Posts by Alfred Chung

3 min AWS

Rapid7 Partners with AWS Security Hub for Deeper Vulnerability Reporting

Last month, we were thrilled to announce our integration with AWS Security Hub at AWS re:Invent.

5 min InsightVM

Did You Remediate That? New InsightVM Executive Report Provides Key Details on Team Progress

We have developed the InsightVM Executive Report so that companies can easily report on month-over-month trends in their vulnerability management programs.

3 min Azure

Azure Security Center and Active Directory Now Integrate with the Rapid7 Platform

Today, we announced [https://www.rapid7.com/about/press-releases/rapid7-integrates-with-microsoft-azure/] continued, more comprehensive development of the integration between the Rapid7 Insight platform [https://www.rapid7.com/products/insight-platform/] and Microsoft Azure. A new integration with Azure Security Center makes it easy to deploy the Rapid7 unified Insight Agent across new and existing Azure Virtual Machines. This automated deployment enables InsightVM customers to maintain consta

3 min Application Security

In Our Customers’ Words: Why Mastering Application Security Basics Matters

In a recent conversation with a Rapid7 application security customer, I was reminded how much of a security practitioner’s day can be consumed by troubleshooting buggy tools and manually executing the same tasks over and over again (needlessly, may I add). As much as we’d like to think that security professionals’ time is being efficiently utilized, oftentimes inadequate tools, a lack of automation, and organizational silos impede SecOps-driven [https://www.rapid7.com/solutions/secops/] progress

4 min Application Security

How DevOps Can Use Quality Gates for Security Checks

Your team has been working at all hours to put the final touches on code for a new big feature release. All the specs are in, the feature works as expected, and the code is pushed to production. A few hours later, the daily security scan runs and the alerts start piling in. What went wrong? And what do you do now? Typically when this happens, it means rolling back the entire deployment, retroactively fixing the bugs and vulnerabilities in the code, and a week or two later, re-deploying. If you’

4 min Application Security

Diving Deep and Finding Vulnerabilities in Modern Web Applications

As more and more companies shift the responsibility of security earlier [https://information.rapid7.com/shifting-left-sdlc.html] in the software development lifecycle (SDLC), DevOps teams are being tasked with detecting vulnerabilities within their applications. Already scrambling to keep up with the terminology, processes, and technologies of modern-day security, DevOps teams also have to contend with the dynamic complexities of securing web apps [https://www.rapid7.com/fundamentals/web-applica

4 min DevOps

How DevOps Can Use Quality Gates for Security Checks

Your team has been working at all hours to put the final touches on code for a new big feature release. All the specs are in, the feature works as expected, and the code is pushed to production. A few hours later, the daily security scan runs and the alerts start piling in. What went wrong? And what do you do now? Typically when this happens, it means rolling back the entire deployment, retroactively fixing the bugs and vulnerabilities in the code, and a week or two later, re-deploying. If you’

2 min GDPR

Securing Personal Information in Web Applications for GDPR

The General Data Protection Regulation (GDPR) [https://www.rapid7.com/solutions/compliance/gdpr/], is just around the corner: it comes into effect on May 25, 2018. If you feel a refresher on this far-reaching privacy law is in order, we’ve got a lot of great content [/tag/gdpr/] to help you and your organization get ready. Now, how do most organizations collect personal information from users these days? Web applications, of course! And as we know [https://www.youtube.com/watch?v=B6Dzc7_3w-k],

4 min Application Security

3 Ways to Accelerate Web App Security Testing

It used to be that web application security testing [https://www.rapid7.com/solutions/application-security/] was the job of just the security team. Today, it is becoming a much more integrative function, especially for organizations who have adopted DevOps [/2015/03/13/getting-started-with-devops/]. Development cycles have become shorter and features are released more frequently for companies to stay competitive. Trouble is, with shorter development cycles, security needs a way to keep up. After

2 min InsightAppSec

How to Scan Your Own Application with the InsightAppSec Free Trial

We think this is pretty sweet news. You asked, we built it—now you can scan one of your own applications with an InsightAppSec trial! But before you start scanning your own application with the InsightAppSec free trial [https://www.rapid7.com/try/insightappsec], you’ll need to validate your application’s domain. This requires adding a custom-generated meta tag to your application’s root path. Let’s get started. When adding your app to the InsightAppSec free trial, you’ll be given an option to

2 min InsightAppSec

Making the Dream Work: Teaming with Dev for Safer Production Apps

So you’ve read the reports outlining how important it is for developers and security teams to work together to build web applications quickly and securely [https://information.rapid7.com/sans-state-of-application-security-2017-report.html] , you’ve scoured the web and have researched the importance of building a web application program at your organization [https://www.rapid7.com/solutions/application-security/], perhaps even watched some videos talking about the evolution of web applications an

3 min InsightAppSec

3 Questions to Ask When Prioritizing Web Application Vulnerabilities

Dynamic application security testing (DAST) often results in a constantly evolving list of security vulnerabilities. When scanning a web application [https://www.rapid7.com/fundamentals/web-application-security/] in production or in an active testing environment, issues can crop up as quickly as changes happen within the app. And when exposed to the internet itself, there are many more ways in which security vulnerabilities [https://www.rapid7.com/fundamentals/vulnerabilities-exploits-threats/]

4 min InsightAppSec

The 4 Big Differences Between Network Security and Web Application Security

Tomato, tomato, potato, potato, network security and web application security [https://www.rapid7.com/solutions/application-security/]. Two things that may seem similar, they are actually quite different. Network security (also known as vulnerability assessment or vulnerability management [https://www.rapid7.com/solutions/vulnerability-management/]) has been around for quite some time and is something most security practitioners today know well. Web application security, however, is still not wi

4 min Application Security

Fast and Secure SDLC: 4 Barriers to Tackle for Better Web Application Security

It’s been months in the making. It promises to generate new revenue for the business. And there’s one team that hasn’t seen it yet. We’re talking about your shiny new web application. Back in the day, it used to be that development would create an application, throw it over the wall to security to review, and security would return back a laundry list of issues that needed to be fixed before it could be pushed to production. Or, perhaps worse, apps are reviewed only after they are pushed to produ

3 min InsightAppSec

InsightAppSec Feature Highlights: On-Premise Engines, JIRA Integration, and More

Powerful Yet Simple DAST Scanning Gets Even Better InsightAppSec [https://www.rapid7.com/products/insightappsec/], Rapid7’s cloud-powered web application security testing solution [https://www.rapid7.com/solutions/application-security/], has added three powerful new features: * On-premise scan engines * JIRA integration * Scan Activity view Test Your Internal Applications and Reduce Your Risk Web application security testing [https://www.rapid7.com/fundamentals/web-application-security-test