News
Sep
For Gustavo Cornejo Lizama, Network Manager for a large public sector organization in Santiago, Chile, moving to a Sophos cybersecurity system has halved his team’s workload.
A team of twenty IT professionals supports the organization’s one thousand employees, however only three ‑ a security expert and two admins ‑ focus on cybersecurity.
To protect against malware and other threats, they use a Sophos cybersecurity system: a Sophos XG Firewall along with Sophos next-gen endpoint and server protection.
Everything is managed through the cloud-based Sophos Central administrative console.
Gustavo shared the impact the Sophos system had on their day-to-day cybersecurity operations.
Life before Sophos: entire work days spent monitoring cybersecurity
With their previous cybersecurity products, Gustavo and team faced a huge amount of daily administration and were slowed down by network issues.
In fact, they used to spend a full eight hours a day between them monitoring for security issues. This took up a significant proportion of their overall capacity, limiting the team’s ability to work on other tasks.
Life after Sophos: 50% reduction in admin time plus improved bandwidth
Since switching to the Sophos system, Gustavo and team have been able to reduce the time spent monitoring for security issues from eight hours to four hours a day.
Management is now simpler and easier, as they can control everything through the Sophos Central console. At the same time, they also experience far fewer network issues.
One feature which has been particularly beneficial is the ability to identify and control all applications on the network, which we call Synchronized App Control.
Sophos endpoint protection and XG Firewall constantly share information in real time, enabling the firewall to identify all apps, including those that would prefer to remain hidden.
Armed with this insight, Gustavo has been able to block social media and streaming, resulting in improved user productivity and bandwidth.
Favorite feature
A favorite feature of Gustavo and team is the ability to manage firewall, server, and endpoint security through a single cloud-based platform, giving them one-stop shopping for security management. Everything they need is at their fingertips with a single login.
Whether managing bandwidth, controlling apps, or dealing with general security issues, everything is handled through a unified console, cutting the time spent on these weighty tasks in half.
See it in action
Watch this demo video to see just how easy day-to-day security management is with a Sophos system.
To try the system for yourself, the easiest way is to start a free trial of one of our products.
And for anything else, or to discuss your own challenges, the Sophos team is here to help.
Sep
The COVID-19 era has ushered in a global organisational transition to remote working policies and highlighted the need to bolster protection against cyber-attacks and inadvertent data misuse at the hands of employees.
Top cybersecurity leaders outline key areas to facilitate successful remote workforce environments in this latest article by HelpNetSecurity, including HelpSystems CEO Kate Bolseth, who discusses the value of data classification in protecting vulnerable corporate assets.
“One thing must be clear” Kate Bolseth writes: “your entire management team needs to assist in establishing the right infrastructure in order to facilitate a successful remote workforce environment.
Before looking at any solutions, answer the following questions:
- How are my employees accessing data?
- How are they working?
- How can we minimize the risk of data breaches or inadvertent exposure of sensitive data?
- How do we discern what data is sensitive and needs to be protected?
The answers will inform organizational planning and facilitate employee engagement while removing potential security roadblocks that might thwart workforce productivity. These guidelines must be as fluid as the extraordinary circumstances we are facing without creating unforeseen exposure to risk.
When examining solutions, any option worth considering must be able to identify and classify sensitive personal data and critical corporate information assets. The deployment of enterprise-grade security is essential to protecting the virtual workforce from security breaches via personal computers as well as at-home Wi-Fi networks and routers.
Ultimately, it’s the flow of email that remains the biggest vulnerability for most organizations, so make sure your solution examines emails and files at the point of creation to identify personal data and apply proper protection while providing the link to broader data classification”.
Sep
We’re pleased to announce the addition of new reporting capabilities for Sophos Central Firewall Reporting (CFR). If you’re a customer of CFR Advanced, you’ll see new options to save, schedule, and export your favorite reports in Sophos Central, further extending your powerful custom reporting capabilities in the cloud.
What’s new and how to use it
- Save reports as templates – Central Firewall Reporting Advanced lets you save custom report templates. First, customize a report with the columns, filters, and chart type you want. Then save it in your template library for quick access whenever you need to run it.
- Schedule reports – Getting your favorite and custom reports is now even easier, as you can schedule them to be delivered your inbox or picked up in Sophos Central at your convenience. The scheduler allows you to set a frequency for your reports, including daily, weekly, and monthly options.
- Export your reports – Reports can now be exported in HTML, CSV, and (coming next month) PDF formats. As an additional bonus, the exported reports provide up to 100,000 records in a report, whereas the interactive reports in Central are limited to 10,000 records. Download your favorite report for offline viewing directly from Sophos Central or have it delivered to your inbox.
You have complete control over the scheduling frequency, report format, and delivery…
We will be covering Central Firewall Reporting in more detail in an upcoming article in our Making the Most of XG Firewall v18 series.
What you need
CFR Advanced is a new subscription license that offers additional firewall log data storage for historical reporting, and now adds these new features for saving, scheduling, and exporting reports.
CFR Advanced subscriptions are on a per-firewall basis, so each firewall you wish to report on in Sophos Central will require its own CFR Advanced license.
CFR Advanced licenses are purchased in 100GB storage quantities. You can use the storage estimation tool (at sophos.com/cfrsizing) to quickly determine the estimated storage required for your particular needs.
XG Firewall v18 is required to take advantage of Central Firewall Reporting. We encourage everyone to upgrade today to take advantage of all the great new performance, security, and feature enhancements.
Talk to your preferred Sophos partner today about adding CFR Advanced to your account so you can take full advantage of the rich customizable reporting options in Sophos Central.
New to Sophos Central Reporting?
If you’re new to Sophos Central Reporting, you can try it for free. Simply set up your firewalls for Sophos Central management and log into Sophos Central to give it a go.
You can learn more about what’s included with Sophos Central management and reporting on our website or download the PDF brochure. And if you’re new to Sophos XG Firewall, be sure to check out how you can add the best visibility, protection, and response to your network.
Sep
Security services bestow organizations with the security expertise they desperately need to combat ever-increasingly capable threat actors, as illustrated by the momentum in uptake of our Managed Threat Response service.
It has been less than 11 months since the launch of Sophos Managed Threat Response, our 24/7 human-led threat hunting, detection, and response service.
Our performance in that time is proof that our strategy of fusing technology, people, and process to act as an extension of organizations’ security and IT teams is a winning one. And we’re just getting started.
It gives me immense pride to announce that we have just surpassed 1,000 customers defended by Sophos MTR, underlining the profound need for security expertise across all verticals, industries, and sectors.
Against the chaotic backdrop of social and economic pressures brought on by the pandemic, those in the IT profession have continued to achieve the seemingly impossible: do more with less, in isolation.
Supporting remote workforces to achieve their goals both effectively and safely is a monumental task. Before this pandemic, there was already a global shortage of skilled cybersecurity professionals: an estimated workforce gap of 4.07 million. Securing an organization has never been a trivial matter, and the current climate has only worsened the impact of this shortage.
As a leader in cybersecurity across endpoint, network, and cloud, we are incredibly fortunate. Where most organizations struggle to both hire and retain security professionals, we are resilient to these struggles due to the sheer scale at which we operate.
When our staff walk over to the (albeit now virtual) water cooler, they talk security with other security people. When they’re in need of guidance, they can talk directly with industry veterans and experts within MTR, SophosLabs, and across our whole organization.
When they’re looking for a new challenge, that challenge already exists within our various research, development, and service groups, as well as within the diversity of our customer landscape. It’s an environment that attracts and hones the best operators in the industry, and that provides a virtuous circle of optimizations between technology and those human operators.
It is an honor to be afforded the trust and responsibility to assist in defending so many organizations across the globe in such a short space of time. This is an important milestone for us, one that enables us to protect more customers than ever in an ever-more effective fashion. But our achievement to date is just the beginning.
Joe Levy
Sophos Chief Technology Officer (CTO)
Aug
Ransomware continues to plague organizations, with over half of companies surveyed across 26 countries revealing that they were hit by ransomware in the last year.
Modern firewalls are highly effective at defending against ransomware attacks, but they need to be given the chance to do their job.
Our guide, Firewall Best Practices to Block Ransomware, explores how ransomware attacks work, how they can be stopped at the gateway, and best practices for configuring your firewall to optimize your protection.
Eight firewall best practices to block ransomware
To maximize the effectiveness of your anti-ransomware defenses, we recommend you:
- Start with the best protection, including a modern high-performance next-gen firewall with IPS, TLS inspection, zero-day sandboxing, and machine learning ransomware protection.
- Lock down RDP and other services with your firewall. Your firewall should be able to restrict access to VPN users and only allow sanctioned IP addresses.
- Reduce the surface area of attack as much as possible by thoroughly reviewing and revisiting all port-forwarding rules to eliminate any non-essential open ports. Where possible, use VPN to access resources on the internal network from outside rather than port-forwarding.
- Be sure to properly secure any open ports by applying suitable IPS protection to the rules governing that traffic.
- Enable TLS inspection with support for the latest TLS 1.3 standards on web traffic to ensure threats are not entering your network through encrypted traffic flows.
- Minimize the risk of lateral movement within the network by segmenting LANs into smaller, isolated zones or VLANs that are secured and connected together by the firewall. Be sure to apply suitable IPS policies to rules governing the traffic traversing these LAN segments to prevent exploits, worms, and bots from spreading between LAN segments.
- Automatically isolate infected systems. When an infection hits, it’s important that your IT security solution be able to quickly identify compromised systems and automatically isolate them until they can be cleaned up (such as with Sophos Synchronized Security).
- Use strong passwords and multi-factor authentication for your remote management and file sharing tools so that they’re not easily compromised by brute-force hacking tools.
These best practices and more are covered in greater detail our new Firewall Best Practices to Block Ransomware whitepaper.
Give your organization the best network protection with Sophos
Sophos XG Firewall gives you the best possible network protection against ransomware and other advanced threats, including cryptomining, bots, worms, hacks, breaches, and APTs.
- Industry-leading IPS stops attackers using the latest network exploits to infect your organization
- Deep learning technology identifies new and zero-day ransomware variants before they get on your network
- Sophos Sandstorm analyzes suspicious files in a safe cloud environment
XG Firewall also provides a simple, elegant way to manage your RDP, as well as support for the latest TLS 1.3 standards.
Visit Sophos.com/Firewall today to learn more and try it yourself!
Aug
In our recent survey of 5,000 IT Managers across 26 countries, 51% of respondents revealed that they were hit by ransomware in the last year. In 73% of those incidents, attackers succeeded in encrypting data. Furthermore, the average global cost to remediate these attacks was an eye-watering $761,106.
An endpoint protection solution is one of the most effective methods to protect against ransomware – but only if it’s properly configured.
Our new guide, Endpoint Protection Best Practices to Block Ransomware, explores how ransomware attacks work, how they can be stopped, and best practices for configuring your endpoint solution for the strongest protection possible.
Seven endpoint protection best practices to block ransomware
To maximize the effectiveness of your anti-ransomware defenses, we recommend:
- Turning on all policies and ensuring all features are enabled. It sounds obvious, but this is a surefire way that you’ll get the best protection out of your endpoint solution. Be sure to enable features that detect file-less attack techniques and ransomware behavior.
- Regularly reviewing your exclusions. Exclusions are sometimes leveraged to soften complaints from users who feel your protection solution is slowing down their systems. Malware that manages to make its way into excluded directories will likely succeed because it’s excluded from being checked.
- Enabling multi-factor authentication (MFA) within your security console. MFA provides an additional layer of security after the first factor, which is often a password.
- Ensuring every endpoint is protected and up to date. Checking your devices regularly to know if they’re protected and up to date is a quick way to ensure optimum protection.
- Maintaining good IT hygiene. Not only does this mitigate your cybersecurity risk, but it can save you a lot of time when it comes to remediating potential incidents in the future.
- Hunting for active adversaries on your network. Malicious actors are more cunning than ever. Take advantage of endpoint detection and response (EDR) technologies in your endpoint solution to identify advanced threats and active adversaries, and take swift action to stop threats.
- Closing the gap with human intervention. Hackers typically spend time exploring your network before deploying ransomware. The best way to detect this malicious activity is to combine human expertise with advanced endpoint technology.
These best practices and more are covered in greater detail our new Endpoint Protection Best Practices to Block Ransomware whitepaper.
How Sophos keeps you protected from ransomware
Sophos Intercept X includes all the features you need to help protect your organization from advanced ransomware attacks like Ryuk, Sodinokibi, Maze, and Ragnar Locker.
- Deep learning identifies and blocks known and unknown ransomware variants
- Anti-exploit technology stops the delivery and installation of ransomware
- CryptoGuard identifies and rolls back the unauthorized encryption of files
Sophos EDR, available for endpoints and servers, lets you hunt for threats and maintain good IT operations hygiene across your entire estate.
If you want to add human expertise to your layered security strategy, Sophos Managed Threat Response (MTR) proactively hunts for and neutralizes threats on your behalf.
Aug
Remote Desktop Protocol (RDP), while a legitimate tool, is also a common ingress point for attackers looking to break into an organization. A recent Sophos survey found that in 9% of ransomware attacks, RDP was the method used to gain entry.
Fortunately, Intercept X Advanced with EDR makes it easy to identify devices that have open RDP connections and remotely shut them down, all from a single management console.
Sophos EDR includes Live Discover, which leverages a collection of pre-written, fully customizable SQL queries to answer IT operations and threat hunting questions.
To begin, we select which devices we want to check.
There are a variety of different categories to choose from depending on your needs. We have a couple of options for RDP. Identifying devices with running processes that have active RDP connections or finding devices that have RDP enabled.
In this case we want to do the latter, so we’re going to create a short query for the task. A quick search of the Live Discover query sharing forum gives us exactly what we need. A couple of clicks later and we have our query ready to run (we also had the option to select a pre-written query to identify devices with active RDP connections).
The query identifies a device that has RDP enabled. From the same console, we launch a Live Response remote terminal session to the device and use the command line interface to disable RDP.
It’s that easy to detect RDP and disable it across your entire endpoint and server estates. To learn more about Sophos EDR head over to Sophos.com or to try it for yourself, you can start a no-obligation 30-day trial.
Aug
We’re excited to announce that we have launched the new Sophos Support Portal, which makes it much easier for you to track and manage all your support cases.
You can now visit support.sophos.com to access and create support cases.
What’s new
- Create and manage your own support cases
- Your Sophos partner can manage cases on your behalf
- More interactive ways to update and track a case
- View and manage cases created by others on your team
- Chat in real time with our support engineers
- Find suitable solutions in our knowledgebase
- Manage your team’s access to the Support Portal
How to get started
Please note that the process to create a support case has now changed. From now on, you will need to log into the new Sophos Support Portal with your SophosID. If you do not have a SophosID yet, you’ll be able to create one as part of the registration process. Registration is quick and easy. You can find more information on how to register on our Community page.
Once logged in, you can conveniently create, manage, and follow cases in the Support Portal.
You can also still call in to our support centers to open a case. You can find our phone numbers on the support pages.
Migration of existing cases
Active cases have been migrated to the new Support Portal. If you have an open case with us, you should have received an email with your new case number and further instructions. Please don’t worry that your old case has been closed, as that is just a result of the migration to the new portal.
Your Sophos partner can file cases on your behalf
Your Sophos partner is now able to manage cases on your behalf and escalate cases to support management. This Community page includes a link to the knowledgebase article that explains how you can give your partner access to view your assets and create cases on your behalf. You will still be able to log in and track cases that your partner is managing for you.
Visit our Community page for a demo and the latest information or if you need any help.
Aug
We often get asked about the inner workings of Netsparker’s vulnerability scanning engine. People familiar with network and virus scanners also ask what vulnerability databases we use and how often we update them. In reality, it’s all a lot more interesting than ticking boxes on a list of known issues. Time to set the record straight about how a cutting-edge web vulnerability scanner works.
Two Sources of Vulnerability Information
When most people hear the word “scanner”, they think of software that looks for known risks. This is generally what virus scanners and network scanners do: check targets against a list of known issues, such as (respectively) malware signatures and CVE vulnerability reports. So when customers see how effective Netsparker is, their first question is often: “What vulnerability database do you use?” Well, the short answer is: “None, mostly.” The full answer is that Netsparker is an advanced heuristic scanner that also checks for known web application vulnerabilities – but let’s break this down a bit.
The Mundane Part: CVEs
The idea of relying on a vulnerability database comes from the systems and network security world, where a software or hardware bug is discovered, publicly disclosed, and added to a vulnerability database such as CVE. Network scanners, for example, work by finding such known issues in target systems. To fix the vulnerability, you simply patch or update the affected component.
Some CVEs also apply to web applications. These are bugs in widely-used products that need to be patched to avoid attacks. As one part of its scanning process, Netsparker checks for such issues based on the CVE registry and other vulnerability databases, so scans also cover vulnerabilities such as Heartbleed (CVE-2014-0160) or POODLE (CVE-2014-3566). In fact, the Netsparker security advisory program actively contributes to finding bugs in open-source packages by scanning them for vulnerabilities during engine testing. To learn how our security researchers do this, see our article on vulnerability disclosures.
Although an important part of overall security, checking for known issues is relatively easy and not terribly exciting. Things get interesting when you have to check for unknown issues – and this is when you find out how effective your web application security solution truly is.
The Really Clever Part: Heuristics
The vast majority of web application vulnerabilities are brand new issues that were introduced in new code in custom-built applications – so how are you supposed to know about them? This is the main difference between web application security testing and signature-based security checks: web vulnerability scanning is primarily about finding new vulnerabilities resulting from underlying weaknesses categorized in the CWE system. To find previously unknown issues, Netsparker uses a cutting-edge heuristic scanning engine that probes websites and applications for vulnerabilities just like a penetration tester would.
Netsparker uses a variety of advanced heuristic techniques to find all entry points in web applications and test them for vulnerabilities. This includes automatic URL rewriting to provide maximum scan coverage, automated fuzzing to generate unexpected inputs that may reveal a weakness, and proprietary Proof-Based Scanning™ technology to safely test weaknesses and provide proof that the vulnerability is real.
Because web vulnerability scanners don’t rely on signatures, their effectiveness is highly dependent on the quality and maturity of the underlying heuristic scanning engine. If the scanning engine is too eager to flag suspicious responses as signs of vulnerabilities, it will flood the user with false positives. If it is too cautious or simply not advanced enough, it will miss real vulnerabilities or even bypass whole pages, for example because it can’t deal with authentication. As an industry veteran and technology leader, Netsparker knows how to strike the right balance.
Get the Best of Both Worlds
The purpose of a web application security solution is to help the user improve security more efficiently than with manual testing alone. This goes way beyond vulnerability databases and even beyond scanning itself. To get measurable security improvements, you need a holistic view of web application security that pulls together accurate information from all relevant sources and applies it through effective automation.
Netsparker combines high-quality heuristic results from its industry-leading vulnerability scanning engine with information about known issues listed in vulnerability databases. All these vulnerability results are complemented by asset discovery and crawling information, warnings about outdated web technologies, detailed vulnerability descriptions complete with suggested remedies, best-practice recommendations, compliance reports, and more. This gives you a complete picture of what you need to fix in your web environment, so you can start getting real value from Netsparker in a matter of days.
Aug
As cybercriminals continue to take advantage of the public cloud in their attacks, Sophos commissioned an independent survey of 3,521 IT managers across 26 countries* to reveal the reality of cloud security in 2020.
The 2020 cloud security reality
The survey provides fresh new insight into the cybersecurity experiences of organizations using the public cloud, including:
- Almost three-quarters of organizations hosting data or workloads in the public cloud experienced a security incident in the last year. Seventy percent of organizations reported they were hit by malware, ransomware, data theft, account compromise attempts, or cryptojacking in the last year.
- Data loss/leakage is the number one concern for organizations. Data loss and leakage topped our list as the biggest security concern, with 44% of organizations seeing data loss as one of their top three focus areas.
- Ninety-six percent of organizations are concerned about their current level of cloud security. Data loss, detection and response, and multi-cloud management top the list of the biggest concerns among organizations.
- Multi-cloud organizations reported more security incidents in the last 12 months. Seventy-three percent of the organizations surveyed were using two or more public cloud providers and reported more security incidents as those using a single platform.
- European organizations may have the General Data Protection Regulation (GDPR) to thank for the lowest attack rates of all regions. The GDPR guidelines’ focus on data protection, and well-publicized ransomware attacks have likely led to these lucrative targets becoming harder for cybercriminals to compromise in Europe.
- Only one in four organizations see lack of staff expertise as a top concern despite the number of cyberattacks reported in the survey. When it comes to hardening security postures in the cloud, the skills needed to create good designs, develop clear use cases, and leverage third-party services for platform tools are crucial but underappreciated.
- Two-thirds of organizations leave back doors open to attackers. Security gaps in misconfigurations were exploited in 66% of attacks, while 33% of attacks used stolen credentials to get into cloud provider accounts.
For the details behind these headlines, and to see how your country stacks up, read The State of Cloud Security 2020 report.
Secure the cloud with Sophos
However you’re using the public cloud, Sophos can help you keep it secure.
- Secure all your cloud resources. Get a complete inventory of multi-cloud environments (virtual machines, storage, containers, IAM Users etc.). Reveal insecure deployments, suspicious access, and sudden spikes in cloud spend. Learn more
- Secure your cloud workloads. Protect virtual machines, the virtual desktops running on those machines from the latest threats, including ransomware, fileless attacks, and server-specific malware. Learn more
- Protect the network edge. Secure inbound and outbound traffic to your virtual network, virtual desktop environments, and provides secure remote access to private applications running in the cloud. Learn more
For more information and to discuss your cloud security needs, request a call back from one of security experts.
* Australia, Belgium, Brazil, Canada, China, Colombia, Czech Republic, France, Germany, India, Italy, Japan, Malaysia, Mexico, Netherlands, Nigeria, Philippines, Poland, Singapore, South Africa, Spain, Sweden, Turkey, UAE, United Kingdom, United States
Aug
ProLock ransomware emerged on the threat scene in March, a retooled and rebranded version of PwndLocker.
As SophosLabs reveals in its detailed analysis, while ProLock ransomware gives you the first eight kilobytes of decryption for free, it can still cause significant business disruption and economic damage.
Protect against ProLock with Sophos Intercept X
Intercept X gives you multiple layers of protection against ProLock, keeping the data on your endpoints and servers safe:
- CryptoGuard identifies and rolls back the unauthorized encryption of files. In fact, Sophos first detected ProLock when CryptoGuard caught it on a customer network
- Deep learning identifies and blocks ProLock without signatures
- Signatures block variants of ProLock either as Troj/Agent-BEKP or Malware/Generic-S
If you’re running Sophos Intercept X you can relax knowing that you are automatically protected against ProLock, as all three of the above features are enabled by default in our recommended settings.
(If you’re not yet running Intercept X and want to give it a try, visit the web page to learn more and start a no-obligation free trial.)
To check that you have CryptoGuard and Deep Learning enabled:
- Open your Sophos Central Admin console and select Endpoint Protection in the left-hand menu
- Select Policies
- Review the list of threat protection policies already created
- Toggle the buttons to make any necessary changes
Endpoint protection and firewall best practices to block ransomware
51% of IT managers surveyed for our recent State of Ransomware 2020 report said their organization was hit by ransomware last year, and that cybercriminals succeeded in encrypting data in 73% of incidents.
With stats like these it’s worth taking the time to ensure all your ransomware defenses are up-to-date.
The earliest detection of ProLock by Sophos was traced to a compromised server, most likely through an exploit of a Remote Desktop Protocol (RDP).
Putting RDP access behind a virtual private network and using multi-factor authentication for remote access are just a couple of the best practices we recommend to reduce your ransomware risk.
For additional best practices, take a look at our guides Endpoint Protection Best Practices to Block Ransomware and Firewall Best Practices to Block Ransomware.
Aug
We are excited to announce that Intercept X for Server Advanced with EDR has been enhanced with powerful cloud visibility features from Cloud Optix.
In addition to even more detail on your AWS, Azure, and GCP cloud workloads, this integration gives customers critical insights into their wider cloud environments, including security groups, hosts, shared storage, databases, serverless, containers, and more.
See your complete cloud environment
The dynamic nature of cloud environments – with assets being spun up and down as and when necessary to meet changing demands – can make security and compliance assessments time-consuming. In many cases, you’ll need to log into multiple consoles and manually collate information to get a full picture.
With Sophos, it’s easy. You get details about your entire cloud infrastructure across different public cloud providers on one screen, in a single management console. You can dive directly into assets to get more detail about your asset inventory and cloud security posture.
Secure your complete cloud environment
Automated scans will detect any insecure deployments, with guided recommendations about how to fix potential issues. Additionally, guardrails can be deployed to lock down configurations, ensuring that they can’t be accidentally or maliciously tampered with and left in an unsafe state.
Artificial intelligence tracks normal behavior patterns, looking for any suspicious activity such as anomalous traffic patterns or unusual login attempts to cloud accounts. Issues are then flagged and prioritized by risk level if they require manual intervention.
Here’s the full list of what’s available:
- Cloud asset inventory – see a detailed inventory of your entire cloud infrastructure (e.g. cloud hosts, serverless functions, S3 buckets, databases, and cloud workloads), eliminating the need for time-consuming manual collation
- Access and traffic anomaly detection – unusual login attempts and suspicious traffic patterns are automatically detected and blocked or flagged to the admin as appropriate
- Security scans – daily and on-demand scans monitor your cloud environment to ensure its on-going security. Issues are automatically resolved where possible, with admin notification if manual intervention is required
- Configuration guardrails – stop accidental or malicious tampering with configurations that could negatively impact security posture
- Compliance policies – ensure that your cloud environment conforms to Center for Internet Security (CIS) best practices, helping keep your security posture at its best
- Alert management integrations – receive email notifications when manual intervention is required
Powerful visibility and protection for every setup
This exciting new cloud functionality is available to all Intercept X Advanced for Server with EDR customers at no additional cost. Log into your Sophos Central console, select Cloud Optix, and you can get started right away.
Current customers using Sophos Central that would like to try out this new functionality – in addition to the recently released EDR IT operations and threat hunting capabilities – can start a trial from within the Sophos Central console.
If you don’t have a Sophos Central account, you can register for a trial on Sophos.com.
Intercept X Advanced for Server with EDR and Intercept X Advanced with EDR give organizations unparalleled visibility and protection across their cloud, on-premises, and virtual estates. Cloud Optix shines a spotlight on complete cloud environments, showing what’s there, what needs securing, and making sure that everything stays safe and secure.
Aug
Most privileged access management solutions just focus on passwords. BeyondTrust is different. Our innovative Universal Privilege Management approach to cyber security secures every user, asset, and session across your enterprise. Deployed as SaaS or on-premises, BeyondTrust’s Universal Privilege Management approach simplifies deployments, reduces costs, improves usability, and reduces privilege risks.
Go Beyond Passwords
Passwords are important. That’s why you can audit and manage every privileged account with BeyondTrust. This includes everything from privileged user passwords, app-to-app credentials, service accounts, DevOps secrets, and more.
But passwords are just the beginning. The BeyondTrust platform integrates privileged password security with endpoint and remote access security, drastically reducing your attack surface and windows of exposure. This is Universal Privilege Management.
Productivity, Not Friction
Privileged users handle critical tasks that keep your business running. The last thing you want to do is slow down legitimate business activity with annoying security measures.
BeyondTrust is non-intrusive to users. Our software helps power some of the most efficient organizations on the planet. Centralized reporting and management, integrations with your existing systems, and automated privilege management enable security that’s virtually invisible to users.
Accelerated Time to Value
Our customers get more than software. They get 30+ years of accumulated security expertise and best practices productized in software form.
Built-in templates and workflows let you see value on day one. Flexible deployment options, including cloud deployments and virtual appliances, let you start right away. Our customers report fast user adoption, which rapidly reduces your risk.
The BeyondTrust Advantage
BeyondTrust serves more organizations than any other Privileged Access Management vendor. More than 20,000 customers, including 70% of the Fortune 500, trust us to improve cyber security and efficiency. We’ve helped more customers deploy in the cloud than anyone else. And customers rate our support organization with 96% satisfaction.
Jul
Increased remote working makes it more important than ever to secure computers and the data on them. With the huge number of laptops that are lost, misplaced, or stolen every day, a crucial first line of defense for devices is full-disk encryption.
With full disk encryption rolled out, admins can ensure sensitive company data can’t be accessed, even if a device falls into the wrong hands. And while disk encryption has long been a vital component of device security, it has also frequently been associated with complexity and admin overhead. Setting up and maintaining servers, dealing with encryption keys, and helping users who’ve forgotten their credentials all takes time and effort.
Hassle-free encryption
With Sophos Central Device Encryption, we focus on making device encryption intuitive and hassle-free. There’s no server to install, and encryption is enabled in a handful of clicks. Sophos Central Device Encryption uses the same core agent as Intercept X, meaning existing Sophos customers have no additional agent to deploy and can start encrypting computers in mere minutes.
Under the hood, we leverage Windows BitLocker and macOS FileVault technology to do the heavy lifting when it comes to encrypting and decrypting data on the disk. With these technologies being integrated deeply into each operating system, performance and security is first-class.
Demonstrate compliance
As a part of compliance requirements, companies often need to verify which computers in the organization are encrypted. The cloud-based Sophos Central Admin console provides great visibility into device status, including which disks are encrypted and the last time a device checked in. The next version of Central Device Encryption adds a new Encryption Status report, further drilling down into device encryption status, making it even easier to help demonstrate compliance across the organization.
Fast recovery
An important consideration with disk encryption is how users will regain access to their devices if they forget their credentials. The Sophos Central Self-Service Portal lets users retrieve their own recovery keys without needing to contact the IT helpdesk. Users get back up and running faster, and IT teams have fewer tickets to deal with.
Sophos Central Device Encryption
The shift towards remote working makes full disk encryption more important than ever. Sophos Central Device Encryption makes it a breeze to deploy and manage devices with full disk encryption. Head over to Sophos.com to find out more and to sign up for a free trial.
Jul
Work from home (WFH) and remote access have accelerated the digital transformation journey, and IT’s move to the cloud. Security programs must address visibility, continuous monitoring, and a unified identity and privilege model for the multicloud environment. Privileged access management solutions are a key enabler for the cloud security strategy because they can protect core enterprise assets from increased vulnerability from the home offices at the edge to significantly reduce attacker’s ability to exploit configuration, credential, or privilege management errors.
Rope Burns & IT Security
Thinking back on those school gym classes, remember rope climbing? Or maybe swinging on a rope? Then you’ll know: ropes can be slippery, and your hands can get burned.
As businesses enabling digital transformation via accelerated cloud adoption, avoiding IT security breaches or outages (the digital equivalent of rope burns) is always a top concern. These negative outcomes can rear their heads amidst an atmosphere of too much uncontrolled change, happening too fast, to the operating environment.
A New Cloud Security Strategy
Accelerated digital transformation means accelerated cloud adoption. All those users that used to be in the office? Now they’re in the cloud. Services and applications? They too are moving to the cloud. A quick review of the Cloud Security Alliance’s top threats shows we have our work cut for us to secure cloud use.
What’s interesting about the CSA’s “Egregious 11” threats, is that many of them – such as misconfiguration, weak control plane, poor visibility, and lack of architecture, are customer-side failings. Earlier this month, I wrote about the need for Cleaning up Risk and Technical Debt spawned from ungoverned cloud adoption
The broad scope of these threats and their root cause in technical debt makes it quite clear: virtually all businesses need a new, or refreshed, cloud security strategy.
Multiple Failures to Protect Privileged Access
How were Jeff Bezos, Elon Musk, Bill Gates, and so many other IT-savvy luminaries’ Twitter accounts recently hacked and used to solicit bitcoin payments? An article from the Verge suggests that attackers “either found a severe security loophole in Twitter’s login or account recovery process or…somehow gained access to a Twitter employee’s admin privileges.”
The Twitter breach is just our latest object lesson about the importance of closing privileged attack vectors. Consider that multiple studies show Credential Misuse being the #1 cause of breaches. Behind any credential breach is an access (or privileged access) management failure. This is true because the typical user should not have access to the “crown jewels” and privileged accounts with more than the usual access should be very difficult for hackers to obtain.
Gaps in Cloud PAM
As IT’s center of gravity shifted, PAM systems have needed to evolve. Amidst the forced digitalization of the pandemic, these architectural deficiencies are no longer just limiting or annoying, they’re downright dangerous. We commonly see the following gaps in that older PAM systems have:
- Limited integration with cloud service provider (CSP) native identity frameworks or APIs
- Poor visibility into cloud environments
- Heavy server-side agent software in the infrastructure-as-a-service (IaaS) environment
- Static, or always-on, privileged accounts (also called accounts with standing privileges)
Let’s focus on the last of these gaps, to make sure everyone understands the need for…
Just-in-Time (JIT) PAM
Traditionally, privileged access is granted through a combination of static accounts and roles. For example, the powerful Active Directory domain administrator role is conferred on static accounts with a Domain Administrator group membership. As shown in the below figure’s topmost process flow, static accounts can be provisioned through identity and access management (IAM) system, or created manually. The traditional PAM system inventories the accounts that are privileged, manages access to them, and performs credential rotation.
Always-on (standing) privileges versus just-in-time (JIT) privileged access
The trouble is that always-on, static accounts can become targets of opportunity. They are one of the first things advanced attackers look for as they move laterally through the victim infrastructure.
Fortunately, CSPs have provided a better way to manage privileged access. That is to bind the privileged roles to accounts only temporarily, after a request is approved. As shown in the bottom most process flow in the figure, the IAM (or PAM) system can process valid access requests and dynamically bind privileged roles to the requesting user’s account by calling an API such as the Amazon Web Service (AWS) AssumeRole. The privileged access soon expires, or is removed, reducing the attack surface available to any bad actors in the IT environment.
We need to achieve a paradigm shift from static to dynamic access grants – to just-in time privileged access management (JIT PAM).
Critical Capabilities for Cloud Privileged Access Management (PAM)
To effectively secure privileged access, credentials, and sessions across cloud environments, PAM systems need to have many of the traditional PAM features such as credential vault, credential rotation, session broker, session recording, privileged user auditing, service account support, and high availability) plus what’s below:
- Unified browser-based administration and remote session protocol support
- Authentication and authorization agility for multiple use cases, third parties, cloud environments
- Integration with cloud-native access systems
- Just-in-time access grant support
Enabling Productive & Secure Work-From-Home & Remote Access
Work from home and remote access have accelerated the digital transformation, and IT’s move to the cloud. Security programs must address visibility, continuous monitoring, and a unified identity and privilege model for the multicloud environment. PAM systems are a key enabler for the cloud security strategy because they can protect core enterprise assets from increased vulnerability from the home offices at the edge to significantly reduce attacker’s ability to exploit configuration, credential, or privilege management errors.
To learn more on updating your cloud security strategy to address the “new normal”, check out my on-demand webinar.
Jul
Analysis of public cloud accounts across Amazon Web Services, Microsoft Azure, and Google Cloud Platform reveals a silver lining when it comes to the protection of cloud data.
New research shows that in the last year, 70% of organizations that use public cloud services experienced a security incident. These incidents included attacks from ransomware and other malware (50%), exposed data (29%), compromised accounts (25%), and cryptojacking (17%).
Ninety-six percent of these organizations are concerned about their current levels of cloud security, with data security being the top concern for 44% of them. It’s a good time to address the fundamentals of cloud security best practices: access to cloud environments and the protection of sensitive data.
Secure who gets in
Identity security represents a huge challenge for organizations. A review of cloud accounts by the Sophos Cloud Optix cloud security posture management service discovered worrying trends in organizations’ security posture as it relates to cloud account access, with 91% of organizations having over-privileged Identity and Access Management roles and 98% without MFA enabled on their cloud provider accounts.
Managing access to cloud accounts is an enormous challenge and yet only a quarter of organizations in our research saw it as a top area for concern, while a third reported that cybercriminals gained access by stealing cloud provider account credentials
Why securing access matters
Granting extensive access permissions to IAM users, groups, and cloud services is a risky practice. If such credentials get compromised, cybercriminals may gain access to any services and data those permissions grant. All user accounts should have MFA enabled, as it adds an extra layer of protection on top of usernames and passwords.
Secure what can get out
You won’t have to look far to find stories of shared storage-related data breaches caused by misconfiguration, where security settings with public read/list permissions had been enabled. AWS has even released an update to help customers from running afoul of this – one of the biggest causes of cloud data breaches. In our review of cloud accounts, we discovered that accidental data exposure through misconfigured storage services continues to plague organizations, with 60% leaving information unencrypted. Organizations are making it easy for attackers to search for and identify new targets.
The silver lining in all this is that the number of organizations exposing data to the public internet is declining, with Sophos Cloud Optix identifying that only 13% of organizations left database ports open to the internet and 18% of organizations had storage services with public read/list permissions enabled. Assuming there will always be use cases for public access being available, organizations are starting to close the door on this, the most common attack method for obtaining sensitive company and customer data.
Why secure configurations matter
Encryption is critical when it comes to stopping cybercriminals from seeing and reading stored information, and is a requirement for many compliance and security best-practice standards. “Public mode” – a setting that can be applied to databases, shared storage, and other cloud provider services – is a major cause of data breaches, and misconfiguring cloud services in “public mode” allows cybercriminals to automate their searches for security weak points. Guardrails should be in place to prevent such misconfigurations.
Think you know what you’ve got in the cloud?
Take control of your cloud security with a free inventory assessment and security check powered by Sophos Cloud Optix. Activate a free trial to get to get 30 days of commitment-free usage, including:
- Comprehensive inventory of everything you’ve got in the cloud: virtual machines, storage, containers, IAM roles, etc.
- Visualize IAM roles like never before and stop over-privileged access roles and stolen credentials from being exploited in cyberattacks
- Harden Amazon Web Services, Microsoft Azure, Google Cloud Platform, Kubernetes clusters, and Infrastructure-as-Code environments to reduce your surface area for attack
- Automatically detect security and compliance vulnerabilities, suspicious access, network traffic and cloud spend anomalies
- No agent, no install, no tie-in
Once you have a Cloud Optix account set up, follow the step-by-step instructions on the screen, which will walk you through adding your AWS, Azure, and GCP environments. For more information, read the Getting Started guide.
Should you need help at any point, check out the community forum or reach out to our technical support team.
Jul
In a cloud-first world, the traditional line between network security and application security is becoming blurred. Physical IT infrastructure can now be hidden behind layers of virtualization, and web applications are frequently designed, developed, tested, and deployed entirely in the cloud. At the same time, web applications have become the main target of cyberattacks and now account for 3 out of 4 data breaches worldwide. Web application security has never been more important – and yet there is still some confusion as to its place in the overall security posture. Established organizations often have mature network security programs, while web application security tends to receive far less attention and funding.
As companies continue to shift data and business logic onto cloud platforms and become reliant on web technologies to do business, information security has become a top priority. Business data, intellectual property (IP), and other sensitive information are now prized commodities, so cybercriminals are increasingly focusing their attacks on web applications to extract this data. This means that traditional network perimeter defense with firewalls to filter network traffic is no longer enough to ensure data security and proper access control. If exploited successfully, web application vulnerabilities can not only allow unauthorized access to sensitive data but also provide a foothold to mount denial-of-service attacks or even serve malware to website visitors.
Modern web assets include not only websites and web applications but also web services and application programming interfaces (APIs) that are used to exchange data between systems and provide the back-end for countless mobile applications. In a large organization, there can be thousands of different web assets spread across multiple systems and geographies. At this scale and level of complexity, protecting them all from cyberthreats is only possible with dedicated web application security solutions that deliver accurate and actionable results, such as modern dynamic application security testing (DAST) products.
Our white paper Web Application Security or Network Security – Do You Have to Choose? examines the history of web security and analyzes current trends to set the record straight on the role of web application security and network security in any mature cybersecurity program.
Download the PDF version of our white paper: Web Application Security or Network Security – Do You Have to Choose?
Jul
The ongoing pandemic is resulting in a crisis for schools, colleges, and universities the world over. With physical buildings closed, most educational institutes are moving to emergency remote learning and working.
For most of them, the transition from physical to online models has happened too quickly. Without proper time to vet potential risks, their networks are exposed thanks to the deployment of new technologies and apps. Furthermore, risks can also run high because students and educators aren’t always properly trained to use the new tech.
Further complicating matters, many educational institutes simply don’t have the budgets to overhaul their technology solutions in the face of such an unprecedented and unanticipated pandemic. As a result, some institutes are lured by free tools and apps for online learning, most of which come laden with inadequate privacy controls, user tracking, inappropriate promotional content, and sometimes malware – all of which elevates the risk of not complying with regulatory mandates like FERPA and others.
With remote learning becoming the new normal, cybercriminals are busy finding new ways to leverage techniques like phishing, ransomware, social engineering, and more to pull off attacks. Here’s a look at some of the most critical risks to be addressed in order to safeguard users and data.
1. Secure remote access
With distance learning taking over physical schooling, students and teachers need access to online learning tools mostly located in the cloud – file sharing applications, email, apps – and they sometimes need to remotely access resources on the school network. At the same time, administrative and IT staff working from home may need access to systems and documents located on the school network as well. If remote access isn’t secure, hackers can sneak in and take control of the entire network. Deploy a virtual private network (VPN) that offers secure remote access to your users and protects all data that flows in and out of the VPN by encrypting it.
Students and school staff may bring their own devices and connect them to the school network, some of which may be unpatched and running risky applications, giving easy access to attackers. To counter this, ensure only whitelisted apps run on the network and that only authorized devices can accessing the network. With complete application visibility and control, you can identify all the applications on your network – including shadow IT and data at risk. This allows you to control the apps and apply user-based application controls and traffic shaping. By synchronizing your firewall and endpoint security, you can instantly identify compromised endpoints, isolate them until they are cleaned, and prevent infections from spreading laterally to other devices on the network.
2. Control access to sensitive data
Educational institutes are treasure troves of valuable information that can be sold on the dark web. Personal data of students, teachers, alumni, and administrative staff, along with sensitive data relating to a school’s research and intellectual property can make a hacker very rich by selling it or ransoming it. It’s critical to enforce access based on user identity, allowing authorized users access to only what they need in order to do their jobs. You can protect sensitive data, research, and other critical resources by allowing access to only those who are authorized, with two-factor authentication (2FA) support for access to key system areas, including IPsec and SSL VPN, user portals, and web administration consoles.
3. Protect against malware
The shift to remote learning means many of the devices connecting to the school network are BYOD. It’s difficult to know whether the devices and applications used are updated with patches and if the antivirus is current. Unless such remote devices are connecting via a VPN, you’ll need to ensure they’re secure before they can access resources on the school’s network.
It’s important to deploy advanced web protection capabilities that can identify and block the latest web threats. This allows you to enforce web filtering rules to keep students safe from instances of cyberbullying, inappropriate content, abuse, and other online threats. And with staff working from home, peripheral controls allow you to control what your staff can and can’t plug into their corporate devices. This helps you safeguard your network against unexpected threats.
4. Protect against phishing
Social engineering and phishing attacks pose major IT security risks to schools. Students, teachers, or staff members who get manipulated to click on malicious links can provide cybercriminals access to the school’s network and precious resources. The best way to counter social engineering and phishing attacks is through user awareness and training. Educating and testing your users with simulated attacks helps you facilitate a positive security awareness culture and makes them less likely to fall for scams. Make sure your email security is up to date as well, and that you have advanced protection for all your endpoints so you can protect them against both known and unknown malware, ransomware, exploits, and viruses.
5. Secure mobile computing
Mobile devices like phones, tablets, and others are increasingly used today for remote learning. A single unprotected device increases the risk of compromising the entire school network and systems, especially at a time when schools have lowered the barriers to access their networks, specifically for students. With most devices connected to the internet, the attack surface is significantly amplified for schools. An effective mobile device security solution can help keep your students and staff safe on the internet, preventing risky file downloads and blocking access to inappropriate websites. Mobile antivirus and ransomware protection capabilities can safeguard your users and devices from malicious content and apps.
Sophos can help
Sophos’ unique IT security capabilities offer award-winning protection for schools of all sizes. You can ensure that learning doesn’t stop in times when students aren’t able to access teachers and educational resources in person. Read our whitepaper on Secure remote learning in education to find out more. You can also visit our education protection page to find solutions that help secure educational institutes.
Jul
It has never been a better time to make the switch to Intercept X.
Recently we launched enhanced endpoint detection and response (EDR) capabilities that give users the power to ask detailed threat hunting and IT operations questions and quickly get the answers they need. That’s in addition to other new features such as Antimalware Scan Interface (AMSI) technology, which excels at detecting malicious obfuscated scripts (e.g. PowerShell) and Intrusion Prevention System functionality that stops network-based attacks (currently in early access).
But those aren’t the only benefits of making the move to Intercept X and Sophos Central, our cloud-based management platform. Here are five reasons to consider moving:
1. Get advanced protection to stop the latest threats
Intercept X excels at blocking the very latest threats such as ransomware, script-based fileless attacks, malware that has never been seen before, and adversaries actively trying to compromise systems. Deep learning AI intelligence, anti-ransomware capabilities, and exploit mitigation techniques combine to provide this unmatched level of security.
2. Make management straightforward
Intercept X is managed via the cloud-based Sophos Central console, which lets you manage all of your Sophos solutions in one place, at any time, from anywhere. Everything is managed from a single console with the same intuitive look and feel, so it’s easy to switch between products and enable powerful cross-product features.
3. Spend less and save time
With cloud management there’s no need to maintain physical on-premises servers and you get access to a single management console, cutting down on admin time.
4. Implement security that grows with you
Sophos Central makes it easy to extend your protection as your business grows. Want to try out the powerful new EDR functionality that helps you track down unwanted applications or users that clicked on a phishing email across your entire estate? Start a trial with the click of a button.
5. Benefit from smarter, faster protection
Sophos products are engineered from the ground up to work better together. For example, Intercept X and XG Firewall work in tandem to isolate a compromised device, clean it up, and restore network access with no admin intervention – in a matter of seconds.
Even if you aren’t yet on Sophos Central, trying out Intercept X couldn’t be easier. You can either start a no-obligation trial or take a look at the online demo to get a feel for the interface and powerful functionality on offer.
Jul
NSS, an international Value Added Distributor of leading edge IT solutions, announces today its partnership with BeyondTrust, the worldwide leader in Privileged Access Management and Secure Remote Access. NSS will distribute the most seamless solutions to prevent data breaches related to credential theft, misuse of privileges and breach of remote access in the markets of Greece, Cyprus and Malta as well as in the other Balkan countries. Being an international distributor of cybersecurity solutions in this region, NSS is in a strategic position regarding the distribution of the entire Privileged Access Management (PAM) suite of tools offered by BeyondTrust.
BeyondTrust’s Privileged Access Management portfolio is a comprehensive solution providing visibility and control capabilities to all privileged accounts and users. By integrating a wide range of privileged access security features, the platform simplifies implementation, reduces the risks associated with privileged credentials, reduces costs and significantly improves usability.
“As our strategic partner, NSS will be able to exploit BeyondTrust’s Universal Privilege Management model, a modern approach that addresses the entire universe of privileges across organizations said Alexis Serrano, Director – Channel & Alliances EMEIA of BeyondTrust. “Combining the know-how and in-depth knowledge of NSS in the regional market and its extensive network of partners, along with BeyondTrust’s best solutions, this partnership will help businesses and organizations improve their security strategies and operational resilience”, added Alexis Serrano, Director EMEIA Channels & Alliances.
“As a leader in Privileged Access Management (PAM) with numerous certifications and international distinctions from analysts such as Gartner, in NSS, we are thrilled to offer BeyondTrust’s solutions in the markets of the Balkan Region”, said George F. Kapaniris, NSS Executive Director. “BeyondTrust’s comprehensive PAM solution will allow us to lead our customers through a secure path helping them deal with critical vulnerabilities and immediately shrink the attack surface on their infrastructure”.
The flexible and expandable BeyondTrust platform allows organizations to easily maximize the security of privileges as the threats evolve into endpoint environments, server, cloud, DevOps and network devices. BeyondTrust’s platform integrates the broader range of privileged access capabilities with central management, reports and analytical reports, allowing administrators and security managers to take decisive and informed action and make decisions to successfully deal with attackers. The holistic approach platform stands out for its flexible design that simplifies consolidation, improves user productivity and maximizes IT and security investment.
BeyondTrust gives organizations the visibility and control they need to reduce risk, meet compliance goals and enhance business performance. NSS will expand its product portfolio by offering the innovative Universal Privilege Management approach solutions from BeyondTrust. This partnership will allow NSS to provide a customized PAM solution that meets the unique requirements of each customer. Find out more on https://www.nss.gr.