W H I T E PA P E R

Insight Cloud Security

Q3 2019
TA B L E O F CO N T E N T S

Overview 3
Data Collection 4
Credential Storage 6
Data Processing and Storage 7
Access to Data 9
Application Security 10
Cloud Security Architecture and Governance 12
Compliance 15

Insight Cloud Security 2

Overview

The Rapid7 Insight cloud provides data collection, visibility, analytics, and automation to establish a shared point-of-view
between security, IT operations, and development teams. Our cloud platform delivers one-click access to Rapid7’s vulnerability
management, application testing, incident detection and response, and log management solutions. This document introduces
the architecture, security mechanisms, and technical foundations that make up the Rapid7 Insight cloud.

Insight Cloud Security 3

Data Collection
The Insight cloud offers multiple options for collecting data across your IT environment. Whether you use collectors, the Rapid7
Insight Agent, scan engines, or direct connections to our platform, our unified data collection enables your teams to collect data
once and use it across multiple products on the Insight cloud. Once configured, data sources continuously collect data, enabling
teams to collaborate effectively as they analyze shared data, alert on risk vectors, and automate remediation and breach response.

Collectors collecting real-time system information—including basic

asset identification information, running processes, and
Rapid7 uses collectors to gather information from on- logs—from your assets and sending this data back to the
premises and cloud networks to securely transfer data to Insight cloud for analysis. The Insight Agent can be installed
the Insight cloud. Collectors sit behind the client’s firewall, directly on Windows, Linux, or Mac assets. Each Insight
respond to changes in the environment, and securely Agent only collects data from the endpoint on which it is
transmit relevant data to our platform for analysis. installed.

Collectors were designed with the following core tenets in The Insight Agent authenticates using TLS client
mind: authentication. When you deploy the Insight Agent, the
deployment includes a private SSL key representing your
organization. This key is used to authenticate and authorize
• Only administrators can configure collectors. your agent with the Insight cloud.*
• All data is secured during the transmission process,
which uses strong encryption protocols. The agent can communicate directly to the Insight cloud,

• Data transferred from each separate collector is uniquely or proxy communication through existing web proxies or
collectors on your network. Finding the best route to the
identified and stored and cannot be accessed by any
third parties. Insight cloud occurs automatically or can be configured in
advanced use cases.
During installation, a collector reaches up to the Insight
cloud and hands off the shared secret (activation key) by *For InsightOps log data, an API token is used to
performing a challenge-response handshake. Once the authenticate the Insight Agent instead of TLS client
initial handshake is complete, a unique pair of cryptographic authentication. Log data is encrypted in transit via TLS.
keys will be generated. These crypto keys are used for all
subsequent collector to Insight cloud communications.
Scan Engines
The collector relies on a TLS connection (HTTPS) to On-premises scan engines are used by InsightVM and
communicate with the Insight cloud. Specifically, the InsightAppSec to scan Rapid7 customers’ environments
collector is explicitly coded to trust only certificates that by finding and remotely connecting to systems to retrieve
have a signature chain that can be vetted by one of the Java asset information.
trust store Certificate Authorities (CAs). Once the challenge-
response handshake is complete, the collector is ready to
InsightVM scan engines perform vulnerability scans of your
accept command and control instructions from the Insight
networks and report results back to the InsightVM console
cloud. For security reasons, the collector always reaches
using TLS 1.2 (HTTPS). Engines can be distributed across
out to the Insight cloud; the Insight cloud cannot reach
internal networks, public networks, and cloud providers.
through the client’s firewall and initiate a conversation.
Scan engines provide strategic views of your network
from an attacker’s perspective. In deciding how and where
Rapid7 Insight Agent to deploy scan engines, you choose how you would like
to “see” your network. Scan engines can be configured
The universal Insight Agent is lightweight software you to perform authenticated scans to check for software
can install on any asset—in the cloud or on-premises—to applications and packages and to verify patches.
easily centralize and monitor data on the Insight cloud. The
Insight Agent gives you endpoint visibility and detection by InsightAppSec scan engines allow scanning internal web

Insight Cloud Security 4

applications that aren’t accessible to the public Internet. call to the Insight cloud. This ensures the validity and origin of
Engines connect to the web applications you configure and messages received from the Orchestrator.
report results back to the Insight cloud. For security reasons,
the InsightAppSec scan engine always reaches out to the
Insight cloud for instructions; the Insight cloud cannot reach
tCell Agent
through the client’s firewall and initiate a scan.
The tCell Agent integrates with your web application and
web server code to monitor all incoming requests and block
Insight Orchestrator malicious requests that can attack your application. The
agent sends data to the Insight Platform using a revocable
The Insight Orchestrator is installed in your environment to API key over TLS.
gain access to on-premises products, services, and tools.
The Orchestrator enables automation capabilities across the
Insight cloud, including in InsightConnect, InsightIDR, and
Cloud Collection and Integrations
InsightVM.
Rapid7 collects some data directly via a connection with the
Insight cloud. The Insight cloud can connect to third parties
Similarly to the collector, the Orchestrator relies on a TLS 1.2
on your behalf, such as container registries for InsightVM.
connection (HTTPS) to communicate with the Insight cloud.
The communication from the Orchestrator to the Insight
cloud is cryptographically signed via ECDSA with a challenge You can also send data directly to us via our APIs or with one
token that expires every 30 seconds and refreshes on each of our software libraries or extensions, such as the InsightOps
application logging libraries.

For details on the collection methods and specific data collected for each product, please visit help.rapid7.com.

Insight Cloud Security 5

Credential Storage

To generate value and collect data, our products require access to credentials with a high level of privilege on your networks.
Credentials are stored differently depending on where and how they are used. Credentials are always encrypted before being
stored in the Insight cloud. Where possible—such as when collecting data with collectors—credentials can only be decrypted by
on-premises components and not the Insight cloud itself.

Collectors Orchestrators

All credentials used by a collector to obtain data from your The Insight Orchestrator protects credentials similarly to
local environment are strongly encrypted in a manner that collectors. As part of registration with the cloud, orchestrators
prevents the passwords from being decrypted based on the generate RSA 4096-bit private and public keys. Only the
information stored in the cloud. Every collector installation public key is uploaded to the cloud, while the private key is
generates a unique public/private key pair that is then split stored locally on the orchestrator. When added, credentials
across environments. The public key is uploaded to the are encrypted using the orchestator’s public key. The Insight
cloud, and the private key is stored locally on the collector. cloud will transmit-as-needed the encrypted credentials to
When writing the private key to the local disk, the collector the Insight Orchestrator, where they can be decrypted using
encrypts the private key contents. The private key can only the orchestrator’s private key and used to communicate
be decrypted using information obtained via successful with third party integrations in a secure manner.
communication with the Rapid7 Insight cloud, thus only
active, live collectors with healthy communication with Orchestrators only utilize credentials specifically encrypted
the cloud can access the private key. for them, and are only issued encrypted credential data that
is relevant to the current set of tasks.
Whenever a credential is added to a collector, the credential
is encrypted using an RSA 4096-bit public key associated
with the specific collector where the credential is being
Cloud Collection and Integration
deployed. It is then persisted in the database within a
Credentials used for cloud based data collection or
client-specific database schema. Once the credential
cloud based integrations are securely stored within the
is stored, the Insight cloud no longer has access to the
Insight cloud. Credentials are encrypted using AWS Key
cleartext credential. When that particular collector needs
Management Service (KMS) and the ciphertext is stored in
to use a credential, the encrypted password is retrieved
the Insight platform. Credentials are decrypted using KMS
from the cloud, and decrypted within the collector using
when needed and the cleartext is temporarily stored in
that collector’s private key. The password is used in memory
memory, never written to disk.
and cleared without ever being stored to disk. A collector
can only request access to the credentials necessary for
the event sources configured on that collector. For example, the Insight cloud stores credentials to enable:

InsightVM Console • Integrations with JIRA, ServiceNow, and Slack

The InsightVM security console, the on-premises
• Container downloads from container registries
component of InsightVM, stores encrypted credentials • Website scanning using InsightAppSec direct collection
used for authenticated scanning unless the user utilizes
a credential management system that the InsightVM
console can integrate with (e.g. CyberArk). InsightVM
does not store scan credentials in the Insight cloud.

Insight Cloud Security 6

Data Processing and Storage

Rapid7’s commitment to helping security and technology practitioners reduce risk requires us to collect and process an enormous
amount of data. The Insight cloud’s analytics engine relies on various NoSQL and relational databases, as well as S3 and other
AWS services to process and store your data.

Geographic Location Encryption in Transit

The Insight cloud offers different regions for storage to help Data sent to and from the Insight cloud—including data
you comply with policies or preferences for the physical collected by collectors, agents, and engines; data ingested
storage location of your data. Customers can select from via APIs and plugins*; and interaction with the user interface
five cloud regions. Rapid7 will not move data from the —is encrypted with TLS (HTTPS). Collectors, agents, engines,
region you select, and data is not replicated across other and plugins are configured to verify and require a valid TLS
regions.* certificate issued by a trusted certificate authority.

• United States *InsightOps libraries allows you to send data encrypted with TLS,
but you can also send log data over unencrypted connections to
• Canada support legacy connections.

• Europe – Germany and Ireland Data Separation

• Japan
• Australia To offer you horizontally scalable solutions without any
risk of one customer accessing another’s data, Rapid7
*Log search data for InsightIDR customers provisioned before
designed the Insight cloud around secure, multi-tenant
September 2017 is stored in Europe. services from its inception. Each organization is assigned
its own relational database schema within database
instances. Data stored in object stores or distributed file
Encryption at Rest systems is tokenized using a unique UUID that logically
separates each customer’s data from each other.
All data processed and stored is encrypted at rest using
various file or disk level encryption mechanisms.* Data is
encrypted using industry standard AES-256 encryption with Data Reliability
keys managed through AWS’s Key Management Service
(KMS). Where possible, Rapid7 utilizes AWS’s services to The Insight cloud is composed of a collection of disparate
manage encryption at rest (e.g. S3, EBS, RDS, etc.). When server types that host a set of services that enable Rapid7
not possible, Rapid7 utilizes block level encryption provided products. Each service is designed to scale horizontally.
by LUKS. All data is protected by strict access controls. Each layer of the data collection and processing pipeline is
designed to be fault-tolerant and to continue to operate in
*Some raw InsightIDR data ingested before July 2018 and stored
the event of reliability issues with our cloud environment.
in S3 is not encrypted at rest. This data is protected by strict IAM If one component of the Insight cloud is unavailable, other
access controls. components will store data until the component is available
again. All persisted data is stored redundantly so that the
loss of a single server or an entire availability zone should
not result in data loss. All infrastructure is monitored for
performance, availability, and reliability. Operations staff
are available 24/7 to respond to incidents.

Insight Cloud Security 7

In addition to a redundant and fault-tolerant architecture, Physical Security
customer data is backed up in a variety of ways. Rapid7
relies on Amazon S3 for storing data backups. Backups AWS Data Centers
are not replicated outside of the region customers selected
when creating their Insight account, but data is replicated Data is stored in AWS data centers located inside nondescript
across multiple data centers within the region. S3 can facilities. Physical access is strictly controlled both at the
withstand the concurrent loss of data in two different perimeter and at building ingress points by professional
facilities. Artifacts from critical stages of the data security staff utilizing video surveillance, state of the art
processing pipeline are backed up as data is processed. intrusion detection systems, and other electronic means.
Log data backup occurs in real time as it is ingested. Authorized staff must pass two-factor authentication a
Automatic database backups occur daily. minimum of two times to access data center floors, and
all physical access by employees is logged and audited
routinely. When an employee no longer has a business
Data Destruction need for these privileges, their access is immediately
revoked, even if they continue to be an employee of
If you opt to leave a Rapid7 service, you’ll have the opportunity Amazon. Datacenter access and information is only
to collect and transfer any data that is possible to export.* provided to employees and contractors who have a
Should you request deletion of the data, the Rapid7 team legitimate business need for such privileges. All visitors
will initiate the process within 14 days. When a user is using and contractors are required to present identification
multiple Rapid7 products and leaves or cancels a product and are signed in and continuously escorted by staff.
which makes use of shared data, the shared data is not More information can be found here:
deleted if any other shared data products are still enabled aws.amazon.com/compliance/data-center/controls.
for that user’s account. Rapid7’s data retention policy and
standard define the maintenance and retention of data in
compliance with applicable governmental and regulatory Rapid7 Offices
requirements and industry best practices. There are various risk-mitigating physical and logical
security controls in place, such as security guards at front
*Data export tools exist for InsightVM and InsightOps. desks or locked office entrances controlled by electronic
badge access. Other controls include automatic screen
locking, full-drive encryption on laptops, and a clean desk
policy. All visitors must check in first when they enter
Rapid7 facilities and must be escorted when entering
sensitive areas.

Insight Cloud Security 8

Access to Data

Ensuring your data is used only in a manner consistent with your expectations is a responsibility Rapid7 takes very seriously.
For this reason, policies including two-factor authentication, jump hosts, service segregation, and per-service permissions
ensuring least-privilege access methodologies are applied.

Data Types Who from Rapid7 can access your data?

Rapid7 may collect certain types of data to help us improve • Sales, Marketing, and other customer support
our solutions and services. We have defined rules for what, teams have access to contact information, sales
when, and how we use this data. data, and Usability Data for product support and
product analytics.

Security System Data • Sales and Solution Engineers only have access to
your Security System Data if you choose to use a
This data is collected to deliver the Insight cloud platform.
production environment for a proof-of-concept.
The elements collected vary by product and include data
such as user, network, vulnerability, incident, asset, and
log data. This data resides on the Insight cloud and is what
• Support, Software Developers, and Operations
Engineers have limited access to data to support
populates the dashboards and products you use. Rapid7 application development and troubleshooting.
will never sell, rent, or trade your Security System Data. Rapid7 collects Usability Data to help us improve
our solutions and services and Security System
Data to deliver the Insight cloud.
Usability Data
In order to provide our solutions and services to you, we
must collect certain usage data. This helps us ensure that Access Control
our solutions and services are operating correctly and
that you are having the best possible experience with our Rapid7 provisions all network and application access
products. The types of Usability Data we collect include: using the principle of least privilege. All access requests
are documented and approved by system owners. Reviews

• Device
of Insight cloud production access are conducted quarterly
and connection data (e.g. browser type,
by the Cloud Operations team to ensure the level of access
operating system version, network speed)
is commensurate with least-privilege required to perform
• User and system behavior (e.g. commonly used job responsibilities.
features, user activity, configuration process)

• Product logs (e.g. web server, java, and Rapid7 Additionally, Rapid7 requires two-factor authentication
for remote management access to our jump hosts and
generated logs for troubleshooting)
our backend production systems and environments.
• Organizational data (e.g. customer industry, In accordance with NIST recommendations, Rapid7
location, number of users) explicitly disallows SMS and phone call-based two-factor
• Other relevant machine data authentication for remote management. This two-factor
authentication includes multiple factors at each step
(e.g., connection to jump host AND connection to
We collect data about the solutions you use and how you
backend servers). VPN or direct corporate LAN
use them, such as how often you access our products
access is required before connecting to jump hosts,
and which features you use most frequently. This is done
and a valid jump host session is required before
in an effort to improve your experience with our solutions.
connecting to any production infrastructure.
For example, we may use this data to highlight additional
capabilities or offer tips relating to features you are already
using, to make our solutions more intuitive, or to enhance
the solution’s most popular features. The Usability Data
collected never includes Security System Data such as
user, network, vulnerability, incident, or asset data.

Insight Cloud Security 9

Application Security

Rapid7 products on the Insight cloud are designed to fit securely into your environment and adhere to security best practices.
Rapid7 takes several steps to protect against common attack vectors and regularly performs application security testing,
vulnerability scanning, and penetration testing.

Single Sign-On Role Based Access Control (RBAC)

Products that authenticate via the Insight cloud share The Insight cloud supports global roles that apply to all
the same user database and authentication mechanisms. products* on the Insight cloud platform, and specific roles
Customers who use multiple Insight products benefit applicable to specific products. Rapid7 is always working to
from the Insight cloud’s single sign-on (SSO) functionality, add new roles and permissions to our products, including
needing only to sign in to the Insight cloud platform once the ability to customize RBAC for your needs.
to access all of their Insight products. Additionally,
customers can customize some aspects of their user
Global Roles:
account authentication policies, such as multi-factor
authentication prompt settings. User account credentials
for the Insight cloud are hashed using Bcrypt with a high
• Platform Admin: Full control over all products.
Platform admins have full access to user management,
number of iterations to protect the credential. including adding and deleting users, viewing all data,
and performing all functions. This role can also
Web application sessions are maintained via a randomly manage product trials.
generated session ID that is at least 128-bits in length.
Sessions are protected against session fixation by assigning • Product Admin: Full control over a single product.
Product admins can view all data, perform all edit
a new session ID when authenticating. Sessions IDs are
functions, and access any admin functions within
exchanged via HTTP cookies. Session Cookies have the
their product.
“Secure” and “HttpOnly” attributes set, ensuring session
IDs are only transmitted over HTTPS and preventing • Product Read/Write User: Able to access all or most
client-side scripts from accessing the cookie. Sessions features within a product except for administration of
expire after 30 minutes of inactivity. users and some settings. Able to modify data and/or
some settings.
Customers with on-premises InsightVM consoles
authenticate to the Software-as-a-Service (SaaS)
• Product Read-Only User: Able to access some
features within a product with read-only access.
portion of InsightVM via their console. The InsightVM
console supports local authentication, LDAP, Active *
RBAC for InsightVM is controlled via the on-premises InsightVM
Directory, SAML, and Kerberos authentication. Local console. InsightVM uses customizable fine grained roles and
two-factor authentication can be enabled as well. permissions that differ from the global roles above.
User account credentials used for local authentication
to the security console are salted and hashed, with
RSA being employed as part of the hashing process.

Insight Cloud Security 10

Distributed Denial of Service (DDoS) Attacks IP Spoofing

AWS network infrastructure leverages proprietary DDoS Amazon EC2 VMs running the Rapid7 service cannot send
mitigation techniques developed as a result of running spoofed network traffic. The AWS controlled, host-based
the world’s largest online retailer and providing cloud firewall infrastructure does not permit an instance to send
infrastructure for many large enterprises and governments. traffic with a source IP or MAC address other than its own.
Additionally, AWS’s networks are multi-homed across a
number of Internet service providers to achieve Internet
access diversity. Insight cloud services scale horizontally
behind load balancers to further mitigate DDoS attacks.

Man-in-the-Middle (MITM) Attacks

By default, all communication with Rapid7’s cloud instances

occur over authenticated channels.* HTTPS traffic is secured
with TLS and authenticated using trusted Certificate
Authorities to prevent MITM attacks.

*InsightOps libraries allow you to send data encrypted with TLS,

but you can also send log data over unencrypted connections
to support legacy connections.

Insight Cloud Security 11

Cloud Security Architecture
and Governance

In addition to designing security into each layer of our products, Rapid7 also builds security into every aspect of our architecture
that hosts the Insight cloud. Misconfiguration of cloud infrastructure continues to be a leading attack vector against SaaS
companies. This section describes how Rapid7 implements, validates, and monitors the cloud security architecture to
minimize this risk.

Least Privileged Design

The principle of least privilege and separation of duties is built into every layer of our cloud infrastructure:

AWS account separation and access: The Insight cloud uses a microservice architecture consisting of several
small services working together. These services are logically separated into several different AWS accounts to
minimize the blast radius of security incidents. Each AWS account contains a grouping of related services that provide
a single product or product feature. Developer and operations employees are granted least privilege access to each
AWS account individually as needed to perform their jobs. Employees access AWS consoles and APIs via Rapid7’s
corporate SSO system, which requires two-factor authentication. VPC networks are not peered across accounts. Cross-
account communication is permitted where needed using least-privilege IAM roles or authenticated REST services. No
direct database access is allowed between accounts.

Subnet separation: Several different network subnets exist within a single account. Services are provisioned to the
appropriate subnet for their purpose. For example, databases are placed in a subnet with no route to the Internet to
mitigate the risk of data exfiltration.

Host-level firewalls: Each set of identical Insight cloud services are assigned to a separate security group, which acts
as an independent firewall for that service. Security groups deny network traffic by default, so all network traffic rules
are whitelist-based and are defined to allow services to communicate with each other using only the specific ports
and protocols necessary for them to function together. This mitigates the risk of lateral movement between instances
comprising each Insight cloud service.

Service-level roles: When Insight cloud services need to access AWS services, (e.g. S3, KMS, SNS/SQS, etc.), their
access is permitted via IAM roles attached to each group of identical services. Credentials for these roles are
managed by AWS and regularly rotated. These roles allow least privileged access to cloud resources. Each service
type has its own IAM role. For example, if a microservice needs access to read from S3, its IAM role would only permit
reading from a specific S3 bucket. No write access would be permitted.

Scoped external access: IAM roles are used to access AWS resources where possible. When IAM keys must be used,
different keys with least privilege access are issued for different tasks.

Insight Cloud Security 12

 No direct access: Access to internal services is guarded by user authentication, IP address whitelisting, and two-factor
authentication. Internal services such as jump hosts and back-office admin portals can only be accessed from the
Rapid7 corporate LAN or VPN. Admin SSH access to backend services, databases, and other infrastructure must
transit through a jump host.

Centralized logging: We store and retain logs centrally for security, compliance, and operational needs. These
centralized logs cannot be altered after they have been submitted to our logging system.

Change Management • Tested: Changes are applied in testing environments to

ensure they perform as expected and do not adversely
impact performance; and
Software
Rapid7 applies a systematic approach to managing change • Approved: Oversight is provided to ensure changes
so that changes to customer-impacting services are are prioritized and agreed upon.
reviewed, tested, approved, and well communicated. Changes are typically moved into production in a phased
automated deployment. Rollback procedures are available
Change management processes are based on Rapid7 in order to revert to a previous version if any failures occur.
change management guidelines and tailored to the
specifics of the Insight cloud. Emergency changes to production systems that require
deviations from standard change management procedures
The goal of Rapid7’s change management process is to are associated with an incident and are logged and
permit no unintended service disruptions and to maintain approved as appropriate.
the integrity of services provided to customers. All code is
version controlled for accountability on who did what, Rapid7’s Engineering teams follow a formally documented
when, and where. Software Development Life Cycle process which is based
on Agile and Scrum methodologies. This process includes
Prior to being deployed in production environments, new peer code review, automated testing, and scenario testing
changes are: to ensure quality and to identify security vulnerabilities
prior to shipping.

• Reviewed: Peer reviews of the technical aspects of a

change are performed to proactively catch and correct
code errors;

Requirements Design Code Test Staging Production

Non-Functional
Architecture Automated Functional
Staging Continuous
Testing
Analysis Code Analysis Validation Monitoring
(Automated & Manual)

Functional Continuous
Planning & Cost Non-Functional
Code Review Testing Security
Discovery Analysis Evaluation
(Automated & Manual) Assessments

Security 3rd Party

Security & Security Security
Testing Security
Threat Analysis Review Validation
(Automated & Manual) Assessments

Insight Cloud Security 13

Infrastructure Configuration Scanning
The Insight cloud relies on public cloud providers such
as AWS to provide infrastructure services. The Cloud Rapid7 performs regular automated scans of our cloud
Operations team has configuration, deployment, and infrastructure with a suite of tools to ensure our policies
change responsibilities for the infrastructure of and best practices are in place. If a misconfiguration is
Insight cloud customers and the Insight platform found, operations engineers are alerted immediately so
Engineering team. they can diagnose and fix the problem.

Rapid7’s Cloud Operations team manages the operational Rapid7 scans for several rules including appropriate
development. The Cloud Operations team develops tools, controls from compliance benchmarks such as CIS AWS
which automate and validate that proper configurations Foundations and AWS Well-Architected Framework. Some
and software are installed in a standard manner, based notable examples of checks scanned for are listed below:
on host classes, and updated regularly.

Changes to cloud infrastructure are orchestrated in code

• Publicly accessible S3 buckets: S3 buckets are
scanned to ensure buckets aren’t publicly accessible
and all changes are version controlled. When making an (readable or writable). Bucket Access Control Lists
infrastructure configuration change, these tools provide a (ACLs) and bucket policies are evaluated. While some
view of what will change and a mechanism to rollback if a buckets (such as website assets, public downloads,
problem occurs. Infrastructure is regularly monitored for etc.) are designed to be public, no other S3 buckets
manual changes made outside of these tools. In the event are ever permitted to be publicly readable or writable.
infrastructure is changed outside of code, it can quickly be
brought back in compliance. • Publicly accessible resources: Internal servers,
databases, and other resources should never be
accessible to the Internet. Security groups are
Changes deployed into production environments are: scanned to ensure ingress from 0.0.0.0/0 is only
allowed on appropriate resources and only for
• Reviewed: Peer reviews of the technical aspects specific ports.
of a change.
• IAM keys: IAM keys are scanned for age, recent access,
• Tested: To ensure that a change will behave as and attached policies. Newly issued keys are reviewed.
IAM policies associated with IAM keys used by third-
expected and not adversely impact performance.
Rapid7 rolls out to its own systems first for quality party services are checked against approved policies.
assurance. Old keys are removed when they are no longer needed.

• Approved: Oversight is provided to ensure changes are

Traceability
prioritized and agreed upon.

Emergency, non-routine, and other configuration changes Rapid7 ensures cloud actions are logged and monitored.
to existing Insight cloud infrastructure are authorized, All AWS API actions are logged. Access to servers and
logged, tested, approved, and documented in accordance services are logged to external systems to prevent
with industry best practices for similar systems. tampering. Logs are analyzed by Rapid7’s own products
(InsightIDR and InsightOps) for notable events. Rapid7’s
Managed Detection & Response services team works
Updates to Rapid7’s infrastructure are done in such a with our internal Security Operations team to monitor
manner that in the vast majority of cases they will not these events 24/7 and investigate any alerts.
impact the customer and their service use.

Rapid7 communicates with customers directly via email

if service use may be adversely affected. Rapid7 also
communicates operational status of the Insight cloud
via status.rapid7.com.

Insight Cloud Security 14

Compliance

Rapid7 SOC Reports GDPR

Rapid7 can provide a SOC 2 Type II report covering The EU’s General Data Protection Regulation (GDPR) has
InsightIDR, InsightOps, InsightVM, InsightConnect, imposed obligations regarding the processing, storage, or
and InsightAppSec under NDA. This report is a transmission of personal data of individuals residing in the
representation of Rapid7’s overall security posture European Union (EU). Rapid7 has a Data Protection Officer,
and controls. and has implemented controls across our organization so
that we can better achieve and maintain compliance with
this framework.
AWS SOC Reports

The Insight cloud is hosted by AWS. You can retrieve Rapid7 has a Data Processing Addendum which is
AWS compliance reports (SOC 2, SOC 3, FedRAMP incorporated into its standard contracts to comply with
Partner Package, ISO 27001:2013 SoA etc.) here: GDPR. You can find Rapid7’s Data Processing Addendum
aws.amazon.com/artifact. at www.rapid7.com/legal/dpa. For more information
about privacy at Rapid7 please visit:
www.rapid7.com/privacy-policy.
Third-Party Penetration Test

External penetration tests are conducted on an annual Amazon Web Services (AWS) Security
basis by a third party. Rapid7 can provide letters of Competency
attestation from the external firm summarizing the
number and risk rating of findings. All findings are Rapid7 has achieved Amazon Web Services (AWS) Security
addressed in accordance with Rapid7’s formally Competency, which differentiates Rapid7 as an AWS
documented Vulnerability Handling and Disclosure Partner Network (APN) member that offers specialized
Standard Operating Procedure. To avoid potential software designed to help organizations adopt, develop
service disruptions, Rapid7 does not allow any and deploy complex security projects on AWS. To receive
customer, user, or individual to penetration test the designation, APN partners must possess deep AWS
our products or services without written consent. expertise and deliver solutions seamlessly on AWS.

Vulnerability Handling and Disclosure More information about Rapid7 compliance and security
frameworks can be found at https://www.rapid7.com/trust.
As a provider of security software, services, and research,
Rapid7 is committed to addressing security issues that are
found in our products and systems. Rapid7 has a defined
standard operating procedure for responsible handling and
disclosure of vulnerabilities that are reported. In the case
that a vulnerability is reported to us, Rapid7 will work with
the reporter to triage and fix the vulnerability in a timely
fashion. Rapid7 will also provide public acknowledgement
and attribution to any reporters who request it. Additional
information about this process can be found here:
www.rapid7.com/security/disclosure.

Insight Cloud Security 15

About Rapid7
Rapid7 (Nasdaq: RPD) is advancing security with visibility, analytics, and automation delivered through our Insight cloud.
Our solutions simplify the complex, allowing security teams to work more effectively with IT and development to reduce
vulnerabilities, monitor for malicious behavior, investigate and shut down attacks, and automate routine tasks. 7,800
customers rely on Rapid7 technology, services, and research to improve security outcomes and securely advance their
organizations. For more information, visit our website, check out our blog, or follow us on Twitter.

Insight Cloud Security 16