Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

10/8/2020
09:00 AM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Rapid7 Announces Cloud Identity and Access Management Governance Module for DivvyCloud

Security professionals can now simplify cloud identity and access management at scale to help prevent security incidents and data breaches.

BOSTON, Ma. -- October 6, 2020 -- Rapid7, Inc. (NASDAQ: RPD), a leading provider of security analytics and automation, today announced the availability of its Cloud Identity and Access Management (IAM) Governance module for DivvyCloud to help customers identify and reduce cloud identity risk. With this new module, customers gain deeper visibility into their cloud resources to assess, prioritize, and remediate improper permission combinations that could grant unintended or overly permissive access. 

The dynamic and ephemeral nature of cloud environments makes traditional security perimeter approaches insufficient for managing risk. To reduce risk, companies must view identity as the new perimeter. Unfortunately, the complexity of cloud environments and cloud service provider IAM tools often lead developers and engineers to grant unintended or overly permissive access. For security teams, this same complexity makes it difficult, if not impossible, to determine who—or what—has access to a cloud resource. The result is unmanaged cloud risk that overwhelms security teams. 

“Despite the fact that cloud-based services and tools have been a staple in most companies’ operations for many years, IAM remains a persistent problem because traditional IAM solutions don't solve today's challenges,” said Brian Johnson, senior vice president of cloud security at Rapid7. “Rapid7’s new Cloud IAM Governance module for DivvyCloud allows our customers to gain full control and visibility over their entire cloud environment, no matter how many different cloud providers, users, or resources they have in play. Once they have this insight, companies can start to implement least privilege access to reduce the risk of data breaches and enhance security.”

This solution is now generally available to DivvyCloud customers as an additional module. Specifically, the Cloud IAM Governance module allows customers to:

  1. Gain visibility of the full cloud IAM picture to assess, prioritize, and remediate improper permission combinations that grant unintended or overly permissive access
  2. Explore effective access by principal user, resource, or application
  3. Understand true access to complex IAM combinations
  4. Establish and maintain least privilege
  5. Limit and understand the cloud security blast radius

“This solution is designed to solve a critical pain point for enterprises today,” said Chris DeRamus, vice president of technology at Rapid7. “Our IAM Governance Module analyzes and maps customers’ cloud environments and bridges the gaps between cloud provider IAM policies and enterprise directories (e.g. Active Directory, LDAP, Okta, Ping, etc.). Enterprises can now identify exactly what resource, application, user, and role is accessing a specific cloud asset and the potential impact of that access.”

“The surge in remote work caused by the pandemic has been accompanied by an increased reliance on cloud applications and services,” said Doug Cahill, vice president and group director of cybersecurity, ESG Global. “This means companies have had to act quickly to ensure proper support and secure access to cloud resources, and, according to a recent study conducted by ESG, developing and adjusting security policies is the top security challenge associated with remote work. Companies need a solution that supports this increase in direct-to-cloud access by offering identity and access management options that recognize there's a new perimeter and ensures security.”

To learn more about how Rapid7’s IAM Governance Module for DivvyCloud helps enterprises gain control over and improve the security of their cloud footprint, download the Cloud IAM whitepaper here: divvycloud.com/iam-whitepaper or join the upcoming webinar on Securing the Accounts and Permissions of the Cloud Identity Perimeter on October 15 at 11am ET. Register here: divvycloud.com/iam-webinar-reg

About Rapid7

Rapid7 (Nasdaq: RPD) is advancing security with visibility, analytics, and automation delivered through our Insight cloud. Our solutions simplify the complex, allowing security teams to work more effectively with IT and development to reduce vulnerabilities, monitor for malicious behavior, investigate and shut down attacks, and automate routine tasks. Over 9,100 customers rely on Rapid7 technology, services, and research to improve security outcomes and securely advance their organizations. For more information, visit our website, check out our blog, or follow us on LinkedIn.

 

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Zero Trust doesn't have to break your budget!
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-32695
PUBLISHED: 2021-06-17
Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.16.1, a malicious app on the same device could have gotten access to the shared preferences of the Nextcloud Android application. This required user-interaction as a victim had to initiate the sharing flow and choose t...
CVE-2020-36388
PUBLISHED: 2021-06-17
In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHAR archive.
CVE-2020-36389
PUBLISHED: 2021-06-17
In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF.
CVE-2021-32575
PUBLISHED: 2021-06-17
HashiCorp Nomad and Nomad Enterprise up to version 1.0.4 bridge networking mode allows ARP spoofing from other bridged tasks on the same node. Fixed in 0.12.12, 1.0.5, and 1.1.0 RC1.
CVE-2021-33557
PUBLISHED: 2021-06-17
An XSS issue was discovered in manage_custom_field_edit_page.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field.