News
Aug
Ransomware continues to plague organizations, with over half of companies surveyed across 26 countries revealing that they were hit by ransomware in the last year.
Modern firewalls are highly effective at defending against ransomware attacks, but they need to be given the chance to do their job.
Our guide, Firewall Best Practices to Block Ransomware, explores how ransomware attacks work, how they can be stopped at the gateway, and best practices for configuring your firewall to optimize your protection.
Eight firewall best practices to block ransomware
To maximize the effectiveness of your anti-ransomware defenses, we recommend you:
- Start with the best protection, including a modern high-performance next-gen firewall with IPS, TLS inspection, zero-day sandboxing, and machine learning ransomware protection.
- Lock down RDP and other services with your firewall. Your firewall should be able to restrict access to VPN users and only allow sanctioned IP addresses.
- Reduce the surface area of attack as much as possible by thoroughly reviewing and revisiting all port-forwarding rules to eliminate any non-essential open ports. Where possible, use VPN to access resources on the internal network from outside rather than port-forwarding.
- Be sure to properly secure any open ports by applying suitable IPS protection to the rules governing that traffic.
- Enable TLS inspection with support for the latest TLS 1.3 standards on web traffic to ensure threats are not entering your network through encrypted traffic flows.
- Minimize the risk of lateral movement within the network by segmenting LANs into smaller, isolated zones or VLANs that are secured and connected together by the firewall. Be sure to apply suitable IPS policies to rules governing the traffic traversing these LAN segments to prevent exploits, worms, and bots from spreading between LAN segments.
- Automatically isolate infected systems. When an infection hits, it’s important that your IT security solution be able to quickly identify compromised systems and automatically isolate them until they can be cleaned up (such as with Sophos Synchronized Security).
- Use strong passwords and multi-factor authentication for your remote management and file sharing tools so that they’re not easily compromised by brute-force hacking tools.
These best practices and more are covered in greater detail our new Firewall Best Practices to Block Ransomware whitepaper.
Give your organization the best network protection with Sophos
Sophos XG Firewall gives you the best possible network protection against ransomware and other advanced threats, including cryptomining, bots, worms, hacks, breaches, and APTs.
- Industry-leading IPS stops attackers using the latest network exploits to infect your organization
- Deep learning technology identifies new and zero-day ransomware variants before they get on your network
- Sophos Sandstorm analyzes suspicious files in a safe cloud environment
XG Firewall also provides a simple, elegant way to manage your RDP, as well as support for the latest TLS 1.3 standards.
Visit Sophos.com/Firewall today to learn more and try it yourself!
Aug
In our recent survey of 5,000 IT Managers across 26 countries, 51% of respondents revealed that they were hit by ransomware in the last year. In 73% of those incidents, attackers succeeded in encrypting data. Furthermore, the average global cost to remediate these attacks was an eye-watering $761,106.
An endpoint protection solution is one of the most effective methods to protect against ransomware – but only if it’s properly configured.
Our new guide, Endpoint Protection Best Practices to Block Ransomware, explores how ransomware attacks work, how they can be stopped, and best practices for configuring your endpoint solution for the strongest protection possible.
Seven endpoint protection best practices to block ransomware
To maximize the effectiveness of your anti-ransomware defenses, we recommend:
- Turning on all policies and ensuring all features are enabled. It sounds obvious, but this is a surefire way that you’ll get the best protection out of your endpoint solution. Be sure to enable features that detect file-less attack techniques and ransomware behavior.
- Regularly reviewing your exclusions. Exclusions are sometimes leveraged to soften complaints from users who feel your protection solution is slowing down their systems. Malware that manages to make its way into excluded directories will likely succeed because it’s excluded from being checked.
- Enabling multi-factor authentication (MFA) within your security console. MFA provides an additional layer of security after the first factor, which is often a password.
- Ensuring every endpoint is protected and up to date. Checking your devices regularly to know if they’re protected and up to date is a quick way to ensure optimum protection.
- Maintaining good IT hygiene. Not only does this mitigate your cybersecurity risk, but it can save you a lot of time when it comes to remediating potential incidents in the future.
- Hunting for active adversaries on your network. Malicious actors are more cunning than ever. Take advantage of endpoint detection and response (EDR) technologies in your endpoint solution to identify advanced threats and active adversaries, and take swift action to stop threats.
- Closing the gap with human intervention. Hackers typically spend time exploring your network before deploying ransomware. The best way to detect this malicious activity is to combine human expertise with advanced endpoint technology.
These best practices and more are covered in greater detail our new Endpoint Protection Best Practices to Block Ransomware whitepaper.
How Sophos keeps you protected from ransomware
Sophos Intercept X includes all the features you need to help protect your organization from advanced ransomware attacks like Ryuk, Sodinokibi, Maze, and Ragnar Locker.
- Deep learning identifies and blocks known and unknown ransomware variants
- Anti-exploit technology stops the delivery and installation of ransomware
- CryptoGuard identifies and rolls back the unauthorized encryption of files
Sophos EDR, available for endpoints and servers, lets you hunt for threats and maintain good IT operations hygiene across your entire estate.
If you want to add human expertise to your layered security strategy, Sophos Managed Threat Response (MTR) proactively hunts for and neutralizes threats on your behalf.
Aug
Remote Desktop Protocol (RDP), while a legitimate tool, is also a common ingress point for attackers looking to break into an organization. A recent Sophos survey found that in 9% of ransomware attacks, RDP was the method used to gain entry.
Fortunately, Intercept X Advanced with EDR makes it easy to identify devices that have open RDP connections and remotely shut them down, all from a single management console.
Sophos EDR includes Live Discover, which leverages a collection of pre-written, fully customizable SQL queries to answer IT operations and threat hunting questions.
To begin, we select which devices we want to check.
There are a variety of different categories to choose from depending on your needs. We have a couple of options for RDP. Identifying devices with running processes that have active RDP connections or finding devices that have RDP enabled.
In this case we want to do the latter, so we’re going to create a short query for the task. A quick search of the Live Discover query sharing forum gives us exactly what we need. A couple of clicks later and we have our query ready to run (we also had the option to select a pre-written query to identify devices with active RDP connections).
The query identifies a device that has RDP enabled. From the same console, we launch a Live Response remote terminal session to the device and use the command line interface to disable RDP.
It’s that easy to detect RDP and disable it across your entire endpoint and server estates. To learn more about Sophos EDR head over to Sophos.com or to try it for yourself, you can start a no-obligation 30-day trial.
Aug
We’re excited to announce that we have launched the new Sophos Support Portal, which makes it much easier for you to track and manage all your support cases.
You can now visit support.sophos.com to access and create support cases.
What’s new
- Create and manage your own support cases
- Your Sophos partner can manage cases on your behalf
- More interactive ways to update and track a case
- View and manage cases created by others on your team
- Chat in real time with our support engineers
- Find suitable solutions in our knowledgebase
- Manage your team’s access to the Support Portal
How to get started
Please note that the process to create a support case has now changed. From now on, you will need to log into the new Sophos Support Portal with your SophosID. If you do not have a SophosID yet, you’ll be able to create one as part of the registration process. Registration is quick and easy. You can find more information on how to register on our Community page.
Once logged in, you can conveniently create, manage, and follow cases in the Support Portal.
You can also still call in to our support centers to open a case. You can find our phone numbers on the support pages.
Migration of existing cases
Active cases have been migrated to the new Support Portal. If you have an open case with us, you should have received an email with your new case number and further instructions. Please don’t worry that your old case has been closed, as that is just a result of the migration to the new portal.
Your Sophos partner can file cases on your behalf
Your Sophos partner is now able to manage cases on your behalf and escalate cases to support management. This Community page includes a link to the knowledgebase article that explains how you can give your partner access to view your assets and create cases on your behalf. You will still be able to log in and track cases that your partner is managing for you.
Visit our Community page for a demo and the latest information or if you need any help.
Aug
We often get asked about the inner workings of Netsparker’s vulnerability scanning engine. People familiar with network and virus scanners also ask what vulnerability databases we use and how often we update them. In reality, it’s all a lot more interesting than ticking boxes on a list of known issues. Time to set the record straight about how a cutting-edge web vulnerability scanner works.
Two Sources of Vulnerability Information
When most people hear the word “scanner”, they think of software that looks for known risks. This is generally what virus scanners and network scanners do: check targets against a list of known issues, such as (respectively) malware signatures and CVE vulnerability reports. So when customers see how effective Netsparker is, their first question is often: “What vulnerability database do you use?” Well, the short answer is: “None, mostly.” The full answer is that Netsparker is an advanced heuristic scanner that also checks for known web application vulnerabilities – but let’s break this down a bit.
The Mundane Part: CVEs
The idea of relying on a vulnerability database comes from the systems and network security world, where a software or hardware bug is discovered, publicly disclosed, and added to a vulnerability database such as CVE. Network scanners, for example, work by finding such known issues in target systems. To fix the vulnerability, you simply patch or update the affected component.
Some CVEs also apply to web applications. These are bugs in widely-used products that need to be patched to avoid attacks. As one part of its scanning process, Netsparker checks for such issues based on the CVE registry and other vulnerability databases, so scans also cover vulnerabilities such as Heartbleed (CVE-2014-0160) or POODLE (CVE-2014-3566). In fact, the Netsparker security advisory program actively contributes to finding bugs in open-source packages by scanning them for vulnerabilities during engine testing. To learn how our security researchers do this, see our article on vulnerability disclosures.
Although an important part of overall security, checking for known issues is relatively easy and not terribly exciting. Things get interesting when you have to check for unknown issues – and this is when you find out how effective your web application security solution truly is.
The Really Clever Part: Heuristics
The vast majority of web application vulnerabilities are brand new issues that were introduced in new code in custom-built applications – so how are you supposed to know about them? This is the main difference between web application security testing and signature-based security checks: web vulnerability scanning is primarily about finding new vulnerabilities resulting from underlying weaknesses categorized in the CWE system. To find previously unknown issues, Netsparker uses a cutting-edge heuristic scanning engine that probes websites and applications for vulnerabilities just like a penetration tester would.
Netsparker uses a variety of advanced heuristic techniques to find all entry points in web applications and test them for vulnerabilities. This includes automatic URL rewriting to provide maximum scan coverage, automated fuzzing to generate unexpected inputs that may reveal a weakness, and proprietary Proof-Based Scanning™ technology to safely test weaknesses and provide proof that the vulnerability is real.
Because web vulnerability scanners don’t rely on signatures, their effectiveness is highly dependent on the quality and maturity of the underlying heuristic scanning engine. If the scanning engine is too eager to flag suspicious responses as signs of vulnerabilities, it will flood the user with false positives. If it is too cautious or simply not advanced enough, it will miss real vulnerabilities or even bypass whole pages, for example because it can’t deal with authentication. As an industry veteran and technology leader, Netsparker knows how to strike the right balance.
Get the Best of Both Worlds
The purpose of a web application security solution is to help the user improve security more efficiently than with manual testing alone. This goes way beyond vulnerability databases and even beyond scanning itself. To get measurable security improvements, you need a holistic view of web application security that pulls together accurate information from all relevant sources and applies it through effective automation.
Netsparker combines high-quality heuristic results from its industry-leading vulnerability scanning engine with information about known issues listed in vulnerability databases. All these vulnerability results are complemented by asset discovery and crawling information, warnings about outdated web technologies, detailed vulnerability descriptions complete with suggested remedies, best-practice recommendations, compliance reports, and more. This gives you a complete picture of what you need to fix in your web environment, so you can start getting real value from Netsparker in a matter of days.
Aug
As cybercriminals continue to take advantage of the public cloud in their attacks, Sophos commissioned an independent survey of 3,521 IT managers across 26 countries* to reveal the reality of cloud security in 2020.
The 2020 cloud security reality
The survey provides fresh new insight into the cybersecurity experiences of organizations using the public cloud, including:
- Almost three-quarters of organizations hosting data or workloads in the public cloud experienced a security incident in the last year. Seventy percent of organizations reported they were hit by malware, ransomware, data theft, account compromise attempts, or cryptojacking in the last year.
- Data loss/leakage is the number one concern for organizations. Data loss and leakage topped our list as the biggest security concern, with 44% of organizations seeing data loss as one of their top three focus areas.
- Ninety-six percent of organizations are concerned about their current level of cloud security. Data loss, detection and response, and multi-cloud management top the list of the biggest concerns among organizations.
- Multi-cloud organizations reported more security incidents in the last 12 months. Seventy-three percent of the organizations surveyed were using two or more public cloud providers and reported more security incidents as those using a single platform.
- European organizations may have the General Data Protection Regulation (GDPR) to thank for the lowest attack rates of all regions. The GDPR guidelines’ focus on data protection, and well-publicized ransomware attacks have likely led to these lucrative targets becoming harder for cybercriminals to compromise in Europe.
- Only one in four organizations see lack of staff expertise as a top concern despite the number of cyberattacks reported in the survey. When it comes to hardening security postures in the cloud, the skills needed to create good designs, develop clear use cases, and leverage third-party services for platform tools are crucial but underappreciated.
- Two-thirds of organizations leave back doors open to attackers. Security gaps in misconfigurations were exploited in 66% of attacks, while 33% of attacks used stolen credentials to get into cloud provider accounts.
For the details behind these headlines, and to see how your country stacks up, read The State of Cloud Security 2020 report.
Secure the cloud with Sophos
However you’re using the public cloud, Sophos can help you keep it secure.
- Secure all your cloud resources. Get a complete inventory of multi-cloud environments (virtual machines, storage, containers, IAM Users etc.). Reveal insecure deployments, suspicious access, and sudden spikes in cloud spend. Learn more
- Secure your cloud workloads. Protect virtual machines, the virtual desktops running on those machines from the latest threats, including ransomware, fileless attacks, and server-specific malware. Learn more
- Protect the network edge. Secure inbound and outbound traffic to your virtual network, virtual desktop environments, and provides secure remote access to private applications running in the cloud. Learn more
For more information and to discuss your cloud security needs, request a call back from one of security experts.
* Australia, Belgium, Brazil, Canada, China, Colombia, Czech Republic, France, Germany, India, Italy, Japan, Malaysia, Mexico, Netherlands, Nigeria, Philippines, Poland, Singapore, South Africa, Spain, Sweden, Turkey, UAE, United Kingdom, United States
Aug
ProLock ransomware emerged on the threat scene in March, a retooled and rebranded version of PwndLocker.
As SophosLabs reveals in its detailed analysis, while ProLock ransomware gives you the first eight kilobytes of decryption for free, it can still cause significant business disruption and economic damage.
Protect against ProLock with Sophos Intercept X
Intercept X gives you multiple layers of protection against ProLock, keeping the data on your endpoints and servers safe:
- CryptoGuard identifies and rolls back the unauthorized encryption of files. In fact, Sophos first detected ProLock when CryptoGuard caught it on a customer network
- Deep learning identifies and blocks ProLock without signatures
- Signatures block variants of ProLock either as Troj/Agent-BEKP or Malware/Generic-S
If you’re running Sophos Intercept X you can relax knowing that you are automatically protected against ProLock, as all three of the above features are enabled by default in our recommended settings.
(If you’re not yet running Intercept X and want to give it a try, visit the web page to learn more and start a no-obligation free trial.)
To check that you have CryptoGuard and Deep Learning enabled:
- Open your Sophos Central Admin console and select Endpoint Protection in the left-hand menu
- Select Policies
- Review the list of threat protection policies already created
- Toggle the buttons to make any necessary changes
Endpoint protection and firewall best practices to block ransomware
51% of IT managers surveyed for our recent State of Ransomware 2020 report said their organization was hit by ransomware last year, and that cybercriminals succeeded in encrypting data in 73% of incidents.
With stats like these it’s worth taking the time to ensure all your ransomware defenses are up-to-date.
The earliest detection of ProLock by Sophos was traced to a compromised server, most likely through an exploit of a Remote Desktop Protocol (RDP).
Putting RDP access behind a virtual private network and using multi-factor authentication for remote access are just a couple of the best practices we recommend to reduce your ransomware risk.
For additional best practices, take a look at our guides Endpoint Protection Best Practices to Block Ransomware and Firewall Best Practices to Block Ransomware.
Aug
We are excited to announce that Intercept X for Server Advanced with EDR has been enhanced with powerful cloud visibility features from Cloud Optix.
In addition to even more detail on your AWS, Azure, and GCP cloud workloads, this integration gives customers critical insights into their wider cloud environments, including security groups, hosts, shared storage, databases, serverless, containers, and more.
See your complete cloud environment
The dynamic nature of cloud environments – with assets being spun up and down as and when necessary to meet changing demands – can make security and compliance assessments time-consuming. In many cases, you’ll need to log into multiple consoles and manually collate information to get a full picture.
With Sophos, it’s easy. You get details about your entire cloud infrastructure across different public cloud providers on one screen, in a single management console. You can dive directly into assets to get more detail about your asset inventory and cloud security posture.
Secure your complete cloud environment
Automated scans will detect any insecure deployments, with guided recommendations about how to fix potential issues. Additionally, guardrails can be deployed to lock down configurations, ensuring that they can’t be accidentally or maliciously tampered with and left in an unsafe state.
Artificial intelligence tracks normal behavior patterns, looking for any suspicious activity such as anomalous traffic patterns or unusual login attempts to cloud accounts. Issues are then flagged and prioritized by risk level if they require manual intervention.
Here’s the full list of what’s available:
- Cloud asset inventory – see a detailed inventory of your entire cloud infrastructure (e.g. cloud hosts, serverless functions, S3 buckets, databases, and cloud workloads), eliminating the need for time-consuming manual collation
- Access and traffic anomaly detection – unusual login attempts and suspicious traffic patterns are automatically detected and blocked or flagged to the admin as appropriate
- Security scans – daily and on-demand scans monitor your cloud environment to ensure its on-going security. Issues are automatically resolved where possible, with admin notification if manual intervention is required
- Configuration guardrails – stop accidental or malicious tampering with configurations that could negatively impact security posture
- Compliance policies – ensure that your cloud environment conforms to Center for Internet Security (CIS) best practices, helping keep your security posture at its best
- Alert management integrations – receive email notifications when manual intervention is required
Powerful visibility and protection for every setup
This exciting new cloud functionality is available to all Intercept X Advanced for Server with EDR customers at no additional cost. Log into your Sophos Central console, select Cloud Optix, and you can get started right away.
Current customers using Sophos Central that would like to try out this new functionality – in addition to the recently released EDR IT operations and threat hunting capabilities – can start a trial from within the Sophos Central console.
If you don’t have a Sophos Central account, you can register for a trial on Sophos.com.
Intercept X Advanced for Server with EDR and Intercept X Advanced with EDR give organizations unparalleled visibility and protection across their cloud, on-premises, and virtual estates. Cloud Optix shines a spotlight on complete cloud environments, showing what’s there, what needs securing, and making sure that everything stays safe and secure.
Aug
Most privileged access management solutions just focus on passwords. BeyondTrust is different. Our innovative Universal Privilege Management approach to cyber security secures every user, asset, and session across your enterprise. Deployed as SaaS or on-premises, BeyondTrust’s Universal Privilege Management approach simplifies deployments, reduces costs, improves usability, and reduces privilege risks.
Go Beyond Passwords
Passwords are important. That’s why you can audit and manage every privileged account with BeyondTrust. This includes everything from privileged user passwords, app-to-app credentials, service accounts, DevOps secrets, and more.
But passwords are just the beginning. The BeyondTrust platform integrates privileged password security with endpoint and remote access security, drastically reducing your attack surface and windows of exposure. This is Universal Privilege Management.
Productivity, Not Friction
Privileged users handle critical tasks that keep your business running. The last thing you want to do is slow down legitimate business activity with annoying security measures.
BeyondTrust is non-intrusive to users. Our software helps power some of the most efficient organizations on the planet. Centralized reporting and management, integrations with your existing systems, and automated privilege management enable security that’s virtually invisible to users.
Accelerated Time to Value
Our customers get more than software. They get 30+ years of accumulated security expertise and best practices productized in software form.
Built-in templates and workflows let you see value on day one. Flexible deployment options, including cloud deployments and virtual appliances, let you start right away. Our customers report fast user adoption, which rapidly reduces your risk.
The BeyondTrust Advantage
BeyondTrust serves more organizations than any other Privileged Access Management vendor. More than 20,000 customers, including 70% of the Fortune 500, trust us to improve cyber security and efficiency. We’ve helped more customers deploy in the cloud than anyone else. And customers rate our support organization with 96% satisfaction.
Jul
Increased remote working makes it more important than ever to secure computers and the data on them. With the huge number of laptops that are lost, misplaced, or stolen every day, a crucial first line of defense for devices is full-disk encryption.
With full disk encryption rolled out, admins can ensure sensitive company data can’t be accessed, even if a device falls into the wrong hands. And while disk encryption has long been a vital component of device security, it has also frequently been associated with complexity and admin overhead. Setting up and maintaining servers, dealing with encryption keys, and helping users who’ve forgotten their credentials all takes time and effort.
Hassle-free encryption
With Sophos Central Device Encryption, we focus on making device encryption intuitive and hassle-free. There’s no server to install, and encryption is enabled in a handful of clicks. Sophos Central Device Encryption uses the same core agent as Intercept X, meaning existing Sophos customers have no additional agent to deploy and can start encrypting computers in mere minutes.
Under the hood, we leverage Windows BitLocker and macOS FileVault technology to do the heavy lifting when it comes to encrypting and decrypting data on the disk. With these technologies being integrated deeply into each operating system, performance and security is first-class.
Demonstrate compliance
As a part of compliance requirements, companies often need to verify which computers in the organization are encrypted. The cloud-based Sophos Central Admin console provides great visibility into device status, including which disks are encrypted and the last time a device checked in. The next version of Central Device Encryption adds a new Encryption Status report, further drilling down into device encryption status, making it even easier to help demonstrate compliance across the organization.
Fast recovery
An important consideration with disk encryption is how users will regain access to their devices if they forget their credentials. The Sophos Central Self-Service Portal lets users retrieve their own recovery keys without needing to contact the IT helpdesk. Users get back up and running faster, and IT teams have fewer tickets to deal with.
Sophos Central Device Encryption
The shift towards remote working makes full disk encryption more important than ever. Sophos Central Device Encryption makes it a breeze to deploy and manage devices with full disk encryption. Head over to Sophos.com to find out more and to sign up for a free trial.
Jul
Work from home (WFH) and remote access have accelerated the digital transformation journey, and IT’s move to the cloud. Security programs must address visibility, continuous monitoring, and a unified identity and privilege model for the multicloud environment. Privileged access management solutions are a key enabler for the cloud security strategy because they can protect core enterprise assets from increased vulnerability from the home offices at the edge to significantly reduce attacker’s ability to exploit configuration, credential, or privilege management errors.
Rope Burns & IT Security
Thinking back on those school gym classes, remember rope climbing? Or maybe swinging on a rope? Then you’ll know: ropes can be slippery, and your hands can get burned.
As businesses enabling digital transformation via accelerated cloud adoption, avoiding IT security breaches or outages (the digital equivalent of rope burns) is always a top concern. These negative outcomes can rear their heads amidst an atmosphere of too much uncontrolled change, happening too fast, to the operating environment.
A New Cloud Security Strategy
Accelerated digital transformation means accelerated cloud adoption. All those users that used to be in the office? Now they’re in the cloud. Services and applications? They too are moving to the cloud. A quick review of the Cloud Security Alliance’s top threats shows we have our work cut for us to secure cloud use.
What’s interesting about the CSA’s “Egregious 11” threats, is that many of them – such as misconfiguration, weak control plane, poor visibility, and lack of architecture, are customer-side failings. Earlier this month, I wrote about the need for Cleaning up Risk and Technical Debt spawned from ungoverned cloud adoption
The broad scope of these threats and their root cause in technical debt makes it quite clear: virtually all businesses need a new, or refreshed, cloud security strategy.
Multiple Failures to Protect Privileged Access
How were Jeff Bezos, Elon Musk, Bill Gates, and so many other IT-savvy luminaries’ Twitter accounts recently hacked and used to solicit bitcoin payments? An article from the Verge suggests that attackers “either found a severe security loophole in Twitter’s login or account recovery process or…somehow gained access to a Twitter employee’s admin privileges.”
The Twitter breach is just our latest object lesson about the importance of closing privileged attack vectors. Consider that multiple studies show Credential Misuse being the #1 cause of breaches. Behind any credential breach is an access (or privileged access) management failure. This is true because the typical user should not have access to the “crown jewels” and privileged accounts with more than the usual access should be very difficult for hackers to obtain.
Gaps in Cloud PAM
As IT’s center of gravity shifted, PAM systems have needed to evolve. Amidst the forced digitalization of the pandemic, these architectural deficiencies are no longer just limiting or annoying, they’re downright dangerous. We commonly see the following gaps in that older PAM systems have:
- Limited integration with cloud service provider (CSP) native identity frameworks or APIs
- Poor visibility into cloud environments
- Heavy server-side agent software in the infrastructure-as-a-service (IaaS) environment
- Static, or always-on, privileged accounts (also called accounts with standing privileges)
Let’s focus on the last of these gaps, to make sure everyone understands the need for…
Just-in-Time (JIT) PAM
Traditionally, privileged access is granted through a combination of static accounts and roles. For example, the powerful Active Directory domain administrator role is conferred on static accounts with a Domain Administrator group membership. As shown in the below figure’s topmost process flow, static accounts can be provisioned through identity and access management (IAM) system, or created manually. The traditional PAM system inventories the accounts that are privileged, manages access to them, and performs credential rotation.
Always-on (standing) privileges versus just-in-time (JIT) privileged access
The trouble is that always-on, static accounts can become targets of opportunity. They are one of the first things advanced attackers look for as they move laterally through the victim infrastructure.
Fortunately, CSPs have provided a better way to manage privileged access. That is to bind the privileged roles to accounts only temporarily, after a request is approved. As shown in the bottom most process flow in the figure, the IAM (or PAM) system can process valid access requests and dynamically bind privileged roles to the requesting user’s account by calling an API such as the Amazon Web Service (AWS) AssumeRole. The privileged access soon expires, or is removed, reducing the attack surface available to any bad actors in the IT environment.
We need to achieve a paradigm shift from static to dynamic access grants – to just-in time privileged access management (JIT PAM).
Critical Capabilities for Cloud Privileged Access Management (PAM)
To effectively secure privileged access, credentials, and sessions across cloud environments, PAM systems need to have many of the traditional PAM features such as credential vault, credential rotation, session broker, session recording, privileged user auditing, service account support, and high availability) plus what’s below:
- Unified browser-based administration and remote session protocol support
- Authentication and authorization agility for multiple use cases, third parties, cloud environments
- Integration with cloud-native access systems
- Just-in-time access grant support
Enabling Productive & Secure Work-From-Home & Remote Access
Work from home and remote access have accelerated the digital transformation, and IT’s move to the cloud. Security programs must address visibility, continuous monitoring, and a unified identity and privilege model for the multicloud environment. PAM systems are a key enabler for the cloud security strategy because they can protect core enterprise assets from increased vulnerability from the home offices at the edge to significantly reduce attacker’s ability to exploit configuration, credential, or privilege management errors.
To learn more on updating your cloud security strategy to address the “new normal”, check out my on-demand webinar.
Jul
Analysis of public cloud accounts across Amazon Web Services, Microsoft Azure, and Google Cloud Platform reveals a silver lining when it comes to the protection of cloud data.
New research shows that in the last year, 70% of organizations that use public cloud services experienced a security incident. These incidents included attacks from ransomware and other malware (50%), exposed data (29%), compromised accounts (25%), and cryptojacking (17%).
Ninety-six percent of these organizations are concerned about their current levels of cloud security, with data security being the top concern for 44% of them. It’s a good time to address the fundamentals of cloud security best practices: access to cloud environments and the protection of sensitive data.
Secure who gets in
Identity security represents a huge challenge for organizations. A review of cloud accounts by the Sophos Cloud Optix cloud security posture management service discovered worrying trends in organizations’ security posture as it relates to cloud account access, with 91% of organizations having over-privileged Identity and Access Management roles and 98% without MFA enabled on their cloud provider accounts.
Managing access to cloud accounts is an enormous challenge and yet only a quarter of organizations in our research saw it as a top area for concern, while a third reported that cybercriminals gained access by stealing cloud provider account credentials
Why securing access matters
Granting extensive access permissions to IAM users, groups, and cloud services is a risky practice. If such credentials get compromised, cybercriminals may gain access to any services and data those permissions grant. All user accounts should have MFA enabled, as it adds an extra layer of protection on top of usernames and passwords.
Secure what can get out
You won’t have to look far to find stories of shared storage-related data breaches caused by misconfiguration, where security settings with public read/list permissions had been enabled. AWS has even released an update to help customers from running afoul of this – one of the biggest causes of cloud data breaches. In our review of cloud accounts, we discovered that accidental data exposure through misconfigured storage services continues to plague organizations, with 60% leaving information unencrypted. Organizations are making it easy for attackers to search for and identify new targets.
The silver lining in all this is that the number of organizations exposing data to the public internet is declining, with Sophos Cloud Optix identifying that only 13% of organizations left database ports open to the internet and 18% of organizations had storage services with public read/list permissions enabled. Assuming there will always be use cases for public access being available, organizations are starting to close the door on this, the most common attack method for obtaining sensitive company and customer data.
Why secure configurations matter
Encryption is critical when it comes to stopping cybercriminals from seeing and reading stored information, and is a requirement for many compliance and security best-practice standards. “Public mode” – a setting that can be applied to databases, shared storage, and other cloud provider services – is a major cause of data breaches, and misconfiguring cloud services in “public mode” allows cybercriminals to automate their searches for security weak points. Guardrails should be in place to prevent such misconfigurations.
Think you know what you’ve got in the cloud?
Take control of your cloud security with a free inventory assessment and security check powered by Sophos Cloud Optix. Activate a free trial to get to get 30 days of commitment-free usage, including:
- Comprehensive inventory of everything you’ve got in the cloud: virtual machines, storage, containers, IAM roles, etc.
- Visualize IAM roles like never before and stop over-privileged access roles and stolen credentials from being exploited in cyberattacks
- Harden Amazon Web Services, Microsoft Azure, Google Cloud Platform, Kubernetes clusters, and Infrastructure-as-Code environments to reduce your surface area for attack
- Automatically detect security and compliance vulnerabilities, suspicious access, network traffic and cloud spend anomalies
- No agent, no install, no tie-in
Once you have a Cloud Optix account set up, follow the step-by-step instructions on the screen, which will walk you through adding your AWS, Azure, and GCP environments. For more information, read the Getting Started guide.
Should you need help at any point, check out the community forum or reach out to our technical support team.
Jul
In a cloud-first world, the traditional line between network security and application security is becoming blurred. Physical IT infrastructure can now be hidden behind layers of virtualization, and web applications are frequently designed, developed, tested, and deployed entirely in the cloud. At the same time, web applications have become the main target of cyberattacks and now account for 3 out of 4 data breaches worldwide. Web application security has never been more important – and yet there is still some confusion as to its place in the overall security posture. Established organizations often have mature network security programs, while web application security tends to receive far less attention and funding.
As companies continue to shift data and business logic onto cloud platforms and become reliant on web technologies to do business, information security has become a top priority. Business data, intellectual property (IP), and other sensitive information are now prized commodities, so cybercriminals are increasingly focusing their attacks on web applications to extract this data. This means that traditional network perimeter defense with firewalls to filter network traffic is no longer enough to ensure data security and proper access control. If exploited successfully, web application vulnerabilities can not only allow unauthorized access to sensitive data but also provide a foothold to mount denial-of-service attacks or even serve malware to website visitors.
Modern web assets include not only websites and web applications but also web services and application programming interfaces (APIs) that are used to exchange data between systems and provide the back-end for countless mobile applications. In a large organization, there can be thousands of different web assets spread across multiple systems and geographies. At this scale and level of complexity, protecting them all from cyberthreats is only possible with dedicated web application security solutions that deliver accurate and actionable results, such as modern dynamic application security testing (DAST) products.
Our white paper Web Application Security or Network Security – Do You Have to Choose? examines the history of web security and analyzes current trends to set the record straight on the role of web application security and network security in any mature cybersecurity program.
Download the PDF version of our white paper: Web Application Security or Network Security – Do You Have to Choose?
Jul
The ongoing pandemic is resulting in a crisis for schools, colleges, and universities the world over. With physical buildings closed, most educational institutes are moving to emergency remote learning and working.
For most of them, the transition from physical to online models has happened too quickly. Without proper time to vet potential risks, their networks are exposed thanks to the deployment of new technologies and apps. Furthermore, risks can also run high because students and educators aren’t always properly trained to use the new tech.
Further complicating matters, many educational institutes simply don’t have the budgets to overhaul their technology solutions in the face of such an unprecedented and unanticipated pandemic. As a result, some institutes are lured by free tools and apps for online learning, most of which come laden with inadequate privacy controls, user tracking, inappropriate promotional content, and sometimes malware – all of which elevates the risk of not complying with regulatory mandates like FERPA and others.
With remote learning becoming the new normal, cybercriminals are busy finding new ways to leverage techniques like phishing, ransomware, social engineering, and more to pull off attacks. Here’s a look at some of the most critical risks to be addressed in order to safeguard users and data.
1. Secure remote access
With distance learning taking over physical schooling, students and teachers need access to online learning tools mostly located in the cloud – file sharing applications, email, apps – and they sometimes need to remotely access resources on the school network. At the same time, administrative and IT staff working from home may need access to systems and documents located on the school network as well. If remote access isn’t secure, hackers can sneak in and take control of the entire network. Deploy a virtual private network (VPN) that offers secure remote access to your users and protects all data that flows in and out of the VPN by encrypting it.
Students and school staff may bring their own devices and connect them to the school network, some of which may be unpatched and running risky applications, giving easy access to attackers. To counter this, ensure only whitelisted apps run on the network and that only authorized devices can accessing the network. With complete application visibility and control, you can identify all the applications on your network – including shadow IT and data at risk. This allows you to control the apps and apply user-based application controls and traffic shaping. By synchronizing your firewall and endpoint security, you can instantly identify compromised endpoints, isolate them until they are cleaned, and prevent infections from spreading laterally to other devices on the network.
2. Control access to sensitive data
Educational institutes are treasure troves of valuable information that can be sold on the dark web. Personal data of students, teachers, alumni, and administrative staff, along with sensitive data relating to a school’s research and intellectual property can make a hacker very rich by selling it or ransoming it. It’s critical to enforce access based on user identity, allowing authorized users access to only what they need in order to do their jobs. You can protect sensitive data, research, and other critical resources by allowing access to only those who are authorized, with two-factor authentication (2FA) support for access to key system areas, including IPsec and SSL VPN, user portals, and web administration consoles.
3. Protect against malware
The shift to remote learning means many of the devices connecting to the school network are BYOD. It’s difficult to know whether the devices and applications used are updated with patches and if the antivirus is current. Unless such remote devices are connecting via a VPN, you’ll need to ensure they’re secure before they can access resources on the school’s network.
It’s important to deploy advanced web protection capabilities that can identify and block the latest web threats. This allows you to enforce web filtering rules to keep students safe from instances of cyberbullying, inappropriate content, abuse, and other online threats. And with staff working from home, peripheral controls allow you to control what your staff can and can’t plug into their corporate devices. This helps you safeguard your network against unexpected threats.
4. Protect against phishing
Social engineering and phishing attacks pose major IT security risks to schools. Students, teachers, or staff members who get manipulated to click on malicious links can provide cybercriminals access to the school’s network and precious resources. The best way to counter social engineering and phishing attacks is through user awareness and training. Educating and testing your users with simulated attacks helps you facilitate a positive security awareness culture and makes them less likely to fall for scams. Make sure your email security is up to date as well, and that you have advanced protection for all your endpoints so you can protect them against both known and unknown malware, ransomware, exploits, and viruses.
5. Secure mobile computing
Mobile devices like phones, tablets, and others are increasingly used today for remote learning. A single unprotected device increases the risk of compromising the entire school network and systems, especially at a time when schools have lowered the barriers to access their networks, specifically for students. With most devices connected to the internet, the attack surface is significantly amplified for schools. An effective mobile device security solution can help keep your students and staff safe on the internet, preventing risky file downloads and blocking access to inappropriate websites. Mobile antivirus and ransomware protection capabilities can safeguard your users and devices from malicious content and apps.
Sophos can help
Sophos’ unique IT security capabilities offer award-winning protection for schools of all sizes. You can ensure that learning doesn’t stop in times when students aren’t able to access teachers and educational resources in person. Read our whitepaper on Secure remote learning in education to find out more. You can also visit our education protection page to find solutions that help secure educational institutes.
Jul
It has never been a better time to make the switch to Intercept X.
Recently we launched enhanced endpoint detection and response (EDR) capabilities that give users the power to ask detailed threat hunting and IT operations questions and quickly get the answers they need. That’s in addition to other new features such as Antimalware Scan Interface (AMSI) technology, which excels at detecting malicious obfuscated scripts (e.g. PowerShell) and Intrusion Prevention System functionality that stops network-based attacks (currently in early access).
But those aren’t the only benefits of making the move to Intercept X and Sophos Central, our cloud-based management platform. Here are five reasons to consider moving:
1. Get advanced protection to stop the latest threats
Intercept X excels at blocking the very latest threats such as ransomware, script-based fileless attacks, malware that has never been seen before, and adversaries actively trying to compromise systems. Deep learning AI intelligence, anti-ransomware capabilities, and exploit mitigation techniques combine to provide this unmatched level of security.
2. Make management straightforward
Intercept X is managed via the cloud-based Sophos Central console, which lets you manage all of your Sophos solutions in one place, at any time, from anywhere. Everything is managed from a single console with the same intuitive look and feel, so it’s easy to switch between products and enable powerful cross-product features.
3. Spend less and save time
With cloud management there’s no need to maintain physical on-premises servers and you get access to a single management console, cutting down on admin time.
4. Implement security that grows with you
Sophos Central makes it easy to extend your protection as your business grows. Want to try out the powerful new EDR functionality that helps you track down unwanted applications or users that clicked on a phishing email across your entire estate? Start a trial with the click of a button.
5. Benefit from smarter, faster protection
Sophos products are engineered from the ground up to work better together. For example, Intercept X and XG Firewall work in tandem to isolate a compromised device, clean it up, and restore network access with no admin intervention – in a matter of seconds.
Even if you aren’t yet on Sophos Central, trying out Intercept X couldn’t be easier. You can either start a no-obligation trial or take a look at the online demo to get a feel for the interface and powerful functionality on offer.
Jul
NSS, an international Value Added Distributor of leading edge IT solutions, announces today its partnership with BeyondTrust, the worldwide leader in Privileged Access Management and Secure Remote Access. NSS will distribute the most seamless solutions to prevent data breaches related to credential theft, misuse of privileges and breach of remote access in the markets of Greece, Cyprus and Malta as well as in the other Balkan countries. Being an international distributor of cybersecurity solutions in this region, NSS is in a strategic position regarding the distribution of the entire Privileged Access Management (PAM) suite of tools offered by BeyondTrust.
BeyondTrust’s Privileged Access Management portfolio is a comprehensive solution providing visibility and control capabilities to all privileged accounts and users. By integrating a wide range of privileged access security features, the platform simplifies implementation, reduces the risks associated with privileged credentials, reduces costs and significantly improves usability.
“As our strategic partner, NSS will be able to exploit BeyondTrust’s Universal Privilege Management model, a modern approach that addresses the entire universe of privileges across organizations said Alexis Serrano, Director – Channel & Alliances EMEIA of BeyondTrust. “Combining the know-how and in-depth knowledge of NSS in the regional market and its extensive network of partners, along with BeyondTrust’s best solutions, this partnership will help businesses and organizations improve their security strategies and operational resilience”, added Alexis Serrano, Director EMEIA Channels & Alliances.
“As a leader in Privileged Access Management (PAM) with numerous certifications and international distinctions from analysts such as Gartner, in NSS, we are thrilled to offer BeyondTrust’s solutions in the markets of the Balkan Region”, said George F. Kapaniris, NSS Executive Director. “BeyondTrust’s comprehensive PAM solution will allow us to lead our customers through a secure path helping them deal with critical vulnerabilities and immediately shrink the attack surface on their infrastructure”.
The flexible and expandable BeyondTrust platform allows organizations to easily maximize the security of privileges as the threats evolve into endpoint environments, server, cloud, DevOps and network devices. BeyondTrust’s platform integrates the broader range of privileged access capabilities with central management, reports and analytical reports, allowing administrators and security managers to take decisive and informed action and make decisions to successfully deal with attackers. The holistic approach platform stands out for its flexible design that simplifies consolidation, improves user productivity and maximizes IT and security investment.
BeyondTrust gives organizations the visibility and control they need to reduce risk, meet compliance goals and enhance business performance. NSS will expand its product portfolio by offering the innovative Universal Privilege Management approach solutions from BeyondTrust. This partnership will allow NSS to provide a customized PAM solution that meets the unique requirements of each customer. Find out more on https://www.nss.gr.
Jul
Η NSS, διεθνής διανομέας Value Added Distributor (VAD) λύσεων πληροφορικής υψηλής τεχνολογίας ανακοινώνει σήμερα τη συνεργασία της με την BeyondTrust, παγκόσμιο ηγέτη στη διαχείριση προνομιακής πρόσβασης (Privileged Access Management) και ασφαλούς απομακρυσμένης πρόσβασης (Secure Remote Access). Η NSS θα διανέμει στην Ελληνική και Κυπριακή αγορά, καθώς και στα Βαλκάνια και τη Μάλτα, την πιο απρόσκοπτη λύση για την αποτροπή παραβιάσεων δεδομένων που σχετίζονται με κλοπή διαπιστευτηρίων, κακή χρήση προνομίων και παραβίαση της απομακρυσμένης πρόσβασης. Ως διεθνής διανομέας λύσεων ασφάλειας στον κυβερνοχώρο στην περιοχή, η NSS βρίσκεται σε στρατηγική θέση για να διανέμει στην αγορά την πλήρη σουίτα εργαλείων Privileged Access Management (PAM) της BeyondTrust.
Το χαρτοφυλάκιο Privileged Access Management της BeyondTrust αποτελεί μια ολοκληρωμένη λύση που παρέχει ορατότητα και δυνατότητες ελέγχου σε όλους τους προνομιακούς λογαριασμούς αλλά και τους προνομιακούς χρήστες. Ενοποιώντας ένα ευρύτατο σύνολο δυνατοτήτων ασφάλειας προνομιακής πρόσβασης, η πλατφόρμα απλοποιεί τις υλοποιήσεις, μειώνει τους κινδύνους που σχετίζονται με τα προνομιακά διαπιστευτήρια, μειώνει τα κόστη και βελτιώνει σημαντικά τη χρηστικότητα.
«Ως στρατηγικός συνεργάτης μας, η NSS θα είναι σε θέση να εκμεταλλευτεί το μοντέλο Universal Privilege Management της BeyondTrust, μια σύγχρονη προσέγγιση που αντιμετωπίζει το σύνολο προνομίων σε έναν οργανισμό», δήλωσε ο Alexis Serrano, Director – Channel & Alliances EMEIA της BeyondTrust. «Συνδυάζοντας την τεχνογνωσία και τη βαθειά γνώση της αγοράς που διαθέτει η NSS στην περιοχή αλλά και το εκτεταμένο δίκτυο συνεργατών της, με τις καλύτερες λύσεις της BeyondTrust, αυτή η συνεργασία θα βοηθήσει τις επιχειρήσεις και τους οργανισμούς να βελτιώσουν τις στρατηγικές ασφάλειας και την επιχειρησιακή τους αντοχή», συμπληρώνει ο κος Alexis Serrano, Director – Channel & Alliances EMEIA της BeyondTrust.
«Ως ηγέτης στη διαχείριση της προνομιακής πρόσβασης (PAM) με πολλές περγαμηνές και διεθνείς διακρίσεις από αναλυτές όπως η Gartner, στην NSS, είμαστε ενθουσιασμένοι που φέρνουμε τις λύσεις της BeyondTrust στην ευρύτερη αγορά της Ελλάδος, της Κύπρου, των Βαλκανίων αλλά και της Μάλτας», δήλωσε ο Γιώργος Καπανίρης, Εκτελεστικός Διευθυντής της NSS. «Η ολοκληρωμένη λύση PAM της BeyondTrust θα μας επιτρέψει να καθοδηγήσουμε τους πελάτες μας σε ένα ταξίδι που τους επιτρέπει να αντιμετωπίσουν κρίσιμα τρωτά σημεία και να αρχίσουν αμέσως να συρρικνώνουν την επιφάνεια επίθεσης στις υποδομές τους».
Η ευέλικτη και επεκτάσιμη πλατφόρμα της BeyondTrust, δίνει τη δυνατότητα στους οργανισμούς να κλιμακώσουν εύκολα την ασφάλεια προνομίων καθώς οι απειλές εξελίσσονται σε περιβάλλοντα τελικού σημείου, διακομιστή, cloud, DevOps αλλά και συσκευών δικτύου. Η πλατφόρμα της BeyondTrust ενοποιεί την ευρύτερη σειρά προνομιακών δυνατοτήτων πρόσβασης με κεντρική διαχείριση, αναφορές και αναλυτικές αναφορές, επιτρέποντας στους διαχειριστές, αλλά και στους επικεφαλείς ασφάλειας να λάβουν αποφασιστικές και ενημερωμένες ενέργειες και αποφάσεις για να αντιμετωπίσουν τους επιτιθέμενους. Η ολιστικής προσέγγισης πλατφόρμα ξεχωρίζει για τον ευέλικτο σχεδιασμό της που απλοποιεί τις ενοποιήσεις, βελτιώνει την παραγωγικότητα των χρηστών και μεγιστοποιεί τις επενδύσεις πληροφορικής και ασφάλειας.
Η BeyondTrust δίνει στους οργανισμούς την ορατότητα και τον έλεγχο που χρειάζονται για τη μείωση του κινδύνου, την επίτευξη των στόχων συμμόρφωσης και την ενίσχυση της επιχειρησιακής απόδοσης. Η NSS θα αξιοποιήσει τις καινοτόμες λύσεις συνολικού ελέγχου προνομιακής πρόσβασης της BeyondTrust για να συμπληρώσει τις λύσεις τεχνολογίας που προσφέρει ήδη στην ευρύτερη περιοχή όπου δραστηριοποιείται. Αυτή η συνεργασία θα επιτρέψει στην NSS να παρέχει μια προσαρμοσμένη λύση PAM που να ανταποκρίνεται στις μοναδικές απαιτήσεις κάθε πελάτη της. Μάθετε περισσότερα στην ιστοσελίδα της NSS https://www.nss.gr.
Jul
Managing IT security takes a lot of time. Well, 26% of an IT team’s time to be precise, based on feedback from the 3,100 IT managers we surveyed last year.
With time an increasingly precious commodity, the good news for XG Firewall users is that you can double the efficiency of your security team while also increasing your protection. How? By running Intercept X with EDR as your endpoint protection.
Double the efficiency of your IT team
Like XG Firewall, Intercept X is part of the Sophos cybersecurity system, and you can manage both solutions through the Sophos Central platform.
This eliminates the need to jump from console to console to see what’s going on. No more struggling to track data across platforms. Instead you have a single security console with consolidated alerts visible from the dashboard.
The Sophos Central Dashboard consolidates alerts across all products for instant visibility.
XG Firewall and Intercept X also share threat, health and user data, enabling you to quickly investigate any incidents that do occur.
When the firewall shows you the device name rather than just the IP address life becomes significantly easier.
See the name as well as the IP address of affected devices
In fact, customers tell us they’ve seen day-to-day security admin fall by 90% since they started running XG Firewall and Intercept X together, managed through Sophos Central.
Elevate your protection
Intercept X with EDR lets you elevate your protection by combining market-leading technologies with the ability to identify the root causes behind security and IT operations incidents.
Like your XG Firewall, Intercept X is powered by Sophos’ deep learning engine. It also gives you the most comprehensive exploit and ransomware protection on the market.
In addition, the new EDR capabilities enable you to see what’s really going on across your environment.
Fully-customizable queries quickly give you the answers to questions such as:
- Why is a device running slowly?
- Are machines pending a re-boot?
- Where is RDP enabled?
- Are any programs trying to connect with a non-standard port?
Armed with this information you can stop potential incidents before they occur, and address underlying issues.
Try for yourself
If you’re managing your XG Firewall through Sophos Central you can start a no-obligation free trial of Intercept X with EDR in just three clicks.
Simply scroll to the Free Trials link in the main left-hand navigation and follow the instructions.
If you’re not yet using Sophos Central, start a trial via our website. You’ll be up and running in a matter of minutes.
Hear from customers
To learn more about the benefits of running XG Firewall and Intercept X, read the Sophos Business Impact report.
It shares the experiences of five customers across North America, Europe, and Asia, quantifying the impact on their team and their organization.
Jul
Think you know what you’ve got in the cloud? Think again.
The accessibility of the public cloud is a double-edged sword: while it enables teams to spin up new resources in minutes, it also makes it hard for IT teams to keep track of everything that needs to be secured.
Take control of your cloud security with a free inventory assessment and security check, powered by Sophos Cloud Optix. Activate a free trial to get to get 30 days commitment-free usage:
- Comprehensive inventory of everything you’ve got in the cloud: virtual machines, storage, containers, IAM Users etc.
- Covers Amazon Web Services, Microsoft Azure, Google Cloud Platform, Kubernetes clusters, and Infrastructure-as-Code environments
- Automatically scans for security gaps so you can address areas of weakness
- No agent, no install, no tie-in
Real-time security alerts, enabling you to take immediate action
Detect and prevent cloud security and compliance gaps
Cloud Optix is an agentless SaaS solution that integrates with your cloud infrastructure accounts using the native cloud provider APIs, logs, and cloud services.
It uses information from these sources to give you a detailed inventory of assets in your cloud accounts and provide an intuitive topological view of the environment’s architecture and traffic flows.
Inventory of all your resources
Topological view of your architecture and traffic flows
Cloud Optix also provides up-to-the-minute reports. These make it easy to stay in compliance with both regulatory requirements and internal security policies, including monitoring your daily spend.
Stay in compliance with real-time reports
Get up and running in minutes
Cloud Optix is managed through the Sophos Central security platform. There are two ways to activate your free usage period:
- Already using Sophos Central: Click on the Free Trials link at the bottom of the left-hand menu in your Central admin console.
- New to Sophos Central: Request a free trial via our website. Your trial will give you access to Cloud Optix as well as all the other security services available in Sophos Central (endpoint protection, server protection etc.).
Next, follow the on-screen step-by-step instructions that will walk you through adding your AWS, Azure and GCP environments. For more information, read the Getting Started guide.
Should you need help at any point, check out the community forum or reach out to our technical support team.
What happens when the trial period is over?
If you wish to continue using Cloud Optix at the end of the free usage period, simply purchase a subscription. Otherwise, you can just stop using the service. There’s no tie-in, no catch, no obligation.
Jun
XG Firewall v18 got off to a tremendous start with thousands of customers upgrading on launch day to take advantage of the new Xstream Architecture and other great enhancements.
Today, the product team is pleased to announce a new release of XG Firewall v18, maintenance release 1 (MR1), that is now available for all XG Firewall devices.
This latest release includes all security hotfixes as well as over fifty performance, reliability and stability enhancements and support for our new SD-RED devices.
Upgrading to v18 MR1 is seamless from v17.5 MR6 and above and from any other v18 release version. You will soon start seeing the new release appear in your console with a firmware upgrade notification, but you don’t need to wait, you can grab the new release anytime from the MySophos Licensing Portal: Upgrade Today!
What’s new and in it for you
Watch this brief 5-minute overview of what’s new in XG Firewall v18:
Here are the top new enhancements:
- Xstream Architecture: A new streaming DPI engine, high-performance TLS 1.3 inspection, AI-powered threat intelligence with in-depth reporting, and FastPath application acceleration.
- Sophos Central: Group firewall management and cloud reporting make management easier and provide deeper insights into network activity with flexible report customization tools and a new license for extending your firewall data storage in the cloud.
- Synchronized SD-WAN: brings the power of Synchronized Security to reliably and accurately route application and user-based traffic over preferred WAN links.
- Plug-and-Play High Availability (HA): makes it easy to enable business continuity and adds peace-of-mind – simply connect two XG Series appliances together and you’ll be up and running in no time and now Sophos Central also supports HA pairs.
- Real-time flow monitoring: Get at-a-glance insights into active bandwidth consuming hosts, applications, and users – a fan favorite feature from our UTM 9 platform.
- Expanded notifications and alerts: You will never miss an important network security event whether it’s related to a threat, service, or important performance metric.
- New SD-RED Model Support: With MR1, take advantage of our all-new SD-RED 20 and SD-RED 60 models that provide added performance, modular connectivity, and redundant power for the ultimate solution to remote branch or device connectivity.
Upgrading XG Firewall firmware is easy. Watch this video for a refresher.
Start enjoying the benefits of added visibility, protection and performance with XG Firewall v18 MR1 today!
Migrating from SG UTM
Sophos SG UTM customers interested in taking advantage of all the great new enhancements in XG Firewall can do so for free – anytime. A valid license can be transferred over at no extra charge and Sophos Professional Services is happy to help with migration if desired. Existing SG Series hardware is fully supported (except for the SG 105 which lacks the minimum required 4 GB of RAM). However, you may want to take this opportunity to consider refreshing your hardware to take full advantage of all the new capabilities such as TLS inspection. Check out this recent article for full details.
Migrating from Cyberoam
Migrating from Cyberoam to XG Firewall v18 is strongly encouraged to get all the added usability, security and performance benefits of XG Firewall. Contact your preferred Sophos partner to inquire about upgrading to the latest high-performance XG Series appliance hardware.
New to XG Firewall
If you’re new to XG Firewall, see why it offers the world’s best visibility, protection and response.