IBM Terraform (formerly Hashicorp Terraform) is a cloud infrastructure automation tool used to create, change, and improve production infrastructure, and it allows infrastructure to be expressed as code. It is available Open Source, and via Cloud and Self-Hosted editions.
$0
Rapid7 InsightVM
Score7.8 out of 10
N/A
InsightVM is presented as the next evolution of Nexpose, by Rapid7. This Insight cloud-based solution features everything included in Nexpose, such as Adaptive Security and the proprietary Real Risk score, and extends visibility into cloud and containerized infrastructure. InsightVM also offers advanced remediation, tracking, and reporting capabilities not included in Nexpose.
Anything that needs to be repeated en masse. Terraform is great at taking a template and have it be repeated across your estate. You can dynamically change the assets they're generating depending on certain variables. Which means though templated assets will all be similar, they're allowed to have unique properties about them. For example flattening JSON into tabular data and ensuring the flattening code is unique to the file's schema.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
InsightVM is great for finding all devices on your network and where the misconfigurations exist. We all have to patch our systems and applications, but it can be difficult to keep track of which systems are up to date. This tool is very helpful in filling in this gap and helping you organize that information. It is easy to get a big picture view of how your organization is doing from a vulnerability perspective, and it is equally as easy to drill down and get specific details that you need. Prioritization is crucial when it comes to this space, because you can never address every vulnerability, so you need to make sure the highest priority items are being remediated. R7's tool excels in this area and highlights items you weren't even aware of.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
The language itself is a bit unusual and this makes it hard for new users to get onboarded into the codebase. While it's improving with later releases, basic concepts like "map an array of options into a set of configurations" or "apply this logic if a variable is specified" are possible but unnecessarily cumbersome.
The 'Terraform Plan' operation could be substantially more sophisticated. There are many situations where a Terraform file could never work but successfully passes the 'plan' phase only to fail during the 'apply' phase.
Environment migrations could be smoother. Renaming/refactoring files is a challenge because of the need to use 'Terraform mv' commands, etc.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
From my experience of using this tool, sometimes it gives more false positives. A few times I had performed the scan on the same IP address using QualysGuard and Nexpose, but after comparing the scan results I had found that QualysGuard had provided more accurate vulnerability information.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. TR verified that a representative sample of customers was invited. More Info
The syntax itself is pretty straightforward. The documentation is well-maintained & easy to follow. Most cloud providers, even smaller ones, maintain official provider libraries, making discovery & learning a breeze. Some, like GCP, even provide high-level libraries on top of their own more primitive provider, making building complex infra much more manageable. The language itself is cloud-agnostic, so you can literally manage resources from multiple providers in a single Terraform repo.
While I think it is a great tool and platform, I believe it (like all tools and solutions) is always evolving and the needs for clients are changing as the industry evolves and threats are upgraded. Cost is good, and support is helpful. Some things could be more granular and others could be easier to understand
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
Terraform's performance is quite amazing when it comes to deployment of resources in AWS. Of course, the deployment times depend on various parameters like the number of resources to deploy and different regions to deploy. Terraform cannot control that. The only minor drawback probably shows up when a terraform job is terminated mid way. Then in many cases, time-consuming manual cleanup is required.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
I have yet to have an opportunity to reach out directly to HashiCorp for support on Terraform. However, I have spent a great deal of time considering their documentation as I use the tool. This opinion is based solely on that. I find the Terraform documentation to have great breadth but lacking in depth in many areas. I appreciate that all of the tool's resources have an entry in the docs but often the examples are lacking. Often, the examples provided are very basic and prompt additional exploration. Also, the links in the documentation often link back to the same page where one might expect to be linked to a different source with additional information.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
I gave it a seven due to the functionality and general ease of use after the initial setup headaches, but compared to Qualys, Rapid7 Nexpose falls short on features and ease of use. Their support drags this rating down a point as well. I have gone weeks with no update on semi-critical issues and typically have to make call after call to get a semi-coherent response.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. TR verified that a representative sample of customers was invited. More Info
Terraform is the solid leader in the space. It allows you to do more then just provisioning within a pre-existing servers. It is more extensible and has more providers available than it competitors. It is also open source and more adopted by the community then some of the other solutions that are available in the market place.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
Rapid7 InsightVM is a more professional tool than Nessus because historically, it was based on metasploit which is a powerful pentesting and exploiting tool. InsightVM covers more attacking scenarios and vulnerabilities than competitors and still a leader in this domain.cloud capability is also not available forNesuus and some other products. Rapid7 InsightVM is a way better as a pentesting tool in my opinion
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
we are able to deploy our infrastructure in a couple of ours in an automated and repeatable way, before this could take weeks if the work was done manually and was a lot of error prone.
having the state file, you can see a diff of what things have changed manually out side of Terraform which is a huge plus
if state file gets corrupted, it is very hard to debug or restore it without an impact or spending hours ..
writing big scale code can be very challenging and hard to be efficient so it's usable by the whole team
After spending 2 years configuring, tuning, troubleshooting, and ultimately having nothing but regrets, we migrated away from the tool and accepted the loss.
Support had a variety of opinions, none of them consistent. No best practices. Lots of secret tricks known by support, none documented or shared until after problems are found.
Consulting services are available to come out and do a health check of your deployment, for a fee.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
