Male
Race=Unspecified&
ExpirationDate=<redacted>&
HoursResetDate=<redacted>&
ModifyBuildingsEnabled=False&
Email=<redacted>&
Buildings[0]=<redacted>
Functions[0]=<redacted>&
AffiliationId=<redacted>&
ProfileId=<redacted>&
Person.RequireIdType=False&
Address.Id=<redacted>
&Address.IsRequired=False&
Address.IsInternationalCountry=False&
Address.IsRequiredAndIsNotInternationalCountry=False&
Address.Line1=<redacted>&
Address.Line2=&
Address.Line3=&
Address.City=<redacted>&
Address.State=<redacted>&
Address.ZipCode=<redacted>&
Address.Country=US&
PrimaryPhone=<redacted>&
SecondPhone=&
ThirdPhone=&
PreferredLanguage=0

Impact

Updating Restricted Fields: Fields that the client prevents from modifying could be changed in the apps.raptortech.com/Portal/Profile/Save body, with the results persisting in the user’s profile. Thus, it was possible to modify restricted fields related to the user’s identity by manipulating this request’s payload.

Updating other users’ information: The payload of the Portal/Profile/Save request includes a field for the Person.PersonID. It was possible to modify the profile of another user associated with the same Raptor Technologies customer by entering the other user’s Person.PersonID in the payload of the request.

Community feature discloses PersonIDs: The ‘Community’ feature presents a list of other members of the user’s community, who have opted in to sharing their information. The browser interface only displays the users’ names and contact information. However, the list of information returned by the server for the
apps.raptortech.com/Portal/Community/gvVolunteerContactInformation_Read
endpoint includes each community member’s PersonID. Prior to the fix, this information disclosure could be combined with the lack of server-side authorization checks to make targeted changes to the accounts of other community members.

The fields included for each user in the response are listed below for reference:

{
    "$id": "2",
    "PersonId": <6 or 7 digits>,
    "ProfileId": <5 digits>,
    "FirstName": "<redacted>",
    "LastName": "<redacted>",
    "PrimaryPhone": "<redacted>",
    "SecondPhone": "",
    "Email": "<redacted>",
    "AllowToContact": true,
    "PreventFromBeingContacted": false,
    "PrimaryPhoneDisplay": "<redacted>",
    "SecondPhoneDisplay": ""
}

Remediation

On March 18, 2023, Raptor Technologies deployed an update to its Volunteer Management application to address this issue.

Since this is a SaaS / cloud-hosted solution, end users, implementers and integrators should not need to do anything to update or patch to address the issue.

Disclosure Timeline

January, 2023: Issues discovered by Tony Porterfield of Rapid7
Tue, Jan 10, 2023: First contact to the vendor, opened ticket #00711217
Mon, Jan 30, 2023: Case opened with CERT/CC, VRF#23-01-NGZBZ
Fri, Feb 17, 2023: CERT/CC VINCE case VU#679276 opened
Fri, Mar 3, 2023: Report acknowledged by the vendor, clarifications provided
Wed, Mar 8, 2023: Details discussed with the vendor, extended disclosure time by approximately 30 days
Sat, Mar 18, 2023: Fixes deployed
Tue, Apr 11, 2023: This disclosure

Rapid7 Announces Partner of the Year Awards 2023 Winners

Post Syndicated from Rapid7 original https://blog.rapid7.com/2023/03/30/rapid7-announces-partner-of-the-year-awards-2023-winners/

Rapid7 Announces Partner of the Year Awards 2023 Winners

It’s with immense pleasure that we announce today the winners of the Rapid7 Partner of the Year Awards 2023. All our category winners have achieved exceptional growth—demonstrating their dedication to, and collaboration with, the Rapid7 Partner Program throughout the year.

“We are incredibly honoured to accept the Rapid7 Partner of the Year Award. This recognition is a testament to the hard work and dedication of our entire team, as well as the strong partnership we have built with Rapid7,” said Tim Sank, Co-Founder of Cythera. “This award is not only a validation of our collective efforts but also a motivation to continue delivering best-in-class security solutions to help protect businesses across the APAC region. We are proud to be a Rapid7 partner and we look forward to many more years of success together.”

We’re very proud to share our complete list of winners. Please join us in congratulating them all.

APAC

Rapid7 APAC Partner of the Year: Cythera Pty Ltd Rapid7 Announces Partner of the Year Awards 2023 Winners
APAC Highest Customer Retention of the Year: The Missing Link Rapid7 Announces Partner of the Year Awards 2023 Winners
APAC Cloud Security Partner of the Year: DGplex Pty Ltd Rapid7 Announces Partner of the Year Awards 2023 Winners
APAC Detection & Response Partner of the Year: Blue Apache Pty Ltd Rapid7 Announces Partner of the Year Awards 2023 Winners
APAC Emerging Partner of the Year: Cyber Risk Rapid7 Announces Partner of the Year Awards 2023 Winners
APAC Vulnerability Management Partner of the Year: Datacom Group Ltd Rapid7 Announces Partner of the Year Awards 2023 Winners
APAC Managed Services Partner of the Year: Triskele Labs Rapid7 Announces Partner of the Year Awards 2023 Winners

EMEA

Rapid7 EMEA Partner of the Year: Softcat PLC Rapid7 Announces Partner of the Year Awards 2023 Winners
EMEA Best Customer Retention: Saepio Solutions Ltd Rapid7 Announces Partner of the Year Awards 2023 Winners
EMEA Cloud Security Partner of the Year: AllCloud Rapid7 Announces Partner of the Year Awards 2023 Winners
EMEA Detection & Response Partner of the Year: Switchpoint Rapid7 Announces Partner of the Year Awards 2023 Winners
EMEA Distributor of the Year: Infinigate Deutschland GmbH Rapid7 Announces Partner of the Year Awards 2023 Winners
EMEA Emerging Partner of the Year: Communication Systems GmbH Rapid7 Announces Partner of the Year Awards 2023 Winners
EMEA Fastest Growth Partner of the Year: Bytes Technology Group Rapid7 Announces Partner of the Year Awards 2023 Winners
EMEA Vulnerability Management Partner of the Year: Davinsi Labs Rapid7 Announces Partner of the Year Awards 2023 Winners
EMEA MSSP Partner of the Year: Integrity360 Rapid7 Announces Partner of the Year Awards 2023 Winners

North America

Rapid7 North America Partner of the Year: CDW Corporation Rapid7 Announces Partner of the Year Awards 2023 Winners
North America Best Customer Retention: Insight Rapid7 Announces Partner of the Year Awards 2023 Winners
North America Cloud Security Partner of the Year: SHI International Corp. Rapid7 Announces Partner of the Year Awards 2023 Winners
North America Detection & Response Partner of the Year: Cyber Watch Systems Rapid7 Announces Partner of the Year Awards 2023 Winners
North America Distribution Partner of the Year: Liquid PC Rapid7 Announces Partner of the Year Awards 2023 Winners
North America Emerging Partner of the Year: Alchemy Technology Group, LLC Rapid7 Announces Partner of the Year Awards 2023 Winners
North America Fastest Growth Partner of the Year: Bird Rock Systems, Inc Rapid7 Announces Partner of the Year Awards 2023 Winners
North America Vulnerability Management Partner of the Year: Optiv Security Inc. Rapid7 Announces Partner of the Year Awards 2023 Winners
North America MSSP Partner of the Year: Acrisure Cyber Services Rapid7 Announces Partner of the Year Awards 2023 Winners

More about our partner program

The Rapid7 PACT Program is built to inspire our partners to grow with us and achieve mutual success through accountability, consistency, and transparency. By participating in the program, partners can offer powerful, industry-leading solutions to our joint customers, resulting in mutual success for all.

If you’re interested in becoming a Rapid7 partner, you can learn more here.

Congratulations again to all our winners!

Backdoored 3CXDesktopApp Installer Used in Active Threat Campaign

Post Syndicated from Rapid7 original https://blog.rapid7.com/2023/03/30/backdoored-3cxdesktopapp-installer-used-in-active-threat-campaign/

Backdoored 3CXDesktopApp Installer Used in Active Threat Campaign

Emergent threats evolve quickly. We will update this blog with new information as it comes to light and we are able to verify it. Erick Galinkin, Ted Samuels, Zach Dayton, Caitlin Condon, Stephen Fewer, and Christiaan Beek all contributed to this blog.

On Wednesday, March 29, 2023, multiple security firms issued warnings about malicious activity coming from a legitimate, signed binary from communications technology company 3CX. The binary, 3CXDesktopApp, is popular video-conferencing software available for download on all major platforms. Several analyses have attributed the threat campaign to state-sponsored threat actors.

Rapid7’s threat research teams analyzed the 3CXDesktopApp Windows binary and confirmed that the 3CX MSI installer drops the following files: 3CXDesktopApp.exe, a benign file that loads the backdoored ffmpeg.dll, which reads an RC4-encrypted blob after the hexadecimal demarcation of fe ed fa ce in d3dcompiler.dll. The RC4-encrypted blob in d3dcompiler.dll is executable code that is reflectively loaded and retrieves .ico files with appended Base64-encoded strings from GitHub. The encoded strings appear to be command-and-control (C2) communications. There is a non-exhaustive list of indicators of compromise (IOCs) at the end of this blog.

Rapid7 reached out to GitHub’s security team the evening of March 29 about the GitHub repository being used as adversary infrastructure in this campaign. As of 9:40 PM ET, the malicious user has been suspended and the repository is no longer available.

Rapid7 Managed Detection and Response (MDR) has observed the backdoored 3CX installer and components in several customer environments as of March 29, 2023. Rapid7 MDR is in contact with customers that we believe may be impacted.

Mitigation Guidance

Official guidance from 3CX confirms that the Windows Electron client running update 7 is affected. However, security firm CrowdStrike indicated in a Reddit thread on March 29 that malicious activity has been observed on both Windows and Mac. Out of an abundance of caution, a conservative mitigation strategy would be to uninstall 3CXDesktopApp on all platforms and remove any artifacts left behind. Users should retroactively hunt for indicators of compromise and block known-bad domains. There is a non-exhaustive list of known-bad domains and malicious file hashes at the end of this blog.

3CX has a browser-based Progressive Web App (PWA) that does not require the user to download an executable file. Their CEO has suggested users leverage this PWA for the time being instead of downloadable clients.

Rapid7 customers

The following new rules have been added for Rapid7 InsightIDR and Managed Detection & Response (MDR) customers and will alert on known-bad hashes and file versions of the backdoored executable, as well as known-bad domains in WEB_PROXY and DNS logs:

  • Suspicious Web Request – 3CX Desktop Supply Chain Compromise
  • Suspicious DNS Request – 3CX Desktop Supply Chain Compromise
  • Suspicious Process – 3CX Desktop Supply Chain Compromise

InsightVM and Nexpose customers can use Query Builder or a Filtered Asset Search to find assets in their environment with 3CX installed using Software Name contains 3CX Desktop App.

A Velociraptor artifact is available here.

Indicators of compromise

A non-exhaustive list of known-bad domains is below. We advise blocking these immediately:

akamaicontainer[.]com
akamaitechcloudservices[.]com
azuredeploystore[.]com
azureonlinecloud[.]com
azureonlinestorage[.]com
convieneonline[.]com
dunamistrd[.]com
glcloudservice.[.]
journalide[.]org
msedgepackageinfo[.]com
msstorageazure[.]com
msstorageboxes[.]com
officeaddons[.]com
officestoragebox[.]com
pbxcloudeservices[.]com
pbxphonenetwork[.]com
pbxsources[.]com
qwepoi123098[.]com
sbmsa[.]wiki
sourceslabs[.]com
Soyoungjun[.]com
visualstudiofactory[.]com
zacharryblogs[.]com

More granular URLs our team has decrypted from C2 communications include:

hxxps[://]akamaitechcloudservices[.]com/v2/storage
hxxps[://]azuredeploystore[.]com/cloud/services
hxxps[://]azureonlinestorage[.]com/azure/storage
hxxps[://]glcloudservice[.]com/v1/console
hxxps[://]msedgepackageinfo[.]com/microsoft-edge
hxxps[://]msedgeupdate[.]net/Windows
hxxps[://]msstorageazure[.]com/window
hxxps[://]msstorageboxes[.]com/office
hxxps[://]officeaddons[.]com/technologies
hxxps[://]officestoragebox[.]com/api/session
hxxps[://]pbxcloudeservices[.]com/phonesystem
hxxps[://]pbxphonenetwork[.]com/voip
hxxps[://]pbxsources[.]com/exchange
hxxps[://]sourceslabs[.]com/downloads
hxxps[://]visualstudiofactory[.]com/workload
hxxps[://]www[.]3cx[.]com/blog/event-trainings/
hxxps[://]zacharryblogs[.]com/feed

File hashes:

Compromised MSI: aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868 

3CXDesktopApp.exe: fad482ded2e25ce9e1dd3d3ecc3227af714bdfbbde04347dbc1b21d6a3670405
ffmpeg.dll: 7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896
d3dcompiler_47.dll: 11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03

The following file hashes have been reported as related and malicious by the community but not independently verified by Rapid7 analysts:

dde03348075512796241389dfea5560c20a3d2a2eac95c894e7bbed5e85a0acc
92005051ae314d61074ed94a52e76b1c3e21e7f0e8c1d1fdd497a006ce45fa61
b86c695822013483fa4e2dfdf712c5ee777d7b99cbad8c2fa2274b133481eadb

Executive Webinar: Confronting Security Fears to Control Cyber Risk, Part Three

Post Syndicated from Rapid7 original https://blog.rapid7.com/2023/03/29/executive-webinar-confronting-security-fears-to-control-cyber-risk-part-three/

Executive Webinar: Confronting Security Fears to Control Cyber Risk, Part Three

In the final installment of our webinar “Confronting Security Fears to Control Cyber Risk,” Jason Hart, Rapid7’s Chief Technology Officer, EMEA, discusses how adopting a cyber target operating model can eliminate cybersecurity silos and increase the effectiveness of your cybersecurity program. If you haven’t already, watch parts one and two before delving into this final segment.

Part One: Cybersecurity Simplicity focused on how to encourage everyone associated with your organization to develop a cybersecurity mindset. To accomplish this, Hart recommends that CISOs decentralize cybersecurity to instill accountability and ownership across the entire business.

Part Two: Cybersecurity Elasticity focused on why organisations must develop the ability to adapt while being able to quickly revert to their original structure after times of great stress and impact.

In the presentation, Hart details how executives can create a Protection Level Agreement (PLA) between the security department and senior leadership team, ensuring everyone works to a common timeline and goals. Measuring success and identifying weaknesses in a PLA is also key. Cybersecurity tools that automate reporting on a wide variety of KPIs can help security teams communicate effectiveness to leadership.

Operationalising Cybersecurity

Part Three: Cybersecurity Tranquility offers practical and actionable advice on how to implement a target operating model that aligns with your business, reduces risks and enables a positive security culture.

In the presentation, Hart outlines a twelve step process to operationalise security:

  1. Understand what an operating model is and map out key dependencies for scope, risk, PLA, and KPIs.
  2. Document your current operating model.
  3. Undertake mapping of scope and categorize business functions by impact.
  4. Implement KPIs to track the effectiveness of your current operating model.
  5. Use data from KPIs aligned to business functions to show the effectiveness of the current operating model.
  6. Implement PLAs to align the business, process and technology to drive change.
  7. Present monthly PLAs to stakeholders and business functions to measure effectiveness from current operating model to target operating model.
  8. Enable automation of KPI data aligned to core foundations to feed into PLA.
  9. Identify process and accountability challenges using PLAs underpinned by KPI data.
  10. Use the PLA to explain and show the effectiveness of cybersecurity investment.
  11. Apply the same process to the next business function.
  12. Target operating model starts to form part of the business process.

Related assets:

Celebrating Women’s History Month at Rapid7

Post Syndicated from Rapid7 original https://blog.rapid7.com/2023/03/22/celebrating-womens-history-month-at-rapid7/

Celebrating Women’s History Month at Rapid7

Each March, we reflect on the historical accomplishments and ongoing need to support women. This, of course, should be embraced all 12 months of the year, but Women’s History Month gives us a special opportunity to learn from, celebrate, and amplify the voices of women.

At Rapid7, we’re shining a light on women’s voices all month long with special events and panel discussions, while recommitting to the ongoing efforts that last all year long. Below you’ll find some highlights from our International Women’s Day panel, which focused equity, inclusion, and advocacy in the workplace.

Rapid7 International Women’s Day Panel

This year’s panel focused on the difference between equity and equality. While historically the focus has been on creating equal opportunities, it’s argued that focusing instead on equitable policies is more effective, as it takes into account the advantages and disadvantages of each individual’s circumstance.

“If we want to drive equitable processes to create an EQUAL playing field, we need to recognize the advantages and disadvantages that are out there today, and address them,” said Laura Ellis, Rapid7 Vice President of Data Engineering and Platform Analytics.

Creating equitable processes requires a dedicated effort and requires us to lean into hard conversations to address common stigmas. If organizations are committed to creating equitable policies and practices, having a culture that supports safe spaces is essential in getting to the most impactful solutions.

“Safety comes easy for a lot of our dominant groups or leaders with a certain title—but we should be aware that it’s not always there for our non-dominant groups,” said Nancy Li, Rapid7 Director of Engineering. “Be open to trying different forums where people can speak. Your loudest voices aren’t always representative of the whole population.”

So, what are some practices that we can take into the workplace to help create more equitable workplaces? Here are a few additional takeaways from the discussion.

  1. Grow your teams with intention. If you are a hiring manager, or in a role where you influence hiring, slow down and partner with your Talent Acquisition team to ensure you’re seeking out a diverse candidate pool right from the start. Ask questions about where they are sourcing talent, what schools and universities they are historically partnering with, and see if there are opportunities to incorporate more diversity into the talent pipeline. It doesn’t stop once someone gets hired either—mentoring and providing support can help them gain the skills necessary to continue to advance their careers. Build out a multi dimensional team, and be open to the ways that each member’s different experiences can help fuel the innovation and creativity of the team.
  2. Be an Upstander for One Another. Many women on the panel shared experiences of when another woman or a male ally stood up for them in the moment. What was shared was that once you feel the support of someone standing up for you by pointing out something that wasn’t right, it makes that person feel even more comfortable passing that support on and standing up for someone else. As stated by one group member, “After an upstander demonstrates how you should be treated—what a difference it makes in your confidence, and in your ability to be an upstander for someone else and pay that forward. Embrace it and then pass it on and use it to support someone else.”
  3. Recognize that progress is fragile—we cannot lose focus. While women have made significant advancements in the workplace, the COVID-19 pandemic illustrated just how fragile this progress can be, especially when many women still bear the brunt of caregiving. While panelists observed progress being made and the gender diversity of the teams around them, they also pointed out that post pandemic, many women who left the workforce still have yet to return. In fact, the US Department of Labor reported that more than two years post-pandemic, women’s labor participation is still a full percentage point lower than what it was pre-pandemic. This means that roughly 1 million women are missing from the labor force. Flexible working policies provide a way to ensure that employees are able to balance their personal commitments and caregiving responsibilities with their work responsibilities. Offering this flexibility to both men and women in the workplace takes this one step further, as it was noted that even policies that are not exclusively for women, have the ability to impact women elsewhere as families are able to share responsibilities more equally.
  4. We all have imposter syndrome. Imposter syndrome isn’t something that is limited to a specific pay band or job level. We are consistently our own toughest critic, and can sometimes feel like there is “someone else” who should be taking advantage of an opportunity or stepping up to take on a leadership role. To combat imposter syndrome,  the panel recommended  looking around the room to determine where your skills can add value, and not being afraid to share that. It was also mentioned that many women are quick to brush off compliments when they are recognized for their work. However, it takes a lot for someone to go out of their way and pay you a compliment, so when that happens, lean into it and really listen to that positive feedback. Those moments can really make an impact on what you believe you are capable of, and make it easier to overcome that feeling of imposter syndrome. Finally, the group stressed the importance of leveraging the resources available to you through your employer, whether it’s access to therapy services or an employee assistance program. Sometimes the key to overcoming imposter syndrome is having someone help us reframe the situation, and shift our perspective. There’s no shame in speaking with someone who is trained to help us navigate all stages of life and career.
  5. Use your voice. Even if it shakes. When paving the path to a more equitable world, things aren’t going to be easy or comfortable the whole time. Continue to speak up and speak out – both for yourself, and for others.

This panel discussion took place on March 8th, and through the month our Women Impact Group will continue to partner with the business to host open and honest conversations and opportunities for reflection and education. This includes an allyship training session hosted by both our Women’s Impact Group and our PRIDE Impact Group, with guests from PFLAG.

In our internal communication channels, we’re spotlighting women in our organization who are making a considerable impact on our business and customers, shining an extra spotlight on the work and accomplishments of our own women at Rapid7. In a fireside chat, “Celebrating Women’s Voices”, leaders shared their own experiences in the workplace and the importance of sharing our journeys and building each other up. From parenting challenges to advocating for yourself and others, to moments of self doubt, these personal stories are shared to emphasize the importance of hard conversations and navigating challenges.

While we remain committed to uplifting the voices and representation of women in our industry throughout the year, we’re proud to have our Rapid Impact Groups driving these events in March that spark important conversations and provide real resources and opportunities for connection and community for our people.

Click here to learn more about our Rapid Impact Groups, and our ongoing commitment to diversity at Rapid7.

Practice Operations Manager Looks Back On First Five Months With Rapid7

Post Syndicated from Rapid7 original https://blog.rapid7.com/2023/03/20/practice-operations-manager-looks-back-on-first-three-months-with-rapid7/

Practice Operations Manager Looks Back On First Five Months With Rapid7

Elianna Sfez is a Detection and Response Practice Operations Manager based in Rapid7’s Tel Aviv office. As she approaches her six month anniversary with the company, we sat down to chat about her new hire journey, initial impressions and experiences in her new role, Rapid7 culture, and more.

Tell me about your role at Rapid7.

I am the Threat Intelligence Practice Operations Manager. My main goal is to help our teams work more efficiently on cross functional projects, whether that’s within our specific practices or between practice teams. Most of the projects I deal with are aimed at supporting the customer experience and improving the customer journey. In my role, I look at everything from R&D to Customer Success and Product and look for ways to deliver the best experience and journey for our customers. Typically, that means identifying bottlenecks and looking for ways to make things better.

What made you excited to join Rapid7?

In my career, I’ve worked with a mix of true startups, as well as companies that were transitioning from the startup phase to a more mature corporation by way of acquisition. This specific type of growth is really interesting to me—seeing the transformation happen as they move from a small startup to a larger company. With Rapid7, I was excited about the challenge of the role. With the maturity of the company and its acquisition of IntSights, I was really excited to be part of navigating that change for the team and building out this new role in Tel Aviv.

What are the major differences you see between working in a startup environment vs. a more global corporation?

There are a lot of differences moving from a startup to a larger corporation, mostly in the way you work and the pressure of the environment. In a startup, you have to be very reactive and respond to challenges at any time—even if it means being up at 3:00 am to troubleshoot issues. There’s a ‘whatever it takes’ mentality and as you are trying to build something from the ground up. It’s important to get that momentum going and have the ability to wear a lot of different hats to solve challenges. The CTO is often right in the trenches with you, and everyone is working around the clock to keep the business moving forward.

As you get larger, you have to get better at being proactive and seeing that fire coming, and figuring out how to fix it before it becomes an issue. Cybersecurity is a field where this is really important because hackers are advancing every day. We’re challenging ourselves to anticipate what customers are going to need 6 months, a year, or two years from now, so we can continue to stay ahead. In a bigger company you have more resources and people who are able to be experts in their areas of focus. We have teams that we can rely on for their insights and expertise, and you aren’t on your own to solve problems. You have more of a support system to lean on and that also helps you grow and learn too.

How would you describe your onboarding experience?

My onboarding experience was interesting, mostly because I don’t have any team members locally in Israel. My manager is in the US and we’re truly a global team. Regardless, people were really welcoming and amazing each step of the way. It was nice to meet other new hires from around the world during the global onboarding sessions, and everyone in the local office was eager to learn more about what I do, and how they can help.

My manager created an onboarding project plan which was also really helpful. I got to see an overview of what my first week would look like, what my first month would look like, and felt confident knowing everything was set up already. There was a good mix of meetings on my calendar with people my manager wanted me to connect with, but I also had enough unscheduled time where I was encouraged to do my own outreach and determine who else I would want to connect with and learn from as well.

Having ownership in the process made it really exciting and gave me permission to ask questions and learn more about the business. My manager even asked me to think about three things I wanted to go and learn more about or become an expert in. That permission to grow and learn right from the start is really empowering in terms of creating your own career path.

What do you enjoy most about your role?

I enjoy the challenge of working with a global team to help build and improve on our customer experiences. I feel I am creating an impact, and that I have the support of the people around me. One thing I’ve found here is that even if someone doesn’t have an answer to your question, they are more than happy to help you find the right person or go find out and circle back with you. Everyone here has new ideas, and those ideas are really welcome. People are curious and ask the right questions to get to the root of a challenge, and there’s an appetite to keep trying new things to find solutions.

How would you describe R7 to someone outside the company?

Everyone has a shared goal of bringing more value to our customers. That alignment helps us all feel connected and committed to helping each other get to the best outcomes possible. It’s a big job and it takes a lot of work, but it also gives you an incredible opportunity to grow in a place where you are supported and encouraged to try new things.

How do the Rapid7 values influence workplace culture?

The company is really living their core values, it’s not just something that they promote externally. Everyone is expected to be transparent and open, and everyone is really supportive in helping you grow and do the best work possible.

When it comes to workplace flexibility, there’s a culture where everyone trusts one another to do what they need to do. As a mom, this means I’m able to leave early and pick up my son and then jump on after hours to wrap things up. I’m having my second child in April, and Rapid7 hired me while I was pregnant. All of my team members were so welcoming and wonderful about this. I’ve even recommended a friend to cover for my role while I’m on maternity leave.

I honestly can’t say enough good things about the culture of the company, the values they have, and the exciting and interesting work that’s being done. There’s an opportunity to do really incredible and impactful work, but also have that space to create balance in our lives without being judged or feeling guilty.

To learn more about opportunities available at Rapid7, visit: careers.rapid7.com.

Executive Webinar: Confronting Security Fears to Control Cyber Risk, Part Two

Post Syndicated from Rapid7 original https://blog.rapid7.com/2023/03/14/executive-webinar-confronting-security-fears-to-control-cyber-risk-part-two/

Executive Webinar: Confronting Security Fears to Control Cyber Risk, Part Two

Part two of Confronting Security Fears to Control Cyber Risk was presented live on March 9th for EMEA and will be delivered on March 16th for APAC. The 40-minute session focuses on the importance of developing cybersecurity elasticity.

In the session, Jason Hart, Rapid7’s Chief Technology Officer, EMEA, will discuss how organisations can develop the ability to adapt while being able to quickly revert to their original structure after times of great stress and impact. To do so, organisations must first address some common cybersecurity challenges:

  • Alignment of ownership and accountability: Cybersecurity should be decentralised across the business–not just an IT security function
  • Scope on where to focus: Not all risks are equal and risk can compound based on business needs and transformation
  • Translation: The requirement to translate cybersecurity needs and requirements across the whole of a organisation

To accomplish these goals, Hart recommends focusing on:

  • Culture: Enable a culture that makes cybersecurity part of the business process and creates a culture of ownership and accountability
  • Measurement: Translating cybersecurity data to allow all organisational stakeholders and personas to understand the context and need
  • Direction: The creation of a Northstar “AKA” Cybersecurity Strategy that is clearly communicated and that has clearly defined objectives and outcomes

For many organizations, that strategy comes in the form of a Protection Level Agreement (PLA).

Cybersecurity Elasticity

A PLA is an agreement between two or more parties, where one is the business (stakeholders), and the others are protection provider(s) (Product Management, IT, 3rd Party Development). Both parties should be equally involved in creating and implementing the PLA, ensuring that expectations are realistic, needs are met, and all parties are bought in to the agreement.

In this session, Hart will detail how executives can create a PLA between the security department and senior leadership team, ensuring everyone works to a common timeline and goals. A well-designed PLA ensures teams are focused and efficient in responding to cybersecurity events. So, clearly defining who owns and is accountable for PLA responsibilities is essential.

Measuring success and identifying weaknesses in a PLA is also key. Cybersecurity tools that automate reporting on a wide variety of KPIs can help security teams communicate effectiveness to leadership.

To learn more, register here:

Confronting Security Fears to Control Cyber Risk: Part Two

REGISTER NOW

Cybersecurity Simplicity

Earlier this month, Rapid7 presented part one of a webinar called “Confronting Security Fears to Control Cyber Risk”. The webinar, available on demand, focused on cybersecurity simplicity and why everyone associated with your organization must develop a cybersecurity mindset. To do so, CISOs must decentralize cybersecurity and instil accountability and ownership across a business. If you haven’t already seen it, you can watch it below:

Related assets:

Confronting Security Fears to Control Cyber Risks Presentation
– Part 1 slides
– Part 2 slides

Target Operating Model KPIs

Implementing Protection Level Agreements

EMEA Executive Round Table

Insight VM Free Trial

Confronting Security Fears to Control Cyber Risk: Part Two

REGISTER NOW

Executive Webinar: Confronting Security Fears to Control Cyber Risk

Post Syndicated from Rapid7 original https://blog.rapid7.com/2023/02/28/executive-webinar-confronting-security-fears-to-control-cyber-risk/

Executive Webinar: Confronting Security Fears to Control Cyber Risk

Last week, Rapid7 presented part one of a webinar called “Confronting Security Fears to Control Cyber Risk”. The webinar, which is available on demand, focused on cybersecurity simplicity and why everyone associated with your organization must develop a cybersecurity mindset. To do so, CISOs must decentralize cybersecurity and instil accountability and ownership across a business.

In the session, which you can view below, Jason Hart, Rapid7’s Chief Technology Officer, EMEA, shared his experiences to help executives enhance their cyber mission and vision statements to create a positive cybersecurity culture that permeates the business.

Cybersecurity effectiveness

Historically, cybersecurity was seen as a very technical discipline, and as a result, it was siloed as a department. Today, cybersecurity has become a responsibility of the entire organization, and as a result, mindsets within organizations need to change to reflect this shift.

Additionally, many organizations have good ideas and intentions when it comes to cybersecurity, but poor execution results in under-utilized security stacks. Stakeholders and other executives assume CISOs know what they are doing and trust them to get on with it. Meanwhile, CISOs, coming from a very technical background, need more business transformation experience and communicate their vision. This must change to encourage cybersecurity effectiveness.

“As an industry, we have an amazing ability to overcomplicate cybersecurity,” Hart said. “With this presentation, I want to enable organizations to execute an effective cyber security target operating model that reduces risk.”

Operating model for cybersecurity

Organizations need an operating model that works with its technology platform to decentralize cybersecurity. The operating model should translate the technical aspects of cybersecurity into something more digestible for stakeholders.

It is critical that the operating model takes a top-down approach. To be effective, accountability for security measures should be led by teams at the top. It doesn’t stop there, however. Roles and responsibilities must be defined across the entire organization – every single individual needs to be part of the cybersecurity process. A successful operating model for cybersecurity empowers everyone within the business to think about security. By involving every individual, organizations can increase their cybersecurity effectiveness and share accountability across the business.

Additionally, the operating model should include tools to measure outcomes and effectiveness, so organizations can understand which processes are working. This ensures technology is fully utilized to deliver the best possible outcomes and ROI. You can watch part one of our presentation below that discusses these points in greater detail:

Related assets:

Cybersecurity elasticity

Part two of Confronting Security Fears to Control Cyber Risk will be presented live on March 9th for EMEA and March 16th for APAC.

In this session, you’ll learn why modern organizations need to develop the ability to adapt while being able to quickly revert to their original structure after times of great stress and impact. Hart will also detail how executives can create a Protection Level Agreement (PLA) with the security department, ensuring everyone works to a common timeline and goals.

Confronting Security Fears to Control Cyber Risk: Part Two

SAVE YOUR SEAT

Rapid7 CEO Corey E. Thomas Appointed To National Security Telecommunications Advisory Committee

Post Syndicated from Rapid7 original https://blog.rapid7.com/2023/02/16/rapid7-ceo-corey-e-thomas-appointed-to-national-security-telecommunications-advisory-committee/

Rapid7 CEO Corey E. Thomas Appointed To National Security Telecommunications Advisory Committee

President Biden has announced his intent to appoint a group of highly qualified and diverse industry leaders, including Rapid7 chairman & CEO Corey E. Thomas, to the President’s National Security Telecommunications Advisory Committee (NSTAC).

Rapid7 CEO Corey E. Thomas Appointed To National Security Telecommunications Advisory Committee

NSTAC’s mission is to to provide the best possible technical information and policy advice to assist the President and other stakeholders responsible for critical national security and emergency preparedness (NS/EP) services. The committee advises the White House on the reliability, security, and preparedness of vital communications and information infrastructure. It is focused on five key themes:

  • Strengthening national security
  • Enhancing cybersecurity
  • Maintaining the global communications infrastructure
  • Assuring communications for disaster response
  • Addressing critical infrastructure interdependencies and dependencies

Thomas joins a talented group of telecommunications and security executives from companies such as AT&T, Microsoft, Cisco, Lockheed Martin, T-Mobile, and Verizon. These executives bring diverse perspectives backed by years of unique industry experience.

“It is an extreme honor and privilege to be named to the President’s National Security Telecommunications Advisory Committee,” said Thomas. “I look forward to the remarkable opportunity to provide cybersecurity guidance to the President’s administration and to work alongside and learn from  this talented group of individuals, many of whom I’ve admired throughout my career.”

Rapid7 and USF: Building a diverse cybersecurity workforce is not optional

Post Syndicated from Rapid7 original https://blog.rapid7.com/2023/02/13/rapid7-and-usf-building-a-diverse-cybersecurity-workforce-is-not-optional/

Rapid7 and USF: Building a diverse cybersecurity workforce is not optional

By Raj Samani and Peter Kaes

Today marks an important day for Rapid7, for the state of Florida, and if we may be so bold, for the future of our industry. The announcement of a joint research lab between Rapid7 and the University of South Florida (USF) reaffirms our commitment to driving a deeper understanding of the challenges we face in protecting our shared digital space, while ushering in new talent to ensure that the cyber workforce of tomorrow is as diverse as the individuals who create the shared digital space we set out to protect.

With the Rapid7 Cybersecurity Foundation, we are proud to announce the opening of the Rapid7 Cyber Threat Intelligence Lab in Tampa, at USF.  We intend for the lab to be an integral component in real-time threat tracking by leveraging our extensive network of sensors, and incorporating this intelligence not only into our products and customers, but to make actionable indicators available to the wider community. This project also reaffirms our commitment to making cybersecurity more accessible to everyone through our support of research, disclosure, and open source, including projects such as Metasploit, Recog, and Velociraptor to name a few.

We believe that providing USF faculty and students this breadth of intelligence will not only support their journey in learning, but fundamentally provide a clearer path in determining areas to focus in their careers. We are hopeful that working side by side with Rapid7 analysts can help propel this journey, and enhance the meaningful research developed by the university.

As part of the commitment for this investment—and consistent with the guiding principles of the Rapid7 Cybersecurity Foundation—we intend to promote diversity within the cybersecurity workforce. In particular, we plan on opening doors to individuals from historically underrepresented groups within the cybersecurity workforce. With the objective to ensure that research projects are inclusive of those from all backgrounds, we are optimistic that not only will this introduce hands-on technical content to those who may not otherwise have such opportunities, but also, in the longer term, encourage greater diversity within the cybersecurity industry as a whole. We remain steadfast in our commitment to broadening the opportunities within cybersecurity to all those with a passion for creating a more secure and prosperous digital future.

We are deeply thankful to USF for their shared vision, and look forward to a partnership that benefits all students and faculty while producing actionable intelligence that can support the entire internet and the broader industry. Ultimately, the threatscape is such that we recognise no one organization can stop attackers on their own. This partnership remains part of our commitment to establish the relationships between private industry and partners that include academia.