News
Aug
As cybercriminals continue to take advantage of the public cloud in their attacks, Sophos commissioned an independent survey of 3,521 IT managers across 26 countries* to reveal the reality of cloud security in 2020.
The 2020 cloud security reality
The survey provides fresh new insight into the cybersecurity experiences of organizations using the public cloud, including:
- Almost three-quarters of organizations hosting data or workloads in the public cloud experienced a security incident in the last year. Seventy percent of organizations reported they were hit by malware, ransomware, data theft, account compromise attempts, or cryptojacking in the last year.
- Data loss/leakage is the number one concern for organizations. Data loss and leakage topped our list as the biggest security concern, with 44% of organizations seeing data loss as one of their top three focus areas.
- Ninety-six percent of organizations are concerned about their current level of cloud security. Data loss, detection and response, and multi-cloud management top the list of the biggest concerns among organizations.
- Multi-cloud organizations reported more security incidents in the last 12 months. Seventy-three percent of the organizations surveyed were using two or more public cloud providers and reported more security incidents as those using a single platform.
- European organizations may have the General Data Protection Regulation (GDPR) to thank for the lowest attack rates of all regions. The GDPR guidelines’ focus on data protection, and well-publicized ransomware attacks have likely led to these lucrative targets becoming harder for cybercriminals to compromise in Europe.
- Only one in four organizations see lack of staff expertise as a top concern despite the number of cyberattacks reported in the survey. When it comes to hardening security postures in the cloud, the skills needed to create good designs, develop clear use cases, and leverage third-party services for platform tools are crucial but underappreciated.
- Two-thirds of organizations leave back doors open to attackers. Security gaps in misconfigurations were exploited in 66% of attacks, while 33% of attacks used stolen credentials to get into cloud provider accounts.
For the details behind these headlines, and to see how your country stacks up, read The State of Cloud Security 2020 report.
Secure the cloud with Sophos
However you’re using the public cloud, Sophos can help you keep it secure.
- Secure all your cloud resources. Get a complete inventory of multi-cloud environments (virtual machines, storage, containers, IAM Users etc.). Reveal insecure deployments, suspicious access, and sudden spikes in cloud spend. Learn more
- Secure your cloud workloads. Protect virtual machines, the virtual desktops running on those machines from the latest threats, including ransomware, fileless attacks, and server-specific malware. Learn more
- Protect the network edge. Secure inbound and outbound traffic to your virtual network, virtual desktop environments, and provides secure remote access to private applications running in the cloud. Learn more
For more information and to discuss your cloud security needs, request a call back from one of security experts.
* Australia, Belgium, Brazil, Canada, China, Colombia, Czech Republic, France, Germany, India, Italy, Japan, Malaysia, Mexico, Netherlands, Nigeria, Philippines, Poland, Singapore, South Africa, Spain, Sweden, Turkey, UAE, United Kingdom, United States
Aug
ProLock ransomware emerged on the threat scene in March, a retooled and rebranded version of PwndLocker.
As SophosLabs reveals in its detailed analysis, while ProLock ransomware gives you the first eight kilobytes of decryption for free, it can still cause significant business disruption and economic damage.
Protect against ProLock with Sophos Intercept X
Intercept X gives you multiple layers of protection against ProLock, keeping the data on your endpoints and servers safe:
- CryptoGuard identifies and rolls back the unauthorized encryption of files. In fact, Sophos first detected ProLock when CryptoGuard caught it on a customer network
- Deep learning identifies and blocks ProLock without signatures
- Signatures block variants of ProLock either as Troj/Agent-BEKP or Malware/Generic-S
If you’re running Sophos Intercept X you can relax knowing that you are automatically protected against ProLock, as all three of the above features are enabled by default in our recommended settings.
(If you’re not yet running Intercept X and want to give it a try, visit the web page to learn more and start a no-obligation free trial.)
To check that you have CryptoGuard and Deep Learning enabled:
- Open your Sophos Central Admin console and select Endpoint Protection in the left-hand menu
- Select Policies
- Review the list of threat protection policies already created
- Toggle the buttons to make any necessary changes
Endpoint protection and firewall best practices to block ransomware
51% of IT managers surveyed for our recent State of Ransomware 2020 report said their organization was hit by ransomware last year, and that cybercriminals succeeded in encrypting data in 73% of incidents.
With stats like these it’s worth taking the time to ensure all your ransomware defenses are up-to-date.
The earliest detection of ProLock by Sophos was traced to a compromised server, most likely through an exploit of a Remote Desktop Protocol (RDP).
Putting RDP access behind a virtual private network and using multi-factor authentication for remote access are just a couple of the best practices we recommend to reduce your ransomware risk.
For additional best practices, take a look at our guides Endpoint Protection Best Practices to Block Ransomware and Firewall Best Practices to Block Ransomware.
Aug
We are excited to announce that Intercept X for Server Advanced with EDR has been enhanced with powerful cloud visibility features from Cloud Optix.
In addition to even more detail on your AWS, Azure, and GCP cloud workloads, this integration gives customers critical insights into their wider cloud environments, including security groups, hosts, shared storage, databases, serverless, containers, and more.
See your complete cloud environment
The dynamic nature of cloud environments – with assets being spun up and down as and when necessary to meet changing demands – can make security and compliance assessments time-consuming. In many cases, you’ll need to log into multiple consoles and manually collate information to get a full picture.
With Sophos, it’s easy. You get details about your entire cloud infrastructure across different public cloud providers on one screen, in a single management console. You can dive directly into assets to get more detail about your asset inventory and cloud security posture.
Secure your complete cloud environment
Automated scans will detect any insecure deployments, with guided recommendations about how to fix potential issues. Additionally, guardrails can be deployed to lock down configurations, ensuring that they can’t be accidentally or maliciously tampered with and left in an unsafe state.
Artificial intelligence tracks normal behavior patterns, looking for any suspicious activity such as anomalous traffic patterns or unusual login attempts to cloud accounts. Issues are then flagged and prioritized by risk level if they require manual intervention.
Here’s the full list of what’s available:
- Cloud asset inventory – see a detailed inventory of your entire cloud infrastructure (e.g. cloud hosts, serverless functions, S3 buckets, databases, and cloud workloads), eliminating the need for time-consuming manual collation
- Access and traffic anomaly detection – unusual login attempts and suspicious traffic patterns are automatically detected and blocked or flagged to the admin as appropriate
- Security scans – daily and on-demand scans monitor your cloud environment to ensure its on-going security. Issues are automatically resolved where possible, with admin notification if manual intervention is required
- Configuration guardrails – stop accidental or malicious tampering with configurations that could negatively impact security posture
- Compliance policies – ensure that your cloud environment conforms to Center for Internet Security (CIS) best practices, helping keep your security posture at its best
- Alert management integrations – receive email notifications when manual intervention is required
Powerful visibility and protection for every setup
This exciting new cloud functionality is available to all Intercept X Advanced for Server with EDR customers at no additional cost. Log into your Sophos Central console, select Cloud Optix, and you can get started right away.
Current customers using Sophos Central that would like to try out this new functionality – in addition to the recently released EDR IT operations and threat hunting capabilities – can start a trial from within the Sophos Central console.
If you don’t have a Sophos Central account, you can register for a trial on Sophos.com.
Intercept X Advanced for Server with EDR and Intercept X Advanced with EDR give organizations unparalleled visibility and protection across their cloud, on-premises, and virtual estates. Cloud Optix shines a spotlight on complete cloud environments, showing what’s there, what needs securing, and making sure that everything stays safe and secure.
Aug
Most privileged access management solutions just focus on passwords. BeyondTrust is different. Our innovative Universal Privilege Management approach to cyber security secures every user, asset, and session across your enterprise. Deployed as SaaS or on-premises, BeyondTrust’s Universal Privilege Management approach simplifies deployments, reduces costs, improves usability, and reduces privilege risks.
Go Beyond Passwords
Passwords are important. That’s why you can audit and manage every privileged account with BeyondTrust. This includes everything from privileged user passwords, app-to-app credentials, service accounts, DevOps secrets, and more.
But passwords are just the beginning. The BeyondTrust platform integrates privileged password security with endpoint and remote access security, drastically reducing your attack surface and windows of exposure. This is Universal Privilege Management.
Productivity, Not Friction
Privileged users handle critical tasks that keep your business running. The last thing you want to do is slow down legitimate business activity with annoying security measures.
BeyondTrust is non-intrusive to users. Our software helps power some of the most efficient organizations on the planet. Centralized reporting and management, integrations with your existing systems, and automated privilege management enable security that’s virtually invisible to users.
Accelerated Time to Value
Our customers get more than software. They get 30+ years of accumulated security expertise and best practices productized in software form.
Built-in templates and workflows let you see value on day one. Flexible deployment options, including cloud deployments and virtual appliances, let you start right away. Our customers report fast user adoption, which rapidly reduces your risk.
The BeyondTrust Advantage
BeyondTrust serves more organizations than any other Privileged Access Management vendor. More than 20,000 customers, including 70% of the Fortune 500, trust us to improve cyber security and efficiency. We’ve helped more customers deploy in the cloud than anyone else. And customers rate our support organization with 96% satisfaction.
Jul
Increased remote working makes it more important than ever to secure computers and the data on them. With the huge number of laptops that are lost, misplaced, or stolen every day, a crucial first line of defense for devices is full-disk encryption.
With full disk encryption rolled out, admins can ensure sensitive company data can’t be accessed, even if a device falls into the wrong hands. And while disk encryption has long been a vital component of device security, it has also frequently been associated with complexity and admin overhead. Setting up and maintaining servers, dealing with encryption keys, and helping users who’ve forgotten their credentials all takes time and effort.
Hassle-free encryption
With Sophos Central Device Encryption, we focus on making device encryption intuitive and hassle-free. There’s no server to install, and encryption is enabled in a handful of clicks. Sophos Central Device Encryption uses the same core agent as Intercept X, meaning existing Sophos customers have no additional agent to deploy and can start encrypting computers in mere minutes.
Under the hood, we leverage Windows BitLocker and macOS FileVault technology to do the heavy lifting when it comes to encrypting and decrypting data on the disk. With these technologies being integrated deeply into each operating system, performance and security is first-class.
Demonstrate compliance
As a part of compliance requirements, companies often need to verify which computers in the organization are encrypted. The cloud-based Sophos Central Admin console provides great visibility into device status, including which disks are encrypted and the last time a device checked in. The next version of Central Device Encryption adds a new Encryption Status report, further drilling down into device encryption status, making it even easier to help demonstrate compliance across the organization.
Fast recovery
An important consideration with disk encryption is how users will regain access to their devices if they forget their credentials. The Sophos Central Self-Service Portal lets users retrieve their own recovery keys without needing to contact the IT helpdesk. Users get back up and running faster, and IT teams have fewer tickets to deal with.
Sophos Central Device Encryption
The shift towards remote working makes full disk encryption more important than ever. Sophos Central Device Encryption makes it a breeze to deploy and manage devices with full disk encryption. Head over to Sophos.com to find out more and to sign up for a free trial.
Jul
Work from home (WFH) and remote access have accelerated the digital transformation journey, and IT’s move to the cloud. Security programs must address visibility, continuous monitoring, and a unified identity and privilege model for the multicloud environment. Privileged access management solutions are a key enabler for the cloud security strategy because they can protect core enterprise assets from increased vulnerability from the home offices at the edge to significantly reduce attacker’s ability to exploit configuration, credential, or privilege management errors.
Rope Burns & IT Security
Thinking back on those school gym classes, remember rope climbing? Or maybe swinging on a rope? Then you’ll know: ropes can be slippery, and your hands can get burned.
As businesses enabling digital transformation via accelerated cloud adoption, avoiding IT security breaches or outages (the digital equivalent of rope burns) is always a top concern. These negative outcomes can rear their heads amidst an atmosphere of too much uncontrolled change, happening too fast, to the operating environment.
A New Cloud Security Strategy
Accelerated digital transformation means accelerated cloud adoption. All those users that used to be in the office? Now they’re in the cloud. Services and applications? They too are moving to the cloud. A quick review of the Cloud Security Alliance’s top threats shows we have our work cut for us to secure cloud use.
What’s interesting about the CSA’s “Egregious 11” threats, is that many of them – such as misconfiguration, weak control plane, poor visibility, and lack of architecture, are customer-side failings. Earlier this month, I wrote about the need for Cleaning up Risk and Technical Debt spawned from ungoverned cloud adoption
The broad scope of these threats and their root cause in technical debt makes it quite clear: virtually all businesses need a new, or refreshed, cloud security strategy.
Multiple Failures to Protect Privileged Access
How were Jeff Bezos, Elon Musk, Bill Gates, and so many other IT-savvy luminaries’ Twitter accounts recently hacked and used to solicit bitcoin payments? An article from the Verge suggests that attackers “either found a severe security loophole in Twitter’s login or account recovery process or…somehow gained access to a Twitter employee’s admin privileges.”
The Twitter breach is just our latest object lesson about the importance of closing privileged attack vectors. Consider that multiple studies show Credential Misuse being the #1 cause of breaches. Behind any credential breach is an access (or privileged access) management failure. This is true because the typical user should not have access to the “crown jewels” and privileged accounts with more than the usual access should be very difficult for hackers to obtain.
Gaps in Cloud PAM
As IT’s center of gravity shifted, PAM systems have needed to evolve. Amidst the forced digitalization of the pandemic, these architectural deficiencies are no longer just limiting or annoying, they’re downright dangerous. We commonly see the following gaps in that older PAM systems have:
- Limited integration with cloud service provider (CSP) native identity frameworks or APIs
- Poor visibility into cloud environments
- Heavy server-side agent software in the infrastructure-as-a-service (IaaS) environment
- Static, or always-on, privileged accounts (also called accounts with standing privileges)
Let’s focus on the last of these gaps, to make sure everyone understands the need for…
Just-in-Time (JIT) PAM
Traditionally, privileged access is granted through a combination of static accounts and roles. For example, the powerful Active Directory domain administrator role is conferred on static accounts with a Domain Administrator group membership. As shown in the below figure’s topmost process flow, static accounts can be provisioned through identity and access management (IAM) system, or created manually. The traditional PAM system inventories the accounts that are privileged, manages access to them, and performs credential rotation.
Always-on (standing) privileges versus just-in-time (JIT) privileged access
The trouble is that always-on, static accounts can become targets of opportunity. They are one of the first things advanced attackers look for as they move laterally through the victim infrastructure.
Fortunately, CSPs have provided a better way to manage privileged access. That is to bind the privileged roles to accounts only temporarily, after a request is approved. As shown in the bottom most process flow in the figure, the IAM (or PAM) system can process valid access requests and dynamically bind privileged roles to the requesting user’s account by calling an API such as the Amazon Web Service (AWS) AssumeRole. The privileged access soon expires, or is removed, reducing the attack surface available to any bad actors in the IT environment.
We need to achieve a paradigm shift from static to dynamic access grants – to just-in time privileged access management (JIT PAM).
Critical Capabilities for Cloud Privileged Access Management (PAM)
To effectively secure privileged access, credentials, and sessions across cloud environments, PAM systems need to have many of the traditional PAM features such as credential vault, credential rotation, session broker, session recording, privileged user auditing, service account support, and high availability) plus what’s below:
- Unified browser-based administration and remote session protocol support
- Authentication and authorization agility for multiple use cases, third parties, cloud environments
- Integration with cloud-native access systems
- Just-in-time access grant support
Enabling Productive & Secure Work-From-Home & Remote Access
Work from home and remote access have accelerated the digital transformation, and IT’s move to the cloud. Security programs must address visibility, continuous monitoring, and a unified identity and privilege model for the multicloud environment. PAM systems are a key enabler for the cloud security strategy because they can protect core enterprise assets from increased vulnerability from the home offices at the edge to significantly reduce attacker’s ability to exploit configuration, credential, or privilege management errors.
To learn more on updating your cloud security strategy to address the “new normal”, check out my on-demand webinar.
Jul
Analysis of public cloud accounts across Amazon Web Services, Microsoft Azure, and Google Cloud Platform reveals a silver lining when it comes to the protection of cloud data.
New research shows that in the last year, 70% of organizations that use public cloud services experienced a security incident. These incidents included attacks from ransomware and other malware (50%), exposed data (29%), compromised accounts (25%), and cryptojacking (17%).
Ninety-six percent of these organizations are concerned about their current levels of cloud security, with data security being the top concern for 44% of them. It’s a good time to address the fundamentals of cloud security best practices: access to cloud environments and the protection of sensitive data.
Secure who gets in
Identity security represents a huge challenge for organizations. A review of cloud accounts by the Sophos Cloud Optix cloud security posture management service discovered worrying trends in organizations’ security posture as it relates to cloud account access, with 91% of organizations having over-privileged Identity and Access Management roles and 98% without MFA enabled on their cloud provider accounts.
Managing access to cloud accounts is an enormous challenge and yet only a quarter of organizations in our research saw it as a top area for concern, while a third reported that cybercriminals gained access by stealing cloud provider account credentials
Why securing access matters
Granting extensive access permissions to IAM users, groups, and cloud services is a risky practice. If such credentials get compromised, cybercriminals may gain access to any services and data those permissions grant. All user accounts should have MFA enabled, as it adds an extra layer of protection on top of usernames and passwords.
Secure what can get out
You won’t have to look far to find stories of shared storage-related data breaches caused by misconfiguration, where security settings with public read/list permissions had been enabled. AWS has even released an update to help customers from running afoul of this – one of the biggest causes of cloud data breaches. In our review of cloud accounts, we discovered that accidental data exposure through misconfigured storage services continues to plague organizations, with 60% leaving information unencrypted. Organizations are making it easy for attackers to search for and identify new targets.
The silver lining in all this is that the number of organizations exposing data to the public internet is declining, with Sophos Cloud Optix identifying that only 13% of organizations left database ports open to the internet and 18% of organizations had storage services with public read/list permissions enabled. Assuming there will always be use cases for public access being available, organizations are starting to close the door on this, the most common attack method for obtaining sensitive company and customer data.
Why secure configurations matter
Encryption is critical when it comes to stopping cybercriminals from seeing and reading stored information, and is a requirement for many compliance and security best-practice standards. “Public mode” – a setting that can be applied to databases, shared storage, and other cloud provider services – is a major cause of data breaches, and misconfiguring cloud services in “public mode” allows cybercriminals to automate their searches for security weak points. Guardrails should be in place to prevent such misconfigurations.
Think you know what you’ve got in the cloud?
Take control of your cloud security with a free inventory assessment and security check powered by Sophos Cloud Optix. Activate a free trial to get to get 30 days of commitment-free usage, including:
- Comprehensive inventory of everything you’ve got in the cloud: virtual machines, storage, containers, IAM roles, etc.
- Visualize IAM roles like never before and stop over-privileged access roles and stolen credentials from being exploited in cyberattacks
- Harden Amazon Web Services, Microsoft Azure, Google Cloud Platform, Kubernetes clusters, and Infrastructure-as-Code environments to reduce your surface area for attack
- Automatically detect security and compliance vulnerabilities, suspicious access, network traffic and cloud spend anomalies
- No agent, no install, no tie-in
Once you have a Cloud Optix account set up, follow the step-by-step instructions on the screen, which will walk you through adding your AWS, Azure, and GCP environments. For more information, read the Getting Started guide.
Should you need help at any point, check out the community forum or reach out to our technical support team.
Jul
In a cloud-first world, the traditional line between network security and application security is becoming blurred. Physical IT infrastructure can now be hidden behind layers of virtualization, and web applications are frequently designed, developed, tested, and deployed entirely in the cloud. At the same time, web applications have become the main target of cyberattacks and now account for 3 out of 4 data breaches worldwide. Web application security has never been more important – and yet there is still some confusion as to its place in the overall security posture. Established organizations often have mature network security programs, while web application security tends to receive far less attention and funding.
As companies continue to shift data and business logic onto cloud platforms and become reliant on web technologies to do business, information security has become a top priority. Business data, intellectual property (IP), and other sensitive information are now prized commodities, so cybercriminals are increasingly focusing their attacks on web applications to extract this data. This means that traditional network perimeter defense with firewalls to filter network traffic is no longer enough to ensure data security and proper access control. If exploited successfully, web application vulnerabilities can not only allow unauthorized access to sensitive data but also provide a foothold to mount denial-of-service attacks or even serve malware to website visitors.
Modern web assets include not only websites and web applications but also web services and application programming interfaces (APIs) that are used to exchange data between systems and provide the back-end for countless mobile applications. In a large organization, there can be thousands of different web assets spread across multiple systems and geographies. At this scale and level of complexity, protecting them all from cyberthreats is only possible with dedicated web application security solutions that deliver accurate and actionable results, such as modern dynamic application security testing (DAST) products.
Our white paper Web Application Security or Network Security – Do You Have to Choose? examines the history of web security and analyzes current trends to set the record straight on the role of web application security and network security in any mature cybersecurity program.
Download the PDF version of our white paper: Web Application Security or Network Security – Do You Have to Choose?
Jul
The ongoing pandemic is resulting in a crisis for schools, colleges, and universities the world over. With physical buildings closed, most educational institutes are moving to emergency remote learning and working.
For most of them, the transition from physical to online models has happened too quickly. Without proper time to vet potential risks, their networks are exposed thanks to the deployment of new technologies and apps. Furthermore, risks can also run high because students and educators aren’t always properly trained to use the new tech.
Further complicating matters, many educational institutes simply don’t have the budgets to overhaul their technology solutions in the face of such an unprecedented and unanticipated pandemic. As a result, some institutes are lured by free tools and apps for online learning, most of which come laden with inadequate privacy controls, user tracking, inappropriate promotional content, and sometimes malware – all of which elevates the risk of not complying with regulatory mandates like FERPA and others.
With remote learning becoming the new normal, cybercriminals are busy finding new ways to leverage techniques like phishing, ransomware, social engineering, and more to pull off attacks. Here’s a look at some of the most critical risks to be addressed in order to safeguard users and data.
1. Secure remote access
With distance learning taking over physical schooling, students and teachers need access to online learning tools mostly located in the cloud – file sharing applications, email, apps – and they sometimes need to remotely access resources on the school network. At the same time, administrative and IT staff working from home may need access to systems and documents located on the school network as well. If remote access isn’t secure, hackers can sneak in and take control of the entire network. Deploy a virtual private network (VPN) that offers secure remote access to your users and protects all data that flows in and out of the VPN by encrypting it.
Students and school staff may bring their own devices and connect them to the school network, some of which may be unpatched and running risky applications, giving easy access to attackers. To counter this, ensure only whitelisted apps run on the network and that only authorized devices can accessing the network. With complete application visibility and control, you can identify all the applications on your network – including shadow IT and data at risk. This allows you to control the apps and apply user-based application controls and traffic shaping. By synchronizing your firewall and endpoint security, you can instantly identify compromised endpoints, isolate them until they are cleaned, and prevent infections from spreading laterally to other devices on the network.
2. Control access to sensitive data
Educational institutes are treasure troves of valuable information that can be sold on the dark web. Personal data of students, teachers, alumni, and administrative staff, along with sensitive data relating to a school’s research and intellectual property can make a hacker very rich by selling it or ransoming it. It’s critical to enforce access based on user identity, allowing authorized users access to only what they need in order to do their jobs. You can protect sensitive data, research, and other critical resources by allowing access to only those who are authorized, with two-factor authentication (2FA) support for access to key system areas, including IPsec and SSL VPN, user portals, and web administration consoles.
3. Protect against malware
The shift to remote learning means many of the devices connecting to the school network are BYOD. It’s difficult to know whether the devices and applications used are updated with patches and if the antivirus is current. Unless such remote devices are connecting via a VPN, you’ll need to ensure they’re secure before they can access resources on the school’s network.
It’s important to deploy advanced web protection capabilities that can identify and block the latest web threats. This allows you to enforce web filtering rules to keep students safe from instances of cyberbullying, inappropriate content, abuse, and other online threats. And with staff working from home, peripheral controls allow you to control what your staff can and can’t plug into their corporate devices. This helps you safeguard your network against unexpected threats.
4. Protect against phishing
Social engineering and phishing attacks pose major IT security risks to schools. Students, teachers, or staff members who get manipulated to click on malicious links can provide cybercriminals access to the school’s network and precious resources. The best way to counter social engineering and phishing attacks is through user awareness and training. Educating and testing your users with simulated attacks helps you facilitate a positive security awareness culture and makes them less likely to fall for scams. Make sure your email security is up to date as well, and that you have advanced protection for all your endpoints so you can protect them against both known and unknown malware, ransomware, exploits, and viruses.
5. Secure mobile computing
Mobile devices like phones, tablets, and others are increasingly used today for remote learning. A single unprotected device increases the risk of compromising the entire school network and systems, especially at a time when schools have lowered the barriers to access their networks, specifically for students. With most devices connected to the internet, the attack surface is significantly amplified for schools. An effective mobile device security solution can help keep your students and staff safe on the internet, preventing risky file downloads and blocking access to inappropriate websites. Mobile antivirus and ransomware protection capabilities can safeguard your users and devices from malicious content and apps.
Sophos can help
Sophos’ unique IT security capabilities offer award-winning protection for schools of all sizes. You can ensure that learning doesn’t stop in times when students aren’t able to access teachers and educational resources in person. Read our whitepaper on Secure remote learning in education to find out more. You can also visit our education protection page to find solutions that help secure educational institutes.
Jul
It has never been a better time to make the switch to Intercept X.
Recently we launched enhanced endpoint detection and response (EDR) capabilities that give users the power to ask detailed threat hunting and IT operations questions and quickly get the answers they need. That’s in addition to other new features such as Antimalware Scan Interface (AMSI) technology, which excels at detecting malicious obfuscated scripts (e.g. PowerShell) and Intrusion Prevention System functionality that stops network-based attacks (currently in early access).
But those aren’t the only benefits of making the move to Intercept X and Sophos Central, our cloud-based management platform. Here are five reasons to consider moving:
1. Get advanced protection to stop the latest threats
Intercept X excels at blocking the very latest threats such as ransomware, script-based fileless attacks, malware that has never been seen before, and adversaries actively trying to compromise systems. Deep learning AI intelligence, anti-ransomware capabilities, and exploit mitigation techniques combine to provide this unmatched level of security.
2. Make management straightforward
Intercept X is managed via the cloud-based Sophos Central console, which lets you manage all of your Sophos solutions in one place, at any time, from anywhere. Everything is managed from a single console with the same intuitive look and feel, so it’s easy to switch between products and enable powerful cross-product features.
3. Spend less and save time
With cloud management there’s no need to maintain physical on-premises servers and you get access to a single management console, cutting down on admin time.
4. Implement security that grows with you
Sophos Central makes it easy to extend your protection as your business grows. Want to try out the powerful new EDR functionality that helps you track down unwanted applications or users that clicked on a phishing email across your entire estate? Start a trial with the click of a button.
5. Benefit from smarter, faster protection
Sophos products are engineered from the ground up to work better together. For example, Intercept X and XG Firewall work in tandem to isolate a compromised device, clean it up, and restore network access with no admin intervention – in a matter of seconds.
Even if you aren’t yet on Sophos Central, trying out Intercept X couldn’t be easier. You can either start a no-obligation trial or take a look at the online demo to get a feel for the interface and powerful functionality on offer.
Jul
NSS, an international Value Added Distributor of leading edge IT solutions, announces today its partnership with BeyondTrust, the worldwide leader in Privileged Access Management and Secure Remote Access. NSS will distribute the most seamless solutions to prevent data breaches related to credential theft, misuse of privileges and breach of remote access in the markets of Greece, Cyprus and Malta as well as in the other Balkan countries. Being an international distributor of cybersecurity solutions in this region, NSS is in a strategic position regarding the distribution of the entire Privileged Access Management (PAM) suite of tools offered by BeyondTrust.
BeyondTrust’s Privileged Access Management portfolio is a comprehensive solution providing visibility and control capabilities to all privileged accounts and users. By integrating a wide range of privileged access security features, the platform simplifies implementation, reduces the risks associated with privileged credentials, reduces costs and significantly improves usability.
“As our strategic partner, NSS will be able to exploit BeyondTrust’s Universal Privilege Management model, a modern approach that addresses the entire universe of privileges across organizations said Alexis Serrano, Director – Channel & Alliances EMEIA of BeyondTrust. “Combining the know-how and in-depth knowledge of NSS in the regional market and its extensive network of partners, along with BeyondTrust’s best solutions, this partnership will help businesses and organizations improve their security strategies and operational resilience”, added Alexis Serrano, Director EMEIA Channels & Alliances.
“As a leader in Privileged Access Management (PAM) with numerous certifications and international distinctions from analysts such as Gartner, in NSS, we are thrilled to offer BeyondTrust’s solutions in the markets of the Balkan Region”, said George F. Kapaniris, NSS Executive Director. “BeyondTrust’s comprehensive PAM solution will allow us to lead our customers through a secure path helping them deal with critical vulnerabilities and immediately shrink the attack surface on their infrastructure”.
The flexible and expandable BeyondTrust platform allows organizations to easily maximize the security of privileges as the threats evolve into endpoint environments, server, cloud, DevOps and network devices. BeyondTrust’s platform integrates the broader range of privileged access capabilities with central management, reports and analytical reports, allowing administrators and security managers to take decisive and informed action and make decisions to successfully deal with attackers. The holistic approach platform stands out for its flexible design that simplifies consolidation, improves user productivity and maximizes IT and security investment.
BeyondTrust gives organizations the visibility and control they need to reduce risk, meet compliance goals and enhance business performance. NSS will expand its product portfolio by offering the innovative Universal Privilege Management approach solutions from BeyondTrust. This partnership will allow NSS to provide a customized PAM solution that meets the unique requirements of each customer. Find out more on https://www.nss.gr.
Jul
Η NSS, διεθνής διανομέας Value Added Distributor (VAD) λύσεων πληροφορικής υψηλής τεχνολογίας ανακοινώνει σήμερα τη συνεργασία της με την BeyondTrust, παγκόσμιο ηγέτη στη διαχείριση προνομιακής πρόσβασης (Privileged Access Management) και ασφαλούς απομακρυσμένης πρόσβασης (Secure Remote Access). Η NSS θα διανέμει στην Ελληνική και Κυπριακή αγορά, καθώς και στα Βαλκάνια και τη Μάλτα, την πιο απρόσκοπτη λύση για την αποτροπή παραβιάσεων δεδομένων που σχετίζονται με κλοπή διαπιστευτηρίων, κακή χρήση προνομίων και παραβίαση της απομακρυσμένης πρόσβασης. Ως διεθνής διανομέας λύσεων ασφάλειας στον κυβερνοχώρο στην περιοχή, η NSS βρίσκεται σε στρατηγική θέση για να διανέμει στην αγορά την πλήρη σουίτα εργαλείων Privileged Access Management (PAM) της BeyondTrust.
Το χαρτοφυλάκιο Privileged Access Management της BeyondTrust αποτελεί μια ολοκληρωμένη λύση που παρέχει ορατότητα και δυνατότητες ελέγχου σε όλους τους προνομιακούς λογαριασμούς αλλά και τους προνομιακούς χρήστες. Ενοποιώντας ένα ευρύτατο σύνολο δυνατοτήτων ασφάλειας προνομιακής πρόσβασης, η πλατφόρμα απλοποιεί τις υλοποιήσεις, μειώνει τους κινδύνους που σχετίζονται με τα προνομιακά διαπιστευτήρια, μειώνει τα κόστη και βελτιώνει σημαντικά τη χρηστικότητα.
«Ως στρατηγικός συνεργάτης μας, η NSS θα είναι σε θέση να εκμεταλλευτεί το μοντέλο Universal Privilege Management της BeyondTrust, μια σύγχρονη προσέγγιση που αντιμετωπίζει το σύνολο προνομίων σε έναν οργανισμό», δήλωσε ο Alexis Serrano, Director – Channel & Alliances EMEIA της BeyondTrust. «Συνδυάζοντας την τεχνογνωσία και τη βαθειά γνώση της αγοράς που διαθέτει η NSS στην περιοχή αλλά και το εκτεταμένο δίκτυο συνεργατών της, με τις καλύτερες λύσεις της BeyondTrust, αυτή η συνεργασία θα βοηθήσει τις επιχειρήσεις και τους οργανισμούς να βελτιώσουν τις στρατηγικές ασφάλειας και την επιχειρησιακή τους αντοχή», συμπληρώνει ο κος Alexis Serrano, Director – Channel & Alliances EMEIA της BeyondTrust.
«Ως ηγέτης στη διαχείριση της προνομιακής πρόσβασης (PAM) με πολλές περγαμηνές και διεθνείς διακρίσεις από αναλυτές όπως η Gartner, στην NSS, είμαστε ενθουσιασμένοι που φέρνουμε τις λύσεις της BeyondTrust στην ευρύτερη αγορά της Ελλάδος, της Κύπρου, των Βαλκανίων αλλά και της Μάλτας», δήλωσε ο Γιώργος Καπανίρης, Εκτελεστικός Διευθυντής της NSS. «Η ολοκληρωμένη λύση PAM της BeyondTrust θα μας επιτρέψει να καθοδηγήσουμε τους πελάτες μας σε ένα ταξίδι που τους επιτρέπει να αντιμετωπίσουν κρίσιμα τρωτά σημεία και να αρχίσουν αμέσως να συρρικνώνουν την επιφάνεια επίθεσης στις υποδομές τους».
Η ευέλικτη και επεκτάσιμη πλατφόρμα της BeyondTrust, δίνει τη δυνατότητα στους οργανισμούς να κλιμακώσουν εύκολα την ασφάλεια προνομίων καθώς οι απειλές εξελίσσονται σε περιβάλλοντα τελικού σημείου, διακομιστή, cloud, DevOps αλλά και συσκευών δικτύου. Η πλατφόρμα της BeyondTrust ενοποιεί την ευρύτερη σειρά προνομιακών δυνατοτήτων πρόσβασης με κεντρική διαχείριση, αναφορές και αναλυτικές αναφορές, επιτρέποντας στους διαχειριστές, αλλά και στους επικεφαλείς ασφάλειας να λάβουν αποφασιστικές και ενημερωμένες ενέργειες και αποφάσεις για να αντιμετωπίσουν τους επιτιθέμενους. Η ολιστικής προσέγγισης πλατφόρμα ξεχωρίζει για τον ευέλικτο σχεδιασμό της που απλοποιεί τις ενοποιήσεις, βελτιώνει την παραγωγικότητα των χρηστών και μεγιστοποιεί τις επενδύσεις πληροφορικής και ασφάλειας.
Η BeyondTrust δίνει στους οργανισμούς την ορατότητα και τον έλεγχο που χρειάζονται για τη μείωση του κινδύνου, την επίτευξη των στόχων συμμόρφωσης και την ενίσχυση της επιχειρησιακής απόδοσης. Η NSS θα αξιοποιήσει τις καινοτόμες λύσεις συνολικού ελέγχου προνομιακής πρόσβασης της BeyondTrust για να συμπληρώσει τις λύσεις τεχνολογίας που προσφέρει ήδη στην ευρύτερη περιοχή όπου δραστηριοποιείται. Αυτή η συνεργασία θα επιτρέψει στην NSS να παρέχει μια προσαρμοσμένη λύση PAM που να ανταποκρίνεται στις μοναδικές απαιτήσεις κάθε πελάτη της. Μάθετε περισσότερα στην ιστοσελίδα της NSS https://www.nss.gr.
Jul
Managing IT security takes a lot of time. Well, 26% of an IT team’s time to be precise, based on feedback from the 3,100 IT managers we surveyed last year.
With time an increasingly precious commodity, the good news for XG Firewall users is that you can double the efficiency of your security team while also increasing your protection. How? By running Intercept X with EDR as your endpoint protection.
Double the efficiency of your IT team
Like XG Firewall, Intercept X is part of the Sophos cybersecurity system, and you can manage both solutions through the Sophos Central platform.
This eliminates the need to jump from console to console to see what’s going on. No more struggling to track data across platforms. Instead you have a single security console with consolidated alerts visible from the dashboard.
The Sophos Central Dashboard consolidates alerts across all products for instant visibility.
XG Firewall and Intercept X also share threat, health and user data, enabling you to quickly investigate any incidents that do occur.
When the firewall shows you the device name rather than just the IP address life becomes significantly easier.
See the name as well as the IP address of affected devices
In fact, customers tell us they’ve seen day-to-day security admin fall by 90% since they started running XG Firewall and Intercept X together, managed through Sophos Central.
Elevate your protection
Intercept X with EDR lets you elevate your protection by combining market-leading technologies with the ability to identify the root causes behind security and IT operations incidents.
Like your XG Firewall, Intercept X is powered by Sophos’ deep learning engine. It also gives you the most comprehensive exploit and ransomware protection on the market.
In addition, the new EDR capabilities enable you to see what’s really going on across your environment.
Fully-customizable queries quickly give you the answers to questions such as:
- Why is a device running slowly?
- Are machines pending a re-boot?
- Where is RDP enabled?
- Are any programs trying to connect with a non-standard port?
Armed with this information you can stop potential incidents before they occur, and address underlying issues.
Try for yourself
If you’re managing your XG Firewall through Sophos Central you can start a no-obligation free trial of Intercept X with EDR in just three clicks.
Simply scroll to the Free Trials link in the main left-hand navigation and follow the instructions.
If you’re not yet using Sophos Central, start a trial via our website. You’ll be up and running in a matter of minutes.
Hear from customers
To learn more about the benefits of running XG Firewall and Intercept X, read the Sophos Business Impact report.
It shares the experiences of five customers across North America, Europe, and Asia, quantifying the impact on their team and their organization.
Jul
Think you know what you’ve got in the cloud? Think again.
The accessibility of the public cloud is a double-edged sword: while it enables teams to spin up new resources in minutes, it also makes it hard for IT teams to keep track of everything that needs to be secured.
Take control of your cloud security with a free inventory assessment and security check, powered by Sophos Cloud Optix. Activate a free trial to get to get 30 days commitment-free usage:
- Comprehensive inventory of everything you’ve got in the cloud: virtual machines, storage, containers, IAM Users etc.
- Covers Amazon Web Services, Microsoft Azure, Google Cloud Platform, Kubernetes clusters, and Infrastructure-as-Code environments
- Automatically scans for security gaps so you can address areas of weakness
- No agent, no install, no tie-in
Real-time security alerts, enabling you to take immediate action
Detect and prevent cloud security and compliance gaps
Cloud Optix is an agentless SaaS solution that integrates with your cloud infrastructure accounts using the native cloud provider APIs, logs, and cloud services.
It uses information from these sources to give you a detailed inventory of assets in your cloud accounts and provide an intuitive topological view of the environment’s architecture and traffic flows.
Inventory of all your resources
Topological view of your architecture and traffic flows
Cloud Optix also provides up-to-the-minute reports. These make it easy to stay in compliance with both regulatory requirements and internal security policies, including monitoring your daily spend.
Stay in compliance with real-time reports
Get up and running in minutes
Cloud Optix is managed through the Sophos Central security platform. There are two ways to activate your free usage period:
- Already using Sophos Central: Click on the Free Trials link at the bottom of the left-hand menu in your Central admin console.
- New to Sophos Central: Request a free trial via our website. Your trial will give you access to Cloud Optix as well as all the other security services available in Sophos Central (endpoint protection, server protection etc.).
Next, follow the on-screen step-by-step instructions that will walk you through adding your AWS, Azure and GCP environments. For more information, read the Getting Started guide.
Should you need help at any point, check out the community forum or reach out to our technical support team.
What happens when the trial period is over?
If you wish to continue using Cloud Optix at the end of the free usage period, simply purchase a subscription. Otherwise, you can just stop using the service. There’s no tie-in, no catch, no obligation.
Jun
XG Firewall v18 got off to a tremendous start with thousands of customers upgrading on launch day to take advantage of the new Xstream Architecture and other great enhancements.
Today, the product team is pleased to announce a new release of XG Firewall v18, maintenance release 1 (MR1), that is now available for all XG Firewall devices.
This latest release includes all security hotfixes as well as over fifty performance, reliability and stability enhancements and support for our new SD-RED devices.
Upgrading to v18 MR1 is seamless from v17.5 MR6 and above and from any other v18 release version. You will soon start seeing the new release appear in your console with a firmware upgrade notification, but you don’t need to wait, you can grab the new release anytime from the MySophos Licensing Portal: Upgrade Today!
What’s new and in it for you
Watch this brief 5-minute overview of what’s new in XG Firewall v18:
Here are the top new enhancements:
- Xstream Architecture: A new streaming DPI engine, high-performance TLS 1.3 inspection, AI-powered threat intelligence with in-depth reporting, and FastPath application acceleration.
- Sophos Central: Group firewall management and cloud reporting make management easier and provide deeper insights into network activity with flexible report customization tools and a new license for extending your firewall data storage in the cloud.
- Synchronized SD-WAN: brings the power of Synchronized Security to reliably and accurately route application and user-based traffic over preferred WAN links.
- Plug-and-Play High Availability (HA): makes it easy to enable business continuity and adds peace-of-mind – simply connect two XG Series appliances together and you’ll be up and running in no time and now Sophos Central also supports HA pairs.
- Real-time flow monitoring: Get at-a-glance insights into active bandwidth consuming hosts, applications, and users – a fan favorite feature from our UTM 9 platform.
- Expanded notifications and alerts: You will never miss an important network security event whether it’s related to a threat, service, or important performance metric.
- New SD-RED Model Support: With MR1, take advantage of our all-new SD-RED 20 and SD-RED 60 models that provide added performance, modular connectivity, and redundant power for the ultimate solution to remote branch or device connectivity.
Upgrading XG Firewall firmware is easy. Watch this video for a refresher.
Start enjoying the benefits of added visibility, protection and performance with XG Firewall v18 MR1 today!
Migrating from SG UTM
Sophos SG UTM customers interested in taking advantage of all the great new enhancements in XG Firewall can do so for free – anytime. A valid license can be transferred over at no extra charge and Sophos Professional Services is happy to help with migration if desired. Existing SG Series hardware is fully supported (except for the SG 105 which lacks the minimum required 4 GB of RAM). However, you may want to take this opportunity to consider refreshing your hardware to take full advantage of all the new capabilities such as TLS inspection. Check out this recent article for full details.
Migrating from Cyberoam
Migrating from Cyberoam to XG Firewall v18 is strongly encouraged to get all the added usability, security and performance benefits of XG Firewall. Contact your preferred Sophos partner to inquire about upgrading to the latest high-performance XG Series appliance hardware.
New to XG Firewall
If you’re new to XG Firewall, see why it offers the world’s best visibility, protection and response.
Jun
At the start of the year the Ponemon Institute launched the 2020 Cost of Insider Threats Global Report. The report highlighted the number of cybersecurity incidents caused by insiders increased by a whopping 47% since 2018. This meant the average annual cost of insider threats had also skyrocketed in only two years, rising 31% to £12.20 million.
Whilst the term “insider threat” can seem malicious, the report highlighted insider incidents are more likely to be caused by negligent employees or contractors. The report supported the trend by showcasing the root cause of most incidents (63 percent) was by negligent insiders. The total figure showed a careless employee or contractor was the root cause of 2,962 of the 4,716 incidents reported, and 1,105 incidents were caused by criminal and malicious insiders.
Non accountable behaviours
Whilst there are various type of insider threats; malicious insiders often seek financial gain or look for revenge. Unintentional insider threats, on the other hand, are more well-meaning but are no less dangerous. These employees will more likely fall victim to social engineering techniques or phishing emails.
Ignorance forms a key issue when it comes to employees handling data. Many of these individuals were never trained on their personal responsibility over company data, and have little knowledge of the company’s security practices. As such, they are highly susceptible to threats mentioned above.
Why they are dangerous?
Apart from the economic factor, these threats are hard to identify, and an operational disaster. Identifying these threats internally can be troublesome, since insider threats already have access to the network with authorised credentials, their access does not flag on a traditional monitoring system. They often already have access to sensitive data, awareness of the existing security measures in place and how to get around them. Combine this all with a lack of visibility into user access and data activity, the difficulty of identifying threat actors is incredibly challenging.
Mitigating the threat
One of the best ways an organisation can combat this issue is by fulfilling their compliance obligations through the adoption of a Privacy by Design approach. This is an approach that takes privacy into account throughout the whole process, ensuring that a business’s systems, policies and processes and technologies is accounted for. Privacy by Design needs to start with data classification. The sheer volume of unstructured data within organisation, combined with the ever-increasing technical abilities of hackers and the fallibility of employees, makes it impossible to rely on people and processes alone to ensure that sensitive data is handled appropriately. Data classification embeds a culture of compliance by involving users to identify, manage and control the sensitive data they work with, while automating parts of the protection process to enforce rules and policies consistently. Data is classified at source so the organisation’s rules can be applied at the outset.
An organisation’s first step is to understand what data they have have, who is using it, how it is being stored, classified and shared, and whether it is company-sensitive; this is key to any data protection strategy. Once the organisation has defined what data it has, the next step is to classify it. Data classification is the categorisation of data according to its level of sensitivity or value, using labels. These are attached as visual markings and metadata within the file. When a classification is applied, the metadata ensures that the data can only be accessed or used in accordance with the rules that correspond with its label. This means the organisation would need to define its classification policy first and decide who should have access to each type of data. Once this is done, the next step will be to select an appropriate classification tool; the right technology will help users to consistently apply the classification scheme with ease. The most effective tools make classification a seamless part of business-as-usual. Once data is appropriately classified, security tools such as Data Loss Prevention (DLP), policy-based email encryption, access control and data governance tools are exponentially more effective, as they can access the information provided by the classification label and metadata that tells them how data should be managed and protected.
With the increase of regulation and its impact on business liability, organisations will need to invest in technology and policies that will help them to respond to, and prevent, insider threats from moving out externally. This will mean organisations would be able to identify what data has left their network, and how to prevent data leaving in the future by looking for similar information on all other data assets.
Jun
Since the first outbreaks of Covid19 in Europe and seeing the containment measures taken by different countries such as Italy or Spain, many companies have been preparing so that their employees could work remotely from home without taking into account the risks and security of their sensitive information.
The advantages of remote work and its risks
According to Gallup Human Resources consulting firm, 54% of American workers work remotely part time or continuously. Many studies claim that remote workers are more productive and profitable than office-based employees. In Europe, the data for occasional remote workers compared to total workers is much lower, although there are huge differences by country.
Among the advantages that have led companies to adopt remote work has been the reconciliation of work and family life, increased productivity, avoidance of stress when travelling to work, and cost reduction.
In a short space of time Covid19 has imposed itself on these advantages in recent weeks and has forced many companies to take measures to remote work and minimize downtime.
However, not everything is an advantage when it comes to remote work. Among the barriers to adoption are isolation and disconnection from the organization and culture of the company (lack of visibility in terms of business management, isolation), lack of visibility and control over worker responsibility (is he doing what he has been asked to do?), difficulties in communication (including changing time zones), maintaining separation between personal and work life and cybersecurity (keeping workers and company data safe).
Tools to facilitate remote work
Due to the threat of the Covid19, many companies have rushed to make work easier for employees. Companies are using, among others, the following technologies to facilitate remote work:
- Productivity tools: Access to documentation suites such as Office, Adobe and others so that employees can continue with their daily operations.
- Videoconferencing: WebEx, Zoom, GoToMeeting, etc. tools to hold online meetings or improve communication between remote teams.
- Collaborative workspaces Teams, Slack, etc. and similar tools that facilitate remote collaboration.
- Access to BackOffice tools: ERPs, CRMs, and other corporate tools via Cloud access or via VPN/RDP.
- Cloud storage systems: Access to corporate documentation via Cloud systems or remote access to corporate file servers.
Is sensitive information safe whith remote work?
But, what about information security? It is important to enable productivity and communication tools, but we must not neglect security: Use of secure authentication systems, VPNs to avoid publishing remote access to servers, etc.
The urgency for companies to implement remote work measures has led, for example, to the establishment of unsafe communication channels from workers’ homes to company systems. For example, enabling access to servers via RDP (Remote Desktop Protocol), without an adequate VPN connection.
One thing is clear, the organization’s sensitive information is going to be more dispersed and widespread than ever before. It will be carried from the company’s systems to home computers with improvised and minimal security measures that cannot be at the level of corporate security systems.
Protect sensitive documents and keep them under control
Now sensitive information has been moved to the cloud, home computers, etc. How can I easily and conveniently put measures in place to keep it protected and under control, even if it is on computers outside the organization?
SealPath, Protection and Control tool allow you to have your data encrypted, even if it is on a remote computer, control access permissions (view only, edit, copy and paste, etc.) and audit access to information. Not only that, but you can revoke access to certain protected information if necessary to prevent possible data leaks.
By following these steps with SealPath you can have your information protected within minutes and under control on all employees’ computers, even if they are at home:
- Register your users in SealPath from the web control panel. They will receive a registration confirmation and instructions to install the SealPath software.
- Create a corporate policy with SealPath where you only allow access to the company’s internal staff (users of the company’s domain).
- Protects sensitive documentation that will be accessible by users from home through file servers, cloud applications, etc. Protection can be done automatically and unattended with SealPath for File Servers to secure data from file servers, SharePoint, Office 365, etc.
Once users access the information from their home computer, they can do so with the permissions assigned to them in that policy. Documentation will be encrypted, and all access will be authenticated.
With SealPath, it’s easy to get your data to travel with the security your business needs. Sensitive documentation will be out, but with corporate security “attached” to it. The work environment may not be as secure as it usually is, but the security enhancement SealPath easily applies eliminates this risk.
What other advantages does SealPath offer to secure information in this new remote work environment?
- The fact that a worker is not physically in the office increases the risk of phishing and identity theft. If confidential or critical information is given to a cybercriminal posing as a co-worker or a company executive, if this information . t can even be easily blocked completely if it is detected that this information has fallen into the wrong hands.
- These days, companies will see access to the network and information repositories from unknown devices. It will be difficult to determine whether these devices are legitimate or not. If critical information is protected with SealPath in the information repositories, the intrusion from an unauthorized device can only take encrypted information that will not be accessible after it is stolen.
Want to know more? Contact us and our experts will advise you on how to secure your information with SealPath quickly and within a few hours so that your employees can work comfortably and safely from home.
Jun
Sophos Connect is our free remote-access VPN client designed specifically to enable remote workers to access your XG Firewall protected network from anywhere. And Sophos Connect 2.0 now includes many new features that you can start taking advantage of right away.
You should also know that as a licensed XG Firewall customer, there’s no extra charge for remote-access VPN connections – you can utilize as many as you want (up to your firewall’s capacity) to support your remote workforce – included for free as part of your base license.
What’s new in Sophos Connect 2.0
The early access program for Sophos Connect 2.0 is now underway, adding support for SSL VPN on Windows as well as a number of other enhancements.
- SSL VPN support for Windows
- Bulk deployment of SSL and/or IPSec VPN configurations via an enhanced provisioning file
- The same convenient deployment as in Sophos Connect v1 for IPSec
- Support for one-time-passwords (OTP)
- Improved DUO multi-factor-authentication (MFA) support (when connecting to XG Firewall v18)
- Auto-Connect option
- Option to execute a logon script when connecting
- Remote gateway availability probing
- Automatic synchronization of the latest user policy if the SSL policy is updated on the firewall (when using the provisioning file to deploy) as well as a manual re-synchronization of the latest policy
- Automatic failover to next firewall WAN link if one link fails
- File extension association for policy files – import a policy file into Sophos Connect just by double-clicking it in Windows Explorer, or opening the file attached in an email
Getting started
Head on over to the XG Firewall Community to get started with the early access program. There are full details on all the changes, instructions on how to use the new provisioning file, and the download itself. Full instructions are also available online.
SSL vs IPSec
With Sophos Connect 2 now supporting both SSL and IPSec VPN technologies, you might be wondering about the pros and cons of each and which one you should use.
In general, SSL VPN, which can work over port 443 just like any encrypted website connection, will present fewer obstacles and work from more varied locations such as public WiFi hotspots and hotel networks.
IPSec is typically more efficient but uses UDP ports 500 and 4500 which can often result in connections being blocked by 3rd party firewalls. If the user has full control over their firewall or router, and can open these ports, then they will find IPSec offers more predictable performance.
One of the great new benefits of Sophos Connect 2 is that you can now offer both with a single client, but we encourage you to take advantage of the new SSL VPN capability for the added flexibility it offers.
Jun
Sophos XG Administration. Αυτό το μάθημα έχει σχεδιαστεί για επαγγελματίες τεχνικούς που θα αναλάβουν τη διαχείριση του Sophos XG Firewall και παρέχει όλες τις απαραίτητες δεξιότητες για τη πραγματοποίηση κοινών καθημερινών εργασιών. 
Στόχοι
Με την ολοκλήρωση αυτού του μαθήματος, οι εκπαιδευόμενοι θα μπορούν:
- Να γνωρίζουν όλα τα βασικά χαρακτηριστικά καθώς και πως να προστατεύονται από απειλές
- Να ολοκληρώνουν απλές εργασίες διαμόρφωσης
- Να διαμορφώνουν/ ρυθμίζουν τις συχνότερα χρησιμοποιούμενες λειτουργίες
- Να προβάλλουν και να διαχειρίζονται αρχεία καταγραφής συμβάντων και αναφορές
- Να προσδιορίζουν και να χρησιμοποιούν εργαλεία αντιμετώπισης προβλημάτων
Προαπαιτούμενα
Δεν υπάρχουν προϋποθέσεις για αυτό το μάθημα. Ωστόσο, συνιστάται να:
- Γνωρίζετε δικτύωση σε επίπεδο CompTIA N+
- Να είστε εξοικειωμένοι με τις βέλτιστες πρακτικές ασφάλειας
- Να έχετε εμπειρία διαμόρφωσης συσκευών ασφαλείας δικτύου
Πιστοποίηση
Για να γίνουν πιστοποιημένοι διαχειριστές της Sophos, οι εκπαιδευόμενοι θα πρέπει να δώσουν και να περάσουν από μια διαδικτυακή αξιολόγηση/ εξέταση. Η αξιολόγηση ελέγχει τις γνώσεις τους τόσο για το περιεχόμενο που παρουσιάστηκε όσο και για το πρακτικό περιεχόμενο και περιέχει 40 ερωτήσεις. Η βάση για να περάσετε την αξιολόγηση είναι 80% και περιορίζεται σε 4 προσπάθειες.
Πρόγραμμα
Η εκπαίδευση αναμένεται να διαρκέσει τρεις (3) ημέρες (24 ώρες) για να ολοκληρωθεί, εκ των οποίων περίπου οι μισές θα δαπανηθούν σε πρακτικές ασκήσεις.
Περιεχόμενο
Η εκπαίδευση περιέχει 10 ενότητες:
- Ενότητα 1: Επισκόπηση XG Firewall
- Ενότητα 2: Ξεκινώντας με το XG Firewall
- Ενότητα 3: Προστασία δικτύου
- Ενότητα 4: Προστασία Web Server
- Ενότητα 5: Site-to-Site Connections
- Ενότητα 6: Έλεγχος ταυτότητας
- Ενότητα 7: Προστασία Ιστού και Έλεγχος Εφαρμογών
- Ενότητα 8: Προστασία ηλεκτρονικού ταχυδρομείου (email)
- Ενότητα 9: Wireless Protection
- Ενότητα 10: Απομακρυσμένη πρόσβαση
- Ενότητα 11: Logging, Reporting και Troubleshooting
Jun
Sophos XG Administration. This course is designed for technical professionals who will be administering Sophos XG Firewall and provides the skills necessary to manage common day-to- day tasks.
Objectives
On completion of this course, trainees will be able to:
- Recognize the main technical capabilities and how they protect against threats
- Complete common configuration tasks
- Configure the most commonly used features
- View and manage logs and reports
- Identify and use troubleshooting tools
Prerequisites
There are no prerequisites for this course; however, it is recommended you should:
- Be knowledge of networking to a CompTIA N+ level
- Be familiar with security best practices
- Experience configuring network security devices
Certification
To become a Sophos Certified Administrator, trainees must take and pass an online assessment. The assessment tests their knowledge of both the presented and practical content and contains 40 questions. The pass mark for the assessment is 80%, and is limited to 4 attempts.
Schedule
Training is expected to take three (3) days (24 hours ) to complete, of which approximately half will be spent on the practical exercises.
Content
The training contains 10 modules:
- Module 1 : XG Firewall Overview
- Module 2 : Getting Started with XG Firewall
- Module 3 : Network Protection
- Module 4 : Web Server Protection
- Module 5 : Site-to-Site Connections
- Module 6 : Authentication
- Module 7 : Web Protection and Application Control
- Module 8 : Email Protection
- Module 9 : Wireless Protection
- Module 10 : remote Access
- Module 11: Logging, Reporting and Troubleshooting