Rapid7 approved by MasterCard as a Security Scanning Vendor for Achieving Compliance with the Payment Card Industry (PCI) Data Security Standard

Rapid7 Attains Approval After Completing the MasterCard Site Data Protection (SDP) Vendor Compliance Testing Program

Boston - May 2, 2006 - Rapid7 LLC today announced it has successfully completed the MasterCard Site Data Protection (SDP) Vendor Compliance Testing Program, which certifies the enterprise vulnerability management company to help merchants achieve compliance with the Payment Card Industry (PCI) Data Security Standard. Rapid7 is the provider of NeXpose PCI Compliance, which delivers network vulnerability scanning services and meets the security scanning requirements of the MasterCard SDP program.

By using a MasterCard-approved security scanning vendor such as Rapid7, merchants can proactively protect their businesses and the data in their payment systems against the threat of compromises. Left undetected, vulnerabilities can potentially lead to unauthorized access, but by finding and fixing any exposures, an SDP-compliant solution reduces the risk of intrusion.

To become qualified as an SDP compliant scanning vendor, Rapid7's NeXpose PCI Compliance demonstrated its effectiveness at proactively locating and reporting vulnerabilities during rigorous evaluation in MasterCard's test environment. MasterCard's testing process addresses how the vendor collects and manages scan requests from customers, the ability of the vendor to identify vulnerabilities and misconfigurations in the network and Web applications, and how the vendor presents the scan results.

A key focus of the MasterCard SDP program is to ensure that merchants and service providers (third party processors and data storage entities) are securely storing credit card account data in accordance with the PCI Data Security Standard. To demonstrate compliance, merchants and service providers must perform onsite security assessments and quarterly network scans. Rapid7 recommends that businesses serious about protecting customer data and avoiding the cost of incidents should do more than the minimum level mandated by the PCI standard.

"The return on investment for deploying a self-auditing solution is easily accomplished," said Alan Matthews, president of Rapid7 LLC. "The financial penalty for failure to provide protected systems for processing credit card data makes vulnerability testing mandatory. Consumers need to be assured that the online transaction systems they are using are secure."

NeXpose PCI Compliance provides scan templates and reporting capabilities that meet or exceed the MasterCard SDP specifications for system security scanning. The PCI Standard compliance report provides pass/fail information at both executive and administrator detail levels. A complete remediation plan is provided that enables security analysts to bring their system devices into full compliance with the PCI Standard.

The PCI Data Security Standard is the global standard adopted by companies in the credit card industry to ensure the protection of customer information. According to the standard, all members, merchants, and service providers that store or process credit cards must meet specific security requirements, which necessitate building a secure network and maintaining a vulnerability management program.

The MasterCard SDP Program provides merchants, service providers and acquirers with easy access to the security vendors that it has recognized as qualified and compliant by maintaining a list on its Website. Rapid7 is on the MasterCard SDP Program's list of approved security scanning vendors.

For more information about Rapid7's PCI certification services, email our PCI support team.

About NeXpose

Rapid7's award-winning NeXpose Unified Vulnerability Management (UVM) product is an all-in-one security solution that scans Web servers, Web applications, databases and networks to locate threats, assess their risk to the environment and devise a remediation plan. NeXpose incorporates an expert system to build a knowledge base of facts on the environment it explores and model potential targeted attacks to expose all existing threats. NeXpose provides robust reporting capabilities that ensure compliance with governmental regulations, corporate security configuration policies, and the PCI Data Security Standard. NeXpose is available as an appliance, downloadable software or an On-Demand hosted solution.

About Rapid7

Rapid7 is a leader in vulnerability management and compliance, delivering a single unified solution across an organization's entire infrastructure. Rapid7's NeXpose is the only solution that includes support for web applications, databases, operating systems, and network devices in a single system. NeXpose uncovers "hidden" threats that other systems cannot find, while at the same time separating these real threats from excessive “false positive” noise common to most vulnerability management systems. Organizations, including Black & Decker, Trader Joe's, Florida State University, the New York Times, and the City of Philadelphia, continually rely on Rapid7 to mitigate risk and remain compliant. Rapid7 is headquartered in Boston, MA, with an office in Los Angeles, California.