Rapid7 InsightCloudSec

What is Rapid7 InsightCloudSec?

Rapid7 InsightCloudSec is a Cloud-Native Application Protection Platform (CNAPP) that combines CSPM, CIEM, workload protection, and Kubernetes security in a single solution.

Key differentiators:

• CNAPP - comprehensive cloud-native protection
• CIEM - cloud entitlement management
• Multi-cloud - AWS, Azure, GCP, Alibaba
• Shift-left - security in CI/CD pipeline

CNAPP Architecture

graph TB
    subgraph "Cloud Environments"
        A[AWS] --> E[InsightCloudSec]
        B[Azure] --> E
        C[GCP] --> E
        D[Kubernetes] --> E
    end

    subgraph "Protection Layers"
        E --> F[CSPM]
        E --> G[CIEM]
        E --> H[Workload Protection]
        E --> I[IaC Security]
    end

    subgraph "Outputs"
        F --> J[Risk Dashboard]
        G --> J
        H --> J
        I --> J
        J --> K[Automated Remediation]
    end

Cloud Security Posture Management (CSPM)

Misconfiguration detection:

Checked Resources

Cloud	Resources
AWS	EC2, S3, IAM, RDS, Lambda, VPC
Azure	VMs, Storage, AD, SQL, Functions
GCP	Compute, Storage, IAM, BigQuery
K8s	Pods, Services, RBAC, Network Policies

Compliance Frameworks

• CIS Benchmarks (AWS, Azure, GCP, K8s)
• SOC 2
• PCI DSS
• HIPAA
• GDPR
• NIST 800-53

Auto-Remediation

• Automatic misconfiguration fixing
• Policy-based enforcement
• Drift detection

Cloud Infrastructure Entitlement Management (CIEM)

Cloud permission management:

[Identity] --> [Permissions Analysis] --> [Effective Access] --> [Risk Score]
                      |
              [Unused Permissions]
                      |
              [Over-privileged Accounts]

CIEM Features:

• Permission analysis - effective permission analysis
• Least privilege - excess permission identification
• Cross-account access - cross-account access visibility
• Service account risk - service account risk
• Identity governance - identity management

Workload Protection

Cloud workload protection:

Container Security

• Image scanning - image scanning
• Runtime protection - runtime protection
• Registry integration - ECR, ACR, GCR
• Vulnerability management - vulnerability management

Kubernetes Security

• Cluster assessment - cluster assessment
• RBAC analysis - K8s permission analysis
• Network policy - network policy analysis
• Pod security - pod security

Serverless Security

• Lambda/Functions - function scanning
• API Gateway - configuration analysis
• Event triggers - trigger monitoring

Infrastructure as Code (IaC) Security

Shift-left security in pipeline:

Supported Formats

• Terraform
• CloudFormation
• ARM Templates
• Kubernetes manifests
• Helm charts
• Docker Compose

CI/CD Integration

• GitHub Actions
• GitLab CI
• Jenkins
• Azure DevOps
• CircleCI

[Code Commit] --> [IaC Scan] --> [Policy Check] --> [Deploy/Block]
                       |
               [Security Findings]

Multi-Cloud Visibility

Single view across all clouds:

Feature	AWS	Azure	GCP	Alibaba
CSPM	✅	✅	✅	✅
CIEM	✅	✅	✅	✅
Container	✅	✅	✅	✅
Serverless	✅	✅	✅	✅

Risk Prioritization

InsightCloudSec prioritizes risk:

• Exposure - is the resource publicly accessible?
• Sensitivity - what data does it contain?
• Exploitability - do exploits exist?
• Business context - business criticality

Who is it for?

Rapid7 InsightCloudSec is for organizations that:

• Use multi-cloud (AWS, Azure, GCP)
• Have Kubernetes in production
• Need CIEM for permission control
• Want shift-left security in CI/CD

Deployment with nFlo

1. Cloud Discovery - account and subscription identification
2. API Integration - cloud provider connection
3. Baseline Assessment - first security assessment
4. Policy Configuration - policy configuration
5. CI/CD Integration - pipeline integration
6. Auto-Remediation - auto-remediation configuration
7. Training - team training