PR Contact
Beth Bryant
BBWrites Strategic Communications
(508) 786-3013
Email Press Contact
Of further interest:
- Rapid7 PCI Compliance Portal
- PCI Certification
- Using the PCI Data Security Standard - White Paper
- PCI Approved Scanning Vendor List
Rapid7 approved by MasterCard as a Security Scanning Vendor for Achieving Compliance with the Payment Card Industry (PCI) Data Security Standard
Rapid7 Attains Approval After Completing the MasterCard Site Data Protection (SDP) Vendor Compliance Testing Program
Boston - May 2, 2006 - Rapid7 LLC today announced it has successfully completed the MasterCard Site Data Protection (SDP) Vendor Compliance Testing Program, which certifies the enterprise vulnerability management company to help merchants achieve compliance with the Payment Card Industry (PCI) Data Security Standard. Rapid7 is the provider of NeXpose PCI Compliance, which delivers network vulnerability scanning services and meets the security scanning requirements of the MasterCard SDP program.
By using a MasterCard-approved security scanning vendor such as Rapid7, merchants can proactively protect their businesses and the data in their payment systems against the threat of compromises. Left undetected, vulnerabilities can potentially lead to unauthorized access, but by finding and fixing any exposures, an SDP-compliant solution reduces the risk of intrusion.
To become qualified as an SDP compliant scanning vendor, Rapid7's NeXpose PCI Compliance demonstrated its effectiveness at proactively locating and reporting vulnerabilities during rigorous evaluation in MasterCard's test environment. MasterCard's testing process addresses how the vendor collects and manages scan requests from customers, the ability of the vendor to identify vulnerabilities and misconfigurations in the network and Web applications, and how the vendor presents the scan results.
A key focus of the MasterCard SDP program is to ensure that merchants and service providers (third party processors and data storage entities) are securely storing credit card account data in accordance with the PCI Data Security Standard. To demonstrate compliance, merchants and service providers must perform onsite security assessments and quarterly network scans. Rapid7 recommends that businesses serious about protecting customer data and avoiding the cost of incidents should do more than the minimum level mandated by the PCI standard.
"The return on investment for deploying a self-auditing solution is easily accomplished," said Alan Matthews, president of Rapid7 LLC. "The financial penalty for failure to provide protected systems for processing credit card data makes vulnerability testing mandatory. Consumers need to be assured that the online transaction systems they are using are secure."
NeXpose PCI Compliance provides scan templates and reporting capabilities that meet or exceed the MasterCard SDP specifications for system security scanning. The PCI Standard compliance report provides pass/fail information at both executive and administrator detail levels. A complete remediation plan is provided that enables security analysts to bring their system devices into full compliance with the PCI Standard.
The PCI Data Security Standard is the global standard adopted by companies in the credit card industry to ensure the protection of customer information. According to the standard, all members, merchants, and service providers that store or process credit cards must meet specific security requirements, which necessitate building a secure network and maintaining a vulnerability management program.
The MasterCard SDP Program provides merchants, service providers and acquirers with easy access to the security vendors that it has recognized as qualified and compliant by maintaining a list on its Website. Rapid7 is on the MasterCard SDP Program's list of approved security scanning vendors.
For more information about Rapid7's PCI certification services, email our PCI support team.
About NeXpose
Rapid7's award-winning NeXpose Unified Vulnerability Management (UVM) product is an all-in-one security solution that scans Web servers, Web applications, databases and networks to locate threats, assess their risk to the environment and devise a remediation plan. NeXpose incorporates an expert system to build a knowledge base of facts on the environment it explores and model potential targeted attacks to expose all existing threats. NeXpose provides robust reporting capabilities that ensure compliance with governmental regulations, corporate security configuration policies, and the PCI Data Security Standard. NeXpose is available as an appliance, downloadable software or an On-Demand hosted solution.
About Rapid7
Rapid7 is the leading provider of Unified Vulnerability Management (UVM) solutions. NeXpose provides network, database and web application vulnerability management for enterprise deployments and small to medium businesses. Rapid7 was founded in 2000 by a team of software industry veterans who were major contributors to product development and subsequent growth and success at Percussion Software, Bond Technologies and Stride & Associates. Since introduced, NeXpose has been sold to corporate enterprises, Global 2000 companies, and government entities, and serves the full range of vertical markets across the U.S. and abroad. In addition, Rapid7 provides compliance products and services for PCI, HIPAA and Sarbanes Oxley. Rapid7 is headquartered in Boston, MA, with offices in California and the United Kingdom.