theDocumentId => 1339117 Rapid7 Announces Cloud Identity and Access ...

Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


09:00 AM
Dark Reading
Dark Reading
Products and Releases

Rapid7 Announces Cloud Identity and Access Management Governance Module for DivvyCloud

Security professionals can now simplify cloud identity and access management at scale to help prevent security incidents and data breaches.

BOSTON, Ma. -- October 6, 2020 -- Rapid7, Inc. (NASDAQ: RPD), a leading provider of security analytics and automation, today announced the availability of its Cloud Identity and Access Management (IAM) Governance module for DivvyCloud to help customers identify and reduce cloud identity risk. With this new module, customers gain deeper visibility into their cloud resources to assess, prioritize, and remediate improper permission combinations that could grant unintended or overly permissive access. 

The dynamic and ephemeral nature of cloud environments makes traditional security perimeter approaches insufficient for managing risk. To reduce risk, companies must view identity as the new perimeter. Unfortunately, the complexity of cloud environments and cloud service provider IAM tools often lead developers and engineers to grant unintended or overly permissive access. For security teams, this same complexity makes it difficult, if not impossible, to determine who—or what—has access to a cloud resource. The result is unmanaged cloud risk that overwhelms security teams. 

“Despite the fact that cloud-based services and tools have been a staple in most companies’ operations for many years, IAM remains a persistent problem because traditional IAM solutions don't solve today's challenges,” said Brian Johnson, senior vice president of cloud security at Rapid7. “Rapid7’s new Cloud IAM Governance module for DivvyCloud allows our customers to gain full control and visibility over their entire cloud environment, no matter how many different cloud providers, users, or resources they have in play. Once they have this insight, companies can start to implement least privilege access to reduce the risk of data breaches and enhance security.”

This solution is now generally available to DivvyCloud customers as an additional module. Specifically, the Cloud IAM Governance module allows customers to:

  1. Gain visibility of the full cloud IAM picture to assess, prioritize, and remediate improper permission combinations that grant unintended or overly permissive access
  2. Explore effective access by principal user, resource, or application
  3. Understand true access to complex IAM combinations
  4. Establish and maintain least privilege
  5. Limit and understand the cloud security blast radius

“This solution is designed to solve a critical pain point for enterprises today,” said Chris DeRamus, vice president of technology at Rapid7. “Our IAM Governance Module analyzes and maps customers’ cloud environments and bridges the gaps between cloud provider IAM policies and enterprise directories (e.g. Active Directory, LDAP, Okta, Ping, etc.). Enterprises can now identify exactly what resource, application, user, and role is accessing a specific cloud asset and the potential impact of that access.”

“The surge in remote work caused by the pandemic has been accompanied by an increased reliance on cloud applications and services,” said Doug Cahill, vice president and group director of cybersecurity, ESG Global. “This means companies have had to act quickly to ensure proper support and secure access to cloud resources, and, according to a recent study conducted by ESG, developing and adjusting security policies is the top security challenge associated with remote work. Companies need a solution that supports this increase in direct-to-cloud access by offering identity and access management options that recognize there's a new perimeter and ensures security.”

To learn more about how Rapid7’s IAM Governance Module for DivvyCloud helps enterprises gain control over and improve the security of their cloud footprint, download the Cloud IAM whitepaper here: or join the upcoming webinar on Securing the Accounts and Permissions of the Cloud Identity Perimeter on October 15 at 11am ET. Register here:

About Rapid7

Rapid7 (Nasdaq: RPD) is advancing security with visibility, analytics, and automation delivered through our Insight cloud. Our solutions simplify the complex, allowing security teams to work more effectively with IT and development to reduce vulnerabilities, monitor for malicious behavior, investigate and shut down attacks, and automate routine tasks. Over 9,100 customers rely on Rapid7 technology, services, and research to improve security outcomes and securely advance their organizations. For more information, visit our website, check out our blog, or follow us on LinkedIn.



Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-07-28
This affects all versions of package curly-bracket-parser. When used as a template library, it does not properly sanitize the user input.
PUBLISHED: 2021-07-28
All versions of package deepmergefn are vulnerable to Prototype Pollution via deepMerge function.
PUBLISHED: 2021-07-28
This affects the package elFinder.AspNet before 1.1.1. The user-controlled file name is not properly sanitized before it is used to create a file system path.
PUBLISHED: 2021-07-28
IBM Jazz Foundation products are vulnerable to server side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 192434.
PUBLISHED: 2021-07-28
IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 192957.