Rapid7 > Case Studies > Rapid7 InsightVM and InsightIDR Integrate to Drive 60% Time Savings and Ease Compliance for Energie Suedbayern

Rapid7 InsightVM and InsightIDR Integrate to Drive 60% Time Savings and Ease Compliance for Energie Suedbayern

Customer Company Size

Mid-size Company

Region

Europe

Country

Germany

Product

InsightVM
InsightIDR
Nexpose

Tech Stack

SIEM
User Behavior Analytics (UBA)
Endpoint Detection and Response (EDR)
Cloud Services

Implementation Scale

Enterprise-wide Deployment

Impact Metrics

Cost Savings
Productivity Improvements
Customer Satisfaction

Technology Category

Cybersecurity & Privacy - Endpoint Security
Cybersecurity & Privacy - Network Security
Analytics & Modeling - Predictive Analytics

Applicable Industries

Utilities

Applicable Functions

Business Operation
Quality Assurance

Use Cases

Intrusion Detection Systems
Predictive Maintenance
Remote Asset Management

Services

System Integration
Cloud Planning, Design & Implementation Services

About The Customer

Energie Suedbayern (ESB) is a Southern Bavarian energy provider that supplies natural gas and electricity to 120,000 households in the south of Germany. As the largest operator of its kind in the region, ESB employs around 350 people, with 14 staff members working alongside Benjamin Nawrath in IT. The company operates in the energy/utilities industry and has a significant presence in Germany’s large energy sector, making it a sizeable target for cyber threats. ESB has been proactive in adopting advanced cybersecurity measures to protect its IT infrastructure and ensure compliance with regulatory requirements.

The Challenge

One of Benjamin Nawrath’s biggest challenges is maintaining compliance with Germany’s IT Security Act (ITSG), which became law in 2015 but applies from July 2017 onward. The law requires all critical infrastructure providers to run an advanced cybersecurity program designed to ensure the availability, integrity, authenticity, and confidentiality of their IT infrastructure. It also demands that organizations regularly provide certification proving their compliance. Failure to do so could result in a fine of hundreds of thousands Euro. With a large and complex environment to monitor (including 2,000 IP addresses), limited IT staff resources, a growing compliance burden, and ever-determined hackers to keep at bay, Benjamin Nawrath needed robust technology solutions to help overcome these major challenges.

The Solution

ESB IT had been using Rapid7’s leading vulnerability management solution Nexpose previously, so expanding their portfolio with Rapid7 was a natural choice. To fill the need for an incident detection and response solution, a Proof of Concept (PoC) with Rapid7 InsightIDR was quickly and easily set up to provide that all-important confirmation of the product’s capabilities. ESB moved forward with the combination of InsightVM (the evolution of Rapid7 Nexpose) and InsightIDR—both powered by the Rapid7 Insight cloud—to offer industry-leading vulnerability management and incident detection and response. Benjamin Nawrath states that both solutions were easy to set up and maintain, and that they provide “one agent to rule them both”—simplifying management and centralizing reporting. ESB has been a keen adopter of cloud services, so there were no roadblocks in terms of delivery. And since it was for security purposes, the monitoring of IP addresses was given the green light by representatives from the German works council.

Operational Impact

InsightIDR has saved ESB IT time and helped them respond to incidents far more quickly. Unifying SIEM, user behavior analytics (UBA), and endpoint detection and response (EDR), it was designed from the ground up to detect intrusions as early on in the attack chain as possible, leaving nowhere for the bad guys to hide.
The easy-to-manage portal allows Benjamin Nawrath to keep an eye on any unusually high values, if remote users are logging in from other countries, or any other metrics that might indicate non-compliance. Email alerts complete the picture and are also sent to other members of the IT team, allowing them to respond if anything malicious is found.
Rapid7’s InsightVM automatically collects, monitors, and analyzes any vulnerabilities on the corporate network, featuring advanced analytics and reporting to allow users to prioritize and remediate risk. The agents have also helped save time over regular scans, and the benefit of tight integration with InsightIDR has boosted efficiency by enabling highly accurate correlations between incidents and vulnerabilities.

Quantitative Benefit