As companies continue to get breached by the hour, IT and security teams are constantly scrambling their defenses in hopes of eradicating attackers from their networks. The (sort of) good news is that security software and hardware vendors are overflowing with product and service offerings designed to help you. Many of them even promise to keep the bad guys and gals out of your systems 24 hours a day, 7 days a week!<\/p>\r\n\r\n\r\n\r\n
So all you have to do is get out your credit card, install one of these products and get a good night\u2019s sleep, right? Unfortunately, during the penetration tests we do for clients around the country, we find time and time again that these expensive security solutions have considerable blind spots. Many fail to fully detect even the most basic attacks. And security products also need to be fine-tuned<\/a> for your environment; default settings will not cover all concerns specific to your environment.<\/p>\r\n\r\n\r\n\r\n In this article, we will show you how to run some of these “hacker low-hanging fruit” attacks to test the effectiveness of your organization\u2019s security services. For the sake of having a real commercial tool to conduct these attacks against, we chose a security solution called InsightIDR from Rapid7 to install in our lab environment.<\/p>\r\n\r\n\r\n\r\n InsightIDR has SIEM<\/a> at its foundation and scales out to essentially be an XDR solution<\/a> covering endpoints<\/a>, network traffic analysis<\/a>, UEBA<\/a>, incident response<\/a> and more. In our testing we found a number of issues that are common in SIEM systems. The good news is vendors are responsive to these issues \u2013 they’d rather hear them from “white hat” folks and customers than the bad guys \u2013 and we’ve been in touch with Rapid7 throughout our work. We found Rapid7 to be responsive and straightforward to deal with – a good sign for user support, and critically important in cybersecurity. Rapid7 is working on a number of fixes to our findings \u2013 some of which were known issues the company was already aware of \u2013 so we’ll update this article in a few months to reflect completion of that work. We’ve also included Rapid7\u2019s comments in a number of places.<\/p>\r\n\r\n\r\n\r\n This is, to our knowledge, one of the few times that test results have been published on a cybersecurity product of this magnitude, so our goal is largely educational. We encourage you to use this article as a guide to conduct your own in-house testing of security solutions. We’ve focused on a number of detectable “warning shots” that can happen during an attack (or a pentest<\/a>) that will let you know that bad things are brewing behind the scenes. If one or more of these attacks are not detected, challenge your vendors to write a signature for them. The result will be a stronger product for their entire user base.<\/p>\r\n\r\n\r\n\r\n