A holistic view of threat and vulnerability risk

Rapid7 and Modulo announced they are working together to deliver an holistic view of threat and vulnerability risk, correlated with broader regulatory, policy and compliance risk analysis.

Today’s organizations require top-down visibility of risk to their assets and business operations. Yet there is no unified way of reporting all IT risks across the vast and layered landscape of security and risk tools, or rating scale for ranking problems. Modulo and Rapid7 have addressed this challenge with a seamlessly integrated business process workflow between Rapid7 Nexpose and Modulo Risk Manager, enabling customers to organize and prioritize thousands of assets and quickly focus on the items that pose the greatest risk to their business.

Benefits of the joint Rapid7 and Modulo offering include:

• Common repository to manage all GRC processes: Perform optimized gap analyses, produce business-related enterprise risk profiles and customized scoring, and prioritize investments according to each asset’s potential impact and importance to the organization
• Continuous discovery of virtualized assets: Native integration with VMware vCenter that enables Nexpose to deliver accurate visibility of all virtual assets and their threat exposure
• Rapid7 Real Risk: Clear insight into the real risk of each unique environment by incorporating information on Exploit Exposure, Malware Exposure, temporal and weighted risk scores as well as CVSS rankings
• Eliminate redundant costs and controls: Modulo Risk Manager is delivered out-of-the-box with one of the industry’s most extensive knowledge bases of content cross-mapped with the latest sources of risk, mitigation and multi-regulatory compliance including Sox, PCI, HIPAA, GLBA, FISMA, BASEL II, ISO 27001, BS-25999, COBIT, Shared Assessments and more.
• Breadth of vulnerability scanning: Scans for over 22,000 vulnerabilities with more than 75,000 vulnerability checks in networks, operating systems, Web applications and databases across a wide range of platforms.

The joint solution feeds detailed asset identification and scanning results from across the entire IT environment – including web, network, applications and databases – into a broader IT risk analysis process. Customers can identify how vulnerabilities present risk to specific business operations, processes, and strategic or tactical activities. They can then manage those exposures through remediation workflow.

The validity of these risk scenarios will be further enhanced by executing an advanced penetration test to validate reported exposures and help prioritize remediation steps. Modulo will integrate Metasploit Professional with Modulo Risk Manager in Q3 2012.