Rapid7: NICER - diagnosing the internet’s security flaws
Released at the end of July 2020, Rapid7’s NICER report is one of the most ambitious pieces of internet security-related research ever conducted.
Focusing on three core topics - National, Industry and Cloud Exposure - the report has been intended by Rapid7 as a conversation starter on the current state of internet security.
In a world which is currently in the grip of a significant digital transformation, in no small part accelerated by the COVID-19 pandemic which has forced companies all around the world to consider operational alternatives, the question of security could not be more relevant.
The ‘myth of the silver city’
First and foremost, the NICER report aims to dispel the false notion that internet security is ideal in its current state. Although most people’s daily interactions with the internet give no hint of the fragility underneath, Rapid7 is keen to quantify and demonstrate the reasons why this is not the case.
Everybody can afford to be more vigilant and proactive in bolstering their cyber defences, the report posits. After all, technology might have advanced exponentially in the last 50 years, yet the threats presented by phishing scams and exploiting legacy software on the edge remain.
NICER includes lists of countries and industries rated by their exposure to risk so that interested parties can compare their ‘risk neighbourhood’ with others and measure relative progress.
Perhaps most disconcertingly, the most at risk industries are revealed to include financial services, retail and pharma (i.e. vital services), with many FTSE 100, Fortune 500 and Nikkei Index entities suffering disproportionately.
This highlights Rapid7’s argument that a constant re-evaluation and reassessment of legacy systems is necessary; particularly amongst older, established or ‘traditional’ companies, outdated infrastructures that seem to operate well could be the Achilles heel which leads to great financial loss or security breaches in the future.
Starting a conversation on security
Far from being a final, declaratory statement, Rapid7 has intended NICER to be the opening remarks to a much broader conversation on the subject.
Commonly used security protocols such as Telnet and SMB are analysed at great length and a balanced summary of each system’s strengths, weaknesses and applicable use cases is presented.
The ultimate conclusion is an ambiguous one: “Things aren't great, but not disastrously bad and relatively small changes in how we design, develop and deploy services will still have a great impact on the stability, safety and security of the internet as a whole.”
Rapid7 hopes that its work, the result of four years’ research, will generate heated debate within the tech industry on how best to address the fundamental issues around internet security.
Whether the answer lies in developing new protocols, re-evaluating how programmers are trained or something yet unthought of, the company hopes that the report will spur a serious discussion on what we desire the future of the internet to be.
Download the full NICER report here
Stay tuned for our feature article on NICER with Rapid7’s Director of Research Tod Beardsley - scheduled to appear in the October edition of FinTech Magazine.
