Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

5/4/2015
06:30 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Rapid7 Picks Up NTObjectives

Adds 25 new employees and further diversifies testing capabilities.

Rapid7 today acquired NT OBJECTives (NTO) for an undisclosed amount in a move that it says will help its customers better keep up with the threat landscape by building out its web and mobile applications security testing capabilities. Known best for its NTOSpider dynamic testing platform, NTO brings to Rapid7 a roster of 25 employees and a mature suite of testing tools that have gained traction in the Fortune 500. For now, Rapid7 will rebrand NTOSpider as AppSpider Pro and NTOEnterprise as AppSpider Enterprise.

"Web application attacks are increasing in severity and frequency. While we've been able to address some of these challenges with our other Threat Exposure Management solutions -- Nexpose and Metasploit -- AppSpider will significantly enhance Rapid7's capabilities," says Lee Weiner, senior vice president of products and engineering for Rapid7.

With web application attacks making up about 35 percent of breaches in many industries,  according to the Verizon Data Breach Investigations Report, and the velocity of mobile development adding to that attack surface exponentially, these areas remain a huge sore spot for enterprise security.  

"Web application security represents one of the greatest challenges facing the security industry and businesses of all sizes. With millions of custom web applications developed in the last two decades, organizations have significantly increased their attack surface," says Dan Kuykendall, co-CEO and CTO at NTO.

Some of the unique capabilities that drew Rapid7 to NTO's product portfolio include AppSpider's 'universal translator' technology that gives better visibility into newer web and mobile development technologies like AJAX, REST, and JSON, as well as the ability to create customized attacks that can better test for business logic flaws that often go unfound using static analysis.

"NTO has developed outstanding functionality to ensure that web application assessment is broad and efficient," Weiner says. "It isn't enough to evaluate some aspects of the threat landscape and feel like you are covered. Tools -- like those from NTO -- must marry comprehensive and continuous coverage of web applications with efficient tools for sophisticated security programs managing business critical application ecosystems."

Plus, says Weiner, the NTO team was a good match from a personnel standpoint.

"We were looking for a team that wasn't just a strong fit technology-wise, but culturally," he says. "The NTO team is extremely well aligned with Rapid7 in terms of philosophy and mission." 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
5/5/2015 | 11:37:24 AM
Current Rapid7 Functionalities
I know currenlty that Rapid7's product Nexpose has a web application scanning functionality but I am not sure how robust it is as I have not used it.

Can someone please provide me with a perspective of what NTOSpider does efficiently as well as things it could work on? Application scanning is a critical component in the present for increasing security posture and with that its good to know the benefits and detriments to the product.
News
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Edge-DRsplash-10-edge-articles
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
News
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Building the SOC of the Future
Building the SOC of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed the way business works and the way security teams operate. There is no going back.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-4931
PUBLISHED: 2021-02-24
IBM MQ 9.1 LTS, 9.2 LTS, and 9.1 CD AMQP Channels could allow an authenticated user to cause a denial of service due to an issue processing messages. IBM X-Force ID: 191747.
CVE-2020-11987
PUBLISHED: 2021-02-24
Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
CVE-2020-11988
PUBLISHED: 2021-02-24
Apache XmlGraphics Commons 2.4 is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
CVE-2021-21974
PUBLISHED: 2021-02-24
OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability. A malicious actor residing within the same network segment as ESXi who has access to port 427 may be able to trigger the heap-overflow issue in...
CVE-2021-22667
PUBLISHED: 2021-02-24
BB-ESWGP506-2SFP-T versions 1.01.09 and prior is vulnerable due to the use of hard-coded credentials, which may allow an attacker to gain unauthorized access and permit the execution of arbitrary code on the BB-ESWGP506-2SFP-T (versions 1.01.01 and prior).