5 min
Emerging Threats
Staying Secure in a Global Cyber Conflict
Now that Russia has begun its armed invasion of Ukraine, we should expect increasing risks of cybersecurity attacks and incidents, either as spillover from cyberattacks targeting Ukraine or direct attacks against actors supporting Ukraine.
3 min
Detection and Response
Demystifying XDR: How Curated Detections Filter Out the Noise
Forrester Analyst Allie Mellen chats with Rapid7's Sam Adams about how curated detections in XDR fight false positives.
5 min
Threat Intel
For Health Insurance Companies, Web Apps Can Be an Open Wound
Misconfigured web apps can leave your defenses wide open. Here's how health insurance providers can harden their web app security and protect their data.
1 min
InsightIDR
This CISO Isn’t Real, But His Problems Sure Are
The odds are stacked against this poor guy (and you) now – but a unified Extended Detection and Response (XDR) and SIEM restacks them in your favor.
3 min
Metasploit
Metasploit Weekly Wrap-Up: 2/18/22
Nagios XI web shell upload module
New this week is a Nagios Web Shell Upload module
from Rapid7' own
Jake Baines , which exploits CVE-2021-37343
. This
module builds upon the existing Nagios XI scanner
written
5 min
Vulnerability Management
What's New in InsightVM and Nexpose: Q4 2021 in Review
As we enter into the new year, we wanted to provide a recap of product releases and features in InsightVM and Nexpose for Q4 2021.
6 min
Log4Shell
Log4Shell 2 Months Later: Security Strategies for the Internet's New Normal
On Wednesday, February 16, Rapid7 experts Bob Rudis, Devin Krugly, and Glenn Thorpe sat down for a webinar on the current state of the Log4j vulnerability.
6 min
Cloud Security
Cloud Security and Compliance: The Ultimate Frenemies of Financial Services
Here are four ways finserv companies can embrace the love-hate relationship with cloud security and compliance while effectively navigating the need to maintain pace with today's rapid rate of change.
5 min
Cloud Security
The Future of Finserv Security: Cloud Expert and Former CISO Anthony Johnson Weighs In
Former CISO Anthony Johnson talks about the latest developments in finserv security and how these developments are being received within the industry.
4 min
Public Policy
Prudent Cybersecurity Preparation for the Potential Russia-Ukraine Conflict
Fending off an attack from a well-resourced nation state is a nightmare scenario for cybersecurity teams. Here are some steps your organization can take to bolster its defenses.
7 min
Application Security
How InsightAppSec Detects Log4Shell: Your Questions Answered
In this post, we talk about our response to CVE-2021-44228 (a.k.a. Log4Shell) with the Rapid7 InsightAppSec platform.
14 min
Research
Dropping Files on a Domain Controller Using CVE-2021-43893
On December 14, 2021, during the Log4Shell chaos, Microsoft published CVE-2021-43893, a remote privelege escalation vulnerability affecting Windows EFS.
2 min
Metasploit
Metasploit Wrap-Up: Feb. 11, 2022
Welcome, Little Hippo: PetitPotam
Our very own @zeroSteiner ported
the PetitPotam
exploit to Metasploit this week. This
module leverages CVE-2021-36942
, a
vulnerability in the Windows Encrypting File System (EFS) API, to capture
machine NTLM hashes. This uses the EfsRpcOpenFileRaw function of t
4 min
Career Development
The Forecast Is Flipped: How Rapid7 Is Flipping L&D for the Future of Work
Rapid7’s People Development team is leaning into innovation, striving to define the next best practice, and reimagining the possibilities of hybrid learning through flipped content.
4 min
Research
Evolving How We Share Rapid7 Research Data
Our goal for Open Data has been to enable others to participate in these efforts, increasing the positive impact across the community.