Deploy Vulnerability Management (InsightVM) in InsightGovCloud

What is Vulnerability Management (InsightVM)?

Vulnerability Management (InsightVM) is a data-rich resource that can amplify the other solutions in your tech stack, from SIEMs and firewalls to ticketing systems.

Vulnerability Management (InsightVM) brings together Rapid7’s library of vulnerability research knowledge from Nexpose, exploit knowledge from Metasploit, global attacker behavior, internet-wide scanning data, exposure analytics, and real-time reporting.

A Vulnerability Management (InsightVM) installation has these components:

Before you begin the deployment, ensure you have read and completed any outstanding tasks in the deployment overview.

Security Console system requirements

The complete hardware and software requirements are provided in the system requirements section  of the Vulnerability Management (InsightVM) quick start guide.

It is important to note that the Security Console requires significantly more system resources than a Scan Engine, as it includes a Web interface, PostgreSQL database, and reporting capabilities.

Deploying on a virtual machine

There are some requirements to consider before you deploy the Security Console on a virtual machine (VM):

• The memory reservation must match the allocation. For example, if you allocate 32 GB of RAM, you must also reserve 32 GB.
• Avoid using shared memory configurations, which can lead to:
  • Degraded performance
  • Out-of-memory (OOM) errors

Security Console minimum specifications

Scan Engine minimum specifications

Several factors can affect memory consumption during scans, including the type of scan being conducted (for example, Policy, Vulnerability, or Discovery), the number of ports detected that require fingerprinting, and the configured Maximum assets scanned simultaneously per Scan Engine.

Additionally, the operating system on which the scan engine application is installed can influence memory usage; for example, a Windows server may use more memory compared to a Linux server.

Operating systems

Microsoft and Linux Servers are supported. Specific server information is available in the Vulnerability Management (InsightVM) Quick Start Guide .

User access and security

Whether you are a new or an existing Rapid7 customer, an essential part of the deployment is to enable FIPS mode .

FIPS stands for the Federal Information Processing Standard and it is required to ensure compliance with the InsightGovCloud environment.

The Security Console and Scan Engine can store and interact with sensitive data and should therefore be installed on a FIPS-compliant encrypted partition and FIPS-compliant operating system.

It is advisable that access to the file system and operating system be monitored and restricted to users who are authorized for the highest security classification within your organization.

Deploy as a new or existing customer

A Rapid7 Engineer will be assigned to help you with the initial deployment of the Security Console. When you are ready to begin the deployment, contact your Rapid7 Federal Customer Success Manager.

The deployment process includes some steps to prepare your operating system, which are essential to ensure a successful installation.

Here is an overview of the deployment process:

1. If you haven’t yet activated your InsightGovCloud account, do so now by following the instructions in Phase 2, Task 1: Activate your account of the deployment overview.
2. Enable Multi-Factor Authentication as explained in Phase 2, Task 4: Configure security policies of the deployment overview.
3. Complete Prerequisite 1: Update the firewall rules for external, internal, and Rapid7 Agent connectivity.
4. Complete Prerequisite 2: License and system requirements.
5. Follow the Vulnerability Management (InsightVM) for InsightGovCloud installation procedure according to your operating system.

• Linux installation
• Windows installation

6. Enable FIPS mode .
7. Start the Security Console .

Prerequisite 1: Update the firewall rules

Firewall rules for external network connectivity

The InsightGovCloud environment uses a different set of network endpoints for communication with Vulnerability Management and Exposure Analytics (EA). To ensure full functionality, update your firewall rules as follows:

Firewall rules for internal network connectivity (host level firewall)

Scan Engines and Security Consoles must be able to communicate with each other in order to initiate scans and integrate scan data. Distributed Scan Engines can communicate with a Security Console in two ways:

• Standard (Console-to-Engine) - This is the most common communication method for a distributed Scan Engine. When the Security Console determines that a scan needs to take place on your target assets, it initiates the connection to communicate with the Scan Engine. As a result, Scan Engines must allow inbound traffic on the default port of 40814 in order to create this connection.
• Reverse (Engine-to-Console) - The engine-to-console communication method, which is implemented by a “reverse” pairing procedure, is useful in cases where your security policies restrict inbound connections to the network hosting the scan engine. In engine-to-console configurations, the Scan Engine routinely pings the Security Console to see if a scan job needs to be run. If the Security Console does in fact have a scan job ready, it accepts the connection from the Scan Engine and the communication channel is established. As a result, Security Consoles must allow inbound traffic on the default port of 40815 in order to create this connection.

Firewall rules for Rapid7 Agent connectivity

The InsightGovCloud environment uses a different set of network endpoints for agent communication.

To maintain full agent functionality:

• Review and update your firewall rules to allow outbound access to FedRAMP-specific URLs and IP addresses.
• Ensure connectivity for critical agent functions, including data transmission, update delivery, and vulnerability assessments.

Internal ports for scan engine connectivity

The Security Console requires specific internal ports to be opened to allow communication to the console and between the scan engines.

The requirements are as follows:

Rapid7 Agent (Insight Agent) requirements

To use the Rapid7 Agent (Insight Agent) with Vulnerability management, read the requirements in Deploy Rapid7 Agent in InsightGovCloud. This section of the documentation also contains helpful information about asset correlation in the Security Console and how to use the Universally Unique Identifier (UUID) retrieval feature.

Operating Systems that support the Scan Assistant

Information about the supported operating systems and installation instructions for the Scan Assistant is available in the Scan Assistant documentation .

Benefits of using the Scan Assistant and Rapid7 Agent

The value of having both the Rapid7 Agent (Insight Agent) and the Scan Assistant on the same system is multifaceted:

• Complementary functionality - The Rapid7 Agent (Insight Agent) and Scan Assistant are designed to complement each other. The Agent performs local checks, while the Scan Assistant allows for immediate authenticated vulnerability scans, which are useful for remediation scans. This combination ensures comprehensive vulnerability assessment and management.
• Efficient remediation - If a vulnerability is discovered by the Agent, the Scan Assistant can be used to immediately verify remediation by kicking off an authenticated scan, rather than waiting for the Agent to conduct another assessment.
• Expanded policy scanning - The Scan Assistant provides access to a broader range of policy scans beyond what the Agent can assess. It supports all categories of policy scans, including CIS, DISA, FDCC, and USGCB, and allows for custom policy building, which is beneficial for adhering to specific internal policies.
• Resource efficiency and security - The Scan Assistant consumes fewer resources and provides a more secure scanning method by removing the need for administrative credential management. It also decreases the time required to complete policy scans.

Overall, deploying both tools on the same system enhances vulnerability coverage, allows for immediate verification of remediation, and supports comprehensive policy compliance checks.

Prerequisite 2: License and system requirements

In order to complete the installation, you will need this information from your account team:

• A Security Console license key, in the format: MOCK-KEY0-L8ET-CHRD.
• An email with the subject line Rapid7 Insight: Activate Your Account.

You will also need a server to be used as the Security Console. Specifically, you will require:

• Hardware as outlined in the Vulnerability Management (InsightVM) system requirements :
  • 24 GB RAM, 8 CPU, fast SSD.
  • Network connection: The IP address is referred to in this article as <yourConsoleIPaddress>.
• A dedicated IP address.
• Administrator privileges.

Install Vulnerability Management for InsightGovCloud (Linux)

Linux software packages

These packages will be installed when you run the installation commands:

• rng-tools – Required for FIPS-mode. Provides hardware and kernel random number generator (RNG) utilities to ensure the system has sufficient entropy for cryptographic operations, which is important for SSL, SSH, and FIPS.
• policycoreutils – Core administrative utilities for SELinux (Security-Enhanced Linux), such as setsebool, restorecon, and load_policy, used to manage and apply SELinux security policies.
• policycoreutils-python-utils – Adds extra SELinux management tools written in Python, like semanage (for managing ports, file contexts, booleans, and users).

Perform the Linux installation

The section that follows provides sample commands for Ubuntu, RHEL, and Rocky for the prerequisite, Security Console, and InsightGovCloud configuration. The comments specify the distribution.

 
# Update system packages..."
# for RHEL
sudo dnf -y update
# for Ubuntu
sudo apt-get update -y
 
 
# Install prerequisite packages (RNG, SELinux tools when available, curl)..."
# for RHEL
sudo dnf -y install rng-tools policycoreutils policycoreutils-python-utils curl
# for Ubuntu
apt-get install -y rng-tools5 rng-tools
 
 
# Enable and start RNG daemon..." 
# For RHEL/Rocky 
sudo systemctl enable --now rngd.service 
# For Ubuntu, varies by version 
# Most common 
sudo systemctl enable --now rngd.service 
# Alternate sudo systemctl enable --now rng-tools.service 
# Another variant 
sudo systemctl enable --now rng-tools-debian.service
 
 
 
# Create /opt/rapid7/nexpose directory..."
sudo install -d -m 755 /opt/rapid7/nexpose
sudo chown -R root:root /opt/rapid7
 
 
# For RHEL/SELinux: label Rapid7 directories and opening TCP 3780...
sudo semanage fcontext -a -t usr_t '/opt/rapid7(/.*)?' || true
sudo semanage fcontext -a -t bin_t '/opt/rapid7/nexpose(/.*)?' || true
sudo semanage fcontext -a -t var_log_t '/opt/rapid7/nexpose/nsc/logs(/.*)?' || true
sudo semanage port -a -t http_port_t -p tcp 3780 2>/dev/null || sudo semanage port -m -t http_port_t -p tcp 3780 || true
sudo restorecon -RF /opt/rapid7 || true
 
# Download Rapid7 InsightVM installer..."
sudo curl -fL https://download2.rapid7.com/download/InsightVM/Rapid7Setup-Linux64.bin -o Rapid7Setup-Linux64.bin
sudo chmod +x Rapid7Setup-Linux64.bin
 
# Run Rapid7 installer...
# USE ALL DEFAULTS. DO NOT START AUTOMATICALLY
sudo ./Rapid7Setup-Linux64.bin
 
 
# Enable FedRAMP and FIPS mode..."
sudo bash -lc cat > /opt/rapid7/nexpose/nsc/CustomEnvironment.properties <<'EOF'
fipsMode=1
com.rapid7.federal=true
EOF
 
 
# Re-apply SELinux labels..."
sudo restorecon -RF /opt/rapid7/nexpose || true
 
 
# Reload systemd and enable Nexpose Console..."
sudo systemctl daemon-reload || true
sudo systemctl enable --now nexposeconsole.service || true
 
# Verify FIPS/Federal mode in logs..."
sudo grep -q "Console is a " /opt/rapid7/nexpose/nsc/logs/nsc.log
sudo grep -q "Console FIPS " /opt/rapid7/nexpose/nsc/logs/nsc.log

Install Vulnerability Management for InsightGovCloud (Windows)

1. Login into the new server as an administrator, for example, RDP: <yourConsoleIPaddress>.
2. Install one of the supported Windows versions as described in the Vulnerability Management (InsightVM) documentation .
3. Download and install the Rapid7insightVM Install Package from https://download2.rapid7.com/download/InsightVM/Rapid7Setup-Windows64.exe .

3. Open a text editor, paste the following code, and save the file with the name CustomEnvironment.properties.

fipsMode=1 
com.rapid7.federal=true 

4. Save the file to the ‘nsc’ directory within your install location. The nsc directory is usually located at c:\Program Files\rapid7\nexpose\nsc\.
5. Reboot the server.
6. Ensure that FIPS mode is enabled by searching the log for a line that says “Console FIPS Mode switched on = true”. The log is usually located at c:\Program Files\rapid7\nexpose\nsc\logs\nsc.log.

Once this procedure is complete, you can proceed to pair the Security Console with InsightGovCloud.

Pair the Security Console with InsightGovCloud

Now that you have your Security Console set up, you can license and pair it to the InsightGovCloud Platform.

Prerequisites

Before you start the pairing process:

• Ensure you have your Security Console license key, in the format: MOCK-KEY0-L8ET-CHRD.
• Locate your activation email with the subject line Rapid7 Insight: Activate Your Account.
• Enable Multi-Factor Authentication (MFA) and enforce one of the FedRAMP-authorized MFA methods: WebAuthn or Okta Verify. For instructions, go to Multi-factor authentication . You may test this setting by logging out of the Command Platform and logging back in. You will be prompted for enrollment into MFA.

Transitioning from an existing customer environment

If you are transitioning to InsightGovCloud from an existing commercial environment, there are some important considerations to note:

• Historical data and configured experiences from your commercial Vulnerability Management (InsightVM) account can’t be migrated to InsightGovCloud. These include agent policies, dashboards, goals and SLAs, and remediation projects in Exposure Analytics (EA).
• Your commercial EA environment will expire 7 days after the new Security Console instance is deployed for InsightGovCloud. Follow the guidance in this customer update guide , which is available after you log in to your Rapid7 environment.

Install FedRAMP-compliant Rapid7 Agents

To ensure that your Rapid7 Agents (Insight Agents) appear in Data Collection Management (DCM) and your Policy assessment results appear in Vulnerability Management (InsightVM), you will need to install new Agents that are compatible with InsightGovCloud.

Follow the instructions in Deploy Rapid7 Agent (Insight Agent) in InsightGovCloud.