Vulnerability Assessment Builds Security Continuous Improvement Into your Enterprise SDLC

Vulnerability assessments are a highly systemised way for established organisations to gain a comprehensive picture of their security posture, and then maintain and continuously improve on it. When new devices, ports, websites, web applications, or services are added, they are included in regular scans. A vulnerability assessment is a great way to identify, and eventually fix, common vulnerabilities in your applications and servers.

Most security professionals recommend that vulnerability testing is conducted at least quarterly. Our recommendation, however, given that Netsparker allows you to configure scheduled scans, is to scan much more frequently. In any case, you should conduct vulnerability tests following any significant change or addition to your web applications or web APIs. With Netsparker, if you want to, you can run scans daily, with notifications drawing your attention to detected vulnerabilities as they arise. Resources can then be deployed rapidly to deal with critical and important threats.

Penetration Testing Exposes Fragile Cracks In Your Security Architecture

Since penetration testing is so specific, it is best suited to environments where an organisation’s web and network security is considered to be already robust. Organisations may ask a tester to attempt to do something specific, such as gain access to a transactions or bank details database, or alter or delete a single record. The purpose is to reduce exposure to certain risks. Penetration testers check for weak points in the architecture. While vulnerability assessments mostly take care of software vulnerabilities, penetration testers may often use phishing, social engineering and onsite engagements in order to reach their goal. Therefore they can give a much more accurate depiction of a company’s security level. They act exactly as malicious hackers, without producing any devastating loss or alteration of data, of course! For example, a penetration tester might try to establish a connection to a remote server without being detected, in order to exfiltrate sensible data from a system. It is a useful way to demonstrate if attackers with particular objectives in mind stand a healthy chance of success. Ostensibly, though, a pen tester would conduct an endless series of attempted hacks.

The recommendation is that penetration testing is conducted at least once per year.

What Scenarios Can Help Determine the Choice of Approach?

Both vulnerability assessments and penetration tests should be run against network devices, and internal and external servers. It’s crucial to determine whether an attack is possible from the outside (for example, by a malicious attacker targeting publicly-available target surfaces on the internet) or the inside (for example, by a disgruntled employee or contractor, a user with permissions they should not have, or a compromised machine within the internal network).

Vulnerability Assessments Help Enterprises Maintain Consistent Compliance With Standards

Sometimes organisations need to work within certain parameters: they have PCI DSS or other forms of compliance to adhere to and want to test if the current architecture, systems and devices would pass the test. They may want to run a port scan or check against everything on the OWASP Top 10 List. In such scenarios, a vulnerability assessment will provide a more realistic and systematic approach. Even a very large team of developers could never comprehensively reach the end of such tests.

Penetration Testing Helps All Organisations Keep Ahead of the Hackers

Penetration testing comes at security from a different angle. Testers will uncover security risks in the same way that hackers do – by conducting attacks with a single purpose in mind, to gain access to certain data or to change something on an organisation’s website, for example. Pen testers are best commissioned with an open mind, leaving them free to conduct both requested attacks and anything else that occurs to them, depending on their professional experience.

What About the Testers?

One of the most important questions to consider, to help distinguish between vulnerability assessment and pen testing, is: Who’s conducting the testing?

Information Security Professionals Establish Internal Procedures for Continuous Improvement

Contrary to some articles on the subject, vulnerability testing is not a fully-automated process in the sense that all it takes is to push a button. The person who manages regular, automated vulnerability assessments must be already skilled and experienced in information security procedures. They must know what environments and attack surfaces to assess and what to assess them for, as automated security scanners will still require some configuration. And they must be able to interpret the resulting reports and make recommendations on what needs to be done next.

In-house security professionals responsible for vulnerability assessment continuously add value to the security status of organisations and their resources. First, they can establish a baseline. They are likely to want to establish some systems, particularly an assessment schedule and reporting. They can help raise awareness within, while facilitating a continuous reduction in security risks. Meanwhile, they will most certainly expand their own knowledge and skills. Arguably, they are much more likely to feel loyal to an organisation in which they already work.

Penetration Testers Tell It Like It Is

Penetration testers, likewise, must also be knowledgeable professionals who are confident in their abilities.

Most professionals in the field recommend that penetration testers should be independent, external professionals. They must maintain enough distance from your company or systems that they are not hampered by concerns about personal financial security, loyalty or politics. This enables then to state the blunt truth about your security status, however much it hurts!

What About Cost?

How much vulnerability testing costs depends on the scope of the engagement. For small organizations the price will be significantly lower than for a big corporation with thousands of potentially vulnerable machines, IPs and internet facing hosts.

Regardless of the cost, vulnerability assessments produce a better yield on investment. While a pen test may be a deep slice of how secure your system is, it only reveals one thing in one direction. Vulnerability assessments take the long view, investing time and resources in developing systems and procedures that will yield a solid level of security on which to further develop your systems and integrate new components.

So, Which Approach Do We Select?

Simply put, do both. Both approaches have the capability to uncover gaping holes in your security and reveal other less obvious vulnerabilities, ones you weren’t even looking for. One thing is certain, if you’re not scanning or testing, you will encounter a loss of data. The only question is when. Whether it’s a known vulnerability that you’ve not addressed, or the result of a bored hacker’s Sunday afternoon adventures (yes, it’s true, they’re not all malicious!), the result is the same.

The mature, preventative approach is to establish vulnerability testing and scanning as part of your regular SDLC, and additionally employ some unusual types to do what a hacker might do, but on friendly terms (‘white box’ pen testing). Then you can read all the reports and results, examine the recommendations and make smart decisions on how to keep your organisation’s security posture ahead of the bad guys.

You can read the original article, here.

Sophos is committed to providing you with the best protection, performance and value in the industry and the latest NSS Labs retest of XG Firewall validates that we are delivering on that commitment. As expected, XG Firewall has performed extremely well blocking 100% of all evasions with excellent results across all other areas tested by NSS Labs. The results for both security effectiveness and total cost of ownership (TCO) per protected Mbps are outstanding.

Here’s a summary of the results:

• 100% Evasion Resistance
• 94.82% Exploit Block Rate
• 100% Resiliency Coverage
• 100% Stability and Reliability
• 6,194 Mbps tested throughput
• TCO per protected Mbps of $5.47

We encourage you to explore the full test results which are available for download.

You can also see how XG Firewall places on the NSS Labs Security Value Map (SVM) Chart (click to enlarge).

Sophos XG Firewall customers and partners don’t need to take any action as your firewall is providing optimal protection and performance. For those wondering about the HTML padded evasion techniques missed in the June 2018 NSS Labs Next Generation Firewall (NGFW) public test, those were addressed through adjusting the AV engine file size scanning parameters. No action is required as your firewall device comes with optimized default settings based on careful analysis of the current threat landscape. You can learn more about this setting in the XG Firewall Knowledge Base.

As you know, we never rest, and are relentlessly improving and innovating our products. In fact, we have a substantial new release of XG Firewall coming soon – watch this space for more details in the days ahead.

You can read the original article, here.

Apple’s iOS 12 is being released to the public today, and the great news is that Sophos Mobile already supports it. As soon as your users upgrade to the latest versions of the operating system we will be protecting them.

For more information about the features of iOS 12, take a look at Apple’s iOS product page.

If you’re managing Sophos Mobile via Sophos Central you can now control when iOS updates are installed, with the option to delay updates for up to 90 days should any custom application testing be required before roll out. If you’re running your own Sophos Mobile server you can also use the same controls once you’ve upgraded to Sophos Mobile 8.5.

Whenever you’re ready to update to iOS 12, Sophos Mobile is ready for you.

You can read the original article, here.

We’ve watched plenty of software demos over the years, be they with or without the thrill of live attacks involving things appearing on your screen, but there really is nothing quite like getting hands-on with a piece of hardware.

So, with our new APX Series access points, we thought we’d try our hand at one online phenomenon – the unboxing video.

If you haven’t got around to ordering your APX Series just yet, here’s a taste of what you can expect. We’ve gone for the subtle unboxing approach and in the interest of good taste – we’re a British company after all – have refrained from throwing any packaging on the floor.

What is an APX?

The APX Series is a new generation of 802.11ac Wave 2 access points, which can be managed through our Sophos Central platform and so alongside your Sophos Endpoint, Intercept X, Mobile, Server, Email and Encryption.

The first three models are already available in most regions:

The APX 120, an entry-level 2×2 model, will be introduced in late 2018 and further models are in planning for 2019.

The very observant amongst you may have noticed that the second digit in the model number correlates with the MIMO capability, which is fully intentional.

Management support in XG Firewall is planned for late 2018.

To find out more visit the APX Series and Sophos Wireless pages or take a look at the Sophos Central demo, which includes Wireless.

You can read the original article, here.

Confusion between the terms ‘penetration testing’ and ‘vulnerability assessments’ often begins at the level of language. Those who are not full-time professionals in web security, such as journalists reporting on a big story that affects consumers, use the terms interchangeably, as if referring to the same process.

Experienced professionals in the industry know the difference, but those new to it can be easily confused. Why? Even professionals sometimes use terms in fuzzy or inexact ways, when they should distinguish between things that differ. Let’s be clear on the difference between the two.

What Are Vulnerability Assessments?

A vulnerability assessment involves running a series of multiple tests, against defined websites, web applications, IP addresses and ranges, using a known list of vulnerabilities, such as the OWASP Top 10 list. Assessors may also run tests against systems they know to be incorrectly configured or unpatched. Often, automated security scanning tools are used. Commercially licensed, subscription-based tools are regarded as coming with less risk – regular updates, release notes bring less chance of the inclusion of malicious code. (Their open source equivalents, however, have the significant advantage of being the exact same tools that malicious hackers prefer.)

Vulnerability assessments tend to include the following stages:

• Identifying all resources, and connected resources, within an organisation’s IT systems
• Assigning a value or priority to each one
• Conducting an assessment of lists of known vulnerabilities across a large number of attack surfaces (from login screens to URL parameters to mail servers)
• Fixing the most critical vulnerabilities and making decisions about how to the deal with the rest

What is Penetration Testing?

Penetration testing (pen testing), on the other hand – while it may be considered to be a type of vulnerability assessment – involves replicating a specific type of attack that might be carried out by a hacker. A pen tester will often explore the systems until they find a vulnerability. They may even employ a vulnerability assessment tool to uncover a vulnerability. Once they find something, they will then try to exploit it, to determine whether it would be possible for a hacker to achieve a certain objective (access, change or delete data, for example). Often, while doing this, they may accidentally encounter other vulnerabilities, and follow where they lead. The pen tester may use an automated tool at this point to run a series of exploits against the vulnerability.

Some penetration tests are referred to as ‘white box’ to indicate that the penetration tester has been given detailed information about the environment, such as a list of assets belonging to the organization, source codes, employee names and email addresses etc. When they are referred to as ‘black box’, this indicates tests that are conducted without any prior information about the internal structure, access to source code etc.  This kind of pen test of course, can more closely resemble the activities of a malicious hacker, but may also lead to less thorough coverage of the companies potentially vulnerable assets.

What Results Can I Expect From Each Approach?

The answer to this question might best be asked by thinking backwards: What results do you want?

Vulnerability Assessments Report Across All Vulnerabilities

The results are collated in an automated, lengthy report, with a comprehensive list of detected vulnerabilities arranged by priority, determined by how by severe and business-critical they are. As time goes on, this list can reveal changes since the last report. One of the criticisms of the results achieved is that, unlike in penetration testing, they can contain false positives or false negatives. Naturally, this is not the case if you use Netsparker web application vulnerability scanner to conduct your vulnerability testing. It is one of our key features – automatically verifying identified vulnerabilities with Proof-Based Scanning.

Reports should include guidance on how to remediate the detected vulnerabilities, and tools sometimes come with patches subscribers can use. In most cases, results are then allocated to dedicated development teams who conduct fixes, remove the most serious vulnerabilities, and otherwise address the less serious ones. In an ideal world, this activity is ongoing, scheduled regularly, and built into the organisation’s SDLC.

Penetration Testing Reports Deep Into Each Vulnerability

With pen testing, there is no lengthy public report, though some record and publish their actions and anonymized findings, blog about their experiments, or live hack at conferences. If you hire a pen tester, however, they should deliver a (pen test) report, but it tends to be focused on the attack method or exploit, and exactly what data can be compromised. It will generally be accompanied by suggestions on what a hacker might be able to do to, or with, it. This helps business analysts and non-technical professionals, who may not understand all of the technology behind such tests, grasp business process impacts quickly.

Sometimes reports also incorporate remediation advice. However, not all pen tests incorporate exploitation of vulnerabilities in the way that Netsparker does. It may be sufficient simply to illustrate that an attack is possible. In some cases the pen test report may simply report theoretical vulnerabilities because attempting to exploit them may result in a catastrophic denial of service (DoS). And, finally, there is no assessment of vulnerabilities, since the goal is simply to do one thing, or least to determine whether it can be done.

Which Approach Should My Organisation Adopt?

The main question to ask is: What is your current security posture?

To be continued…

With the introduction of Sophos Wireless v2.0 and the new APX Series Access Points, we’re continuing the evolution of our security in order to connect multiple products via our Sophos Central security management platform.

When connected through our new APX Series access points, Sophos Wireless can not only talk to your endpoints but also your mobile devices and even your servers – as long as they’re connected via Wi-Fi.

What does synchronized security with Wireless do?

In this first phase, Wireless receives the Security Heartbeat of any Wi-Fi connected device, which is managed through the same Sophos Central account.

The heartbeat communicates the health state – green, yellow or red – and should a red heartbeat be detected, which can indicate anything from a minor compliance violation for a mobile device, to a ransomware attack on an endpoint or server – the device is automatically put into a ‘walled garden’.

As pleasant an image as that may conjure up in the horticultural sense, here it means that internet access is restricted to a list of pre-defined URLs – a safe environment – thus potentially preventing call-home attempts and further propagation of threats.

So generally speaking, walled gardens are much less fun in the world of Wi-Fi.

Take a look at this short video to see how it works.

Find out more at the Sophos Wireless page or take a look at the Sophos Central demo.

You can read the original article, here.

Cryptocurrencies like Bitcoin have been a source of worry since their creation. Fans of the technology say it’s the future of money in terms of privacy, and the verifiability of complex transactions; but there has always been a great debate that the real ‘value’ of cryptocurrency is in the application and use of the currency such as tax avoidance and for purchases of illicit items and services.

While governments, various financial institutes and law enforcement have begun to crackdown on those concerns by attempts to regulate the market place, cryptocurrencies remain as an attractive form of income when linked to malicious activities such as malware infections, increasing the popularity of these strains.

Because they are valuable, digital, anonymous, and work across borders—anyone can send cryptocurrencies to anyone else, anytime or anywhere – they have become an irresistible target for cybercriminals. It’s no accident that the increasing popularity of cryptocurrencies has seen a parallel rise in malware infections that turn laptops and servers into zombie machines, quietly doing the bidding of a distant and remote bitcoin ‘mining’ operation.

Bitcoin mining or Crypto-jacking takes place when someone else uses your computer to ‘mine’ a cryptocurrency like Bitcoin or Ethereum. Rather than benefit yourself, however, any mined (collected) coins go into the attacker’s (or their client’s) account. By crypto-jacking your machine the crypto-jacker steals and utilizes your resources, in the form of your machine processing power and electricity, and converts them into capital for themselves.

Those computing resources include taking over your graphics processing unit (GPU) and central processing unit (CPU). Bitcoin mining is an exceptionally power and resource-intensive task, pushing those processors into overdrive and requiring large amounts of energy to complete the complex calculations necessary to generate a virtual coin. Pushing your machinery to these levels without the correct cooling and provisions in place can easily cost you your pride and joy or witness a loss of productivity in a workplace environment due to hardware failing from overheating challenges.

That’s what motivated a team of Russian scientists to use the supercomputer at a nuclear research facility to run an unsanctioned bitcoin mining operation. It’s also what motivates crypto-jacking. By creating a distributed computing network compromised of hundreds or thousands zombie/compromised machines, they sidestep the upfront costs of a single, expensive super-powered computer, and then pass on the ongoing costs of powering it.

Those costs are passed on to us

The UK and Australian governments recently suffered website outages thanks to a crypto-jacking malware that infected thousands of government machines. The source of infection was a compromised browser plug-in made by a third-party. Thousands of websites in and outside of Australia, including the UK’s National Health Service, and the UK’s own data protection watchdog, were affected.

Windows machines tend to be the target of crypto-jacking malware, but other devices and operating systems can also be turned into bitcoin mining bots:

• Mac OS and iOS device, including iPhones
• Gaming consoles
• Environment-monitoring devices, used in data centers
• IoT devices within a Smart Home instance
• Home WIFI routers
• Android-run smart TVs and mobile devices

A compromised device is often forced by the malware to run at the maximum of what its components can handle. Mining can slow other processes, overwork cards and processors, or even brick the machine. With degraded capabilities and the connection between the infected host and the command and control server for the crypto mining software being unsecured, the machine can also be vulnerable to infection from other kinds of malware.

While an end user or network admin might realize that a machine is running more slowly than normal, or that CPU usage on the network is high, determining the source of the issue can be difficult. The fact that a crypto-jacked machine is running slowly also makes it harder to investigate. The mining processes initiated by the malware can also mask themselves as normal system tasks.

To stop crypto-jacking, cross correlate network anomalies

Unfortunately, there is no blanket protection against crypto-jacking. As with any malware there are multiple vectors of infection and keeping them out of connected machines is part of the long-term battle against malware.

Security teams should of course, follow standard mitigation techniques – updating antivirus and firewall settings, ensuring all devices are updated with the latest patches, changing or strengthening default credentials, application whitelisting and so on.

But the biggest challenge to stopping crypto-jacking is detection. Proactively monitoring network traffic and machine status can help spot the indicators of infection – spikes in CPU usage, excessive memory usage, network congestion, or servers inexplicably slowing down. However, when seen in isolation, these red flags may not be enough to raise the alarm.

The key is to have network monitoring systems capable of cross-correlating the anomalies. Only then can a system administrator or SOC team can identify the behavioral patterns that point to bitcoin or another cryptocurrency mining. They can then decide on the best approach to stopping it, mitigating the damage, and limiting the size of the energy bill created by the infection.

Securing email gateways, developing countermeasures against web injections, implementing best practice for mobile devices, BYOD (Bring your own device), and promoting a security-aware business culture can all form part of a defense-in-depth against crypto-jacking and other breaches.

Ultimately, however, the security of internet-connected devices against cryptocurrency-mining malware is going to be a top item on the cybersecurity agenda for some time to come.

You can read the original article, here.

This three-day training program was designed and intended for experienced technical professionals who want to install, configure and support the XG Firewall in production environments and is the result of an in-depth study on the next generation firewall of Sophos.

The program consists of presentations and practical workshops for the enhancement of teaching content. Due to the nature of the traditions and the varied experience of the trainees, open discussion is encouraged during the training.

Prerequisites

Participants should have attended the XG Engineer Course.

Recommended Knowledge

•  Knowledge of networking to a CompTIA N+ level
•  Knowledge of IT security to a CompTIA S+ level
•  Experience configuring network security devices
•  Be able to troubleshoot and resolve issues in Windows networked environments
•  Experience configuring and administering Linux/UNIX systems

Contents

• Module 1: Enterprise Deployment Scenarios
• Module 2: Advanced Firewall
• Module 3: Authentication
• Module 4: Webserver Protection
• Module 5: RED Management
• Module 6: Wireless Protection
• Module 7: Enterprise VPN
• Module 8: High Availability
• Module 9: Troubleshooting
• Module 10: Sizing

Certification

+ exam: Sophos XG Architect

Duration

3 days 

Agenda

Trainer: Michalis Eleftheroglou

Day 1 Monday, October 29th, 2018

9:30-10:15 Module 1: Enterprise Deployment Scenarios Part I

• Bridge mode
• Gateway mode
• Mixed mode

10:15-10:30 Break

10:30-12:00 Enterprise Deployment Scenarios Part I

• VLAN
• Link Aggregation
• Routing protocols

12:00-12:15 Break

12:15-13:45 Advanced Firewall  Part I

• Stateful inspection
• Strict policy
• Fast path
• Intrusion prevention
• Anti Dos/floofing
• Advanced Threat Protection

13:45-14:45 Break – Lunch

14:45-16:15 Advanced Firewall  Part II

• Asymmetric routing
• Local NAT policy
• DHCP options
• Bind to existing DHCP scope
• Country list
• Drop packet capture
• IPS tuning

16:15-16:30 Break

16:30-17:15 Webserver Protection

• Overview
• Web Servers
• Application Protection policies
• Path specific routing
• Authentication policies
• Certificates

Day 2 Tuesday, October 30th, 2018

9:30-10:15 Module 4: Authentication

• Single sign-on (SSO)
• LDAP integration
• Secure LDAP
• STAS (Sophos Transparent Authentication Suite
• Troubleshooting STAS

10:15-10:30 Break

10:30-12:00 Authentication part II

• Sophos Authentication for Thin clients (SATC)
• Troubleshooting SATC
• NTLM
• Troubleshooting NTLM

12:00-12:15 Break

12:15-13:45 Module 5: Red Management

• Overview
• RED Models
• Deployment
• Adding a RED interface
• Balancing and failover
• VLAN port configuration

13:45-14:45 Break – Lunch

14:45-15:30 Module 6: Wireless Protection

• Overview
• Access Points
• Wireless networks
• Security modes
• Deployment
• Built-in wireless
• Mesh networks
• Radius authentication
• Class Activity

15:30-15:45 Break

15:45-17:15 Module 7: Enterprise VPN

• Huge and spoke topology
• Ipsec VPN configuration
• Ipsec VPN policies
• NAT overlap
• Route precedence
• VPN failover
• Logs
• Troubleshooting

Day 3, Wednesday, October 31st, 2018

9:30-11:00 Module 8: High Availability

• Overview
• Prerequisites
• HA packet flow
• Configuration
• HA status
• Console commands
• Logs
• General Administration

11:00-11:15 Break

11:15-12:00 Module 9: Troubleshooting

• Consolidated Troubleshooting Report
• SF loader
• Tcpdump

12:00-12:15 Break

12:15-13:45 Module 10: Sizing

• Hardware appliance models
• Hardware appliance sizing
• Software and virtual devices
• Sizing scenarios
• Class activity

13:45-14:45 Break – Lunch

14:45-17-15 Labs and Exams

There are numerous things you can do with Sophos Central, our cloud-based management platform. You can manage networking products, mobile devices, phishing training and more. You’d think with so much functionality it would be complicated, but as happy customer Igor Bovio explains, it’s easy to use:

“With Sophos Central, the IT system is able to respond to cyber attacks with a simple click” says Igor Bovio.

More than 90% of our Sophos Central customers already combine it with some form of endpoint product, whether it’s our Endpoint Advanced offering or Intercept X.

For first-time customers logging into Sophos Central, and for those who just want a refresher, we’ve created a 12-minute guided video tour that provides a quick overview of the Sophos Central platform. It walks through how to set up various endpoint policies, offers advice for getting end users into the system, and covers how to deploy the all-in-one software agent onto those users’ machines.

Think of Sophos Central as a theme park: you can burst through the gates and head right for the roller coaster, or you can hop on the trolley and take a little tour first. For those of you looking to get a lay of the land, we hope this video serves you well. Enjoy!

CyberArk, the global leader in privileged access security, today announced the availability of its SAP-certified CyberArk Privileged Access Security Solution. The solution can strengthen and extend security across SAP environments, including SAP ERP systems, by protecting against privileged access-related risk and credential compromise.

The CyberArk Privileged Access Security Solution achieved SAP certification as Integrated with SAP NetWeaver technology platform. It enables organizations to improve operational efficiencies and safeguard critical assets from external attackers and malicious insiders. With more than 90 percent of the Global 2000 relying on SAP applications to run their organizations, powerful credentials for these applications and systems are sought out by attackers to gain access to business-critical information and assets.

This certification extends CyberArk’s existing SAP integrations, which are available to customers on the CyberArk Marketplace. SAP is also a new member of the C³ Alliance, CyberArk’s global technology partner program.

The CyberArk Privileged Access Security Solution enables organizations to:

• Manage and secure SAP credentials: Organizations can strengthen their overall security posture and improve operational efficiencies by onboarding accounts into CyberArk’s encrypted centralized repository. With CyberArk they can also automate password rotation and enable multi-layered privilege access security control across the SAP stack – from the application layer to databases, operating system and servers.
• Reduce privileged access security risk: Organizations can quickly detect and halt suspicious activity by monitoring SAP privileged user activity. CyberArk complements SAP’s security controls by managing, protecting and controlling the use of privileged accounts. CyberArk provides a consistent approach to reducing privileged access security risk across the entire enterprise for SAP solutions and other high-value applications and infrastructure.
• Meet compliance requirements: Organizations can easily demonstrate compliance with internal enterprise policies and various industry regulations – including SOX, PCI DSS, GDPR and more – with complete visibility into SAP privileged account controls and activity records.

“The CyberArk Privileged Access Security Solution enables SAP-focused organizations to move forward with the confidence that only an SAP certified solution delivers,” said Adam Bosnian, executive vice president, global business development, CyberArk. “CyberArk enhances existing risk management and compliance initiatives in SAP environments and extends privileged access security, a critical layer of IT security, to essential business systems. CyberArk delivers an innovative and impactful solution for privileged access security that can scale effectively with these organizations.”

Real-life cyber threat headlines, Hollywood scripts and great animations come to Phish Threat.

“I’ll admit I’m not the most avid reader. The annual holiday-readathon when TV and YouTube are put on pause for 2 weeks is usually as far as I get.

It’s the same when it comes to training or learning new skills. With a choice between wading through notes and attending a lecture or watching a video with real stories and examples, most of us would choose the video every time.”

Security awareness training the Sophos way

Phish Threat from Sophos is all about delivering security awareness training in this way – consumable and engaging, with a variety of videos, games and interactive quizzes to make training content memorable.

Combining phishing simulations with security awareness and compliance training modules, we’re able to seize that ‘teachable moment’ directly following someone’s cybersecurity mistake (such as clicking on a simulated phishing email link).

https://vimeo.com/148154237

Bringing training to life

Stories help make training resonate, and they inspire us to act – moving training on from you simply ‘knowing’, to you ‘doing’. That’s why we’re excited to announce our latest Phish Threat learning partnership with Ninjio.

Ninjio shares our approach of short, engaging training, and its unique style recently scooped it the Gartner Customer Choice award for Computer Based Training 2018. By dramatizing real-life cyber threat headlines, with Hollywood script writers and great animations, Ninjio brings these stories to life for employees.

Launching later this summer, we’re excited to add these great additions to the growing range of Sophos Phish Threat learning videos. Look out for the launch information soon, and, for now, take a sneak peek at Ninjio’s latest work…

You can read the original article, here.

Savvy security practitioners understand that one of the most important, preventative steps they can take to bolster their cyber security posture is to secure privileged access – including privileged accounts, credentials and secrets. Protecting privilege is a process, and it’s often a key element of an enterprise-wide security program. Perhaps you are wondering if there a guide with actionable – yet easy-to-understand – information about establishing and maintaining a privileged access security program that you could flip open and reference.

Look no further than the new Privileged Access Security for Dummies guide. Brought to you by CyberArk, this guide is meant for an extended team to read – from CISOs to Developers – and not just IT security. Often, cyber security books go into significant technical depth, which is great for highly technical audiences. You should expect this guide to be conversational, with plenty of examples, analogies and elements designed to make this important security topic more approachable. With this quick and easy guide, readers can better understand and articulate the need to prioritize risk reduction associated with privileged-related access.

Inside, you’ll meet a full cast of characters – from Billy the “freelance hacker” who has made a career out of phishing unsuspecting corporate victims, to “Liam the Leak,” an engineer with access to sensitive data, who’s been passed over for a promotion one too many times. Through their stories, you’ll gain tips, technical insights and lessons others have learned – sometimes painfully so.

Download Privileged Access Security for Dummies today to:

• Discover the many types of privileged access used by humans and non-human automated processes
• Learn more about data loss, compliance, audit and third-party risks
• Get tips for establishing a privileged access security program
• Explore a 10-step approach for securing privileged access across the enterprise

Get smart on privileged access security. Download the free guide today.

You can read the original article, here.

Yesterday evening I felt an all-too-familiar mix of pride and embarrassment as my seven-year old daughter patiently walked me through some of the more advanced features on our TV.

As well as enhancing my viewing it also got me thinking: if I hadn’t had my own ‘advanced technical adviser’, I would have missed out on a whole range of things that our TV package has to offer.

I suspect this is a pretty common scenario with a host of software and devices, both at home and at work.

Fortunately, when it comes to Sophos Central Endpoint and Intercept X, help is at hand.

Intercept X Endpoint Resource Page

The Intercept X Endpoint resource page is your new go-to place for all things Intercept X and Sophos Central Endpoint.

It gives you easy access to the Knowledge Base, community forums and documentation, as well as links to important product lifecycle information.

New customers can take advantage of practical tips to help them get up and running, including the new Getting Started overview video.

Intercept X Endpoint How-to Library

The How-to Library is designed to help you make the most of your investment. It brings together a collection of videos, articles and PDF guides on a range of topics, from getting started, to malware detection and troubleshooting.

Whether you’re new to Sophos or an old-hand, we hope you’ll find it useful.

Both pages can be accessed by the support section on our website, or directly at:

• sophos.com/endpointsupport
• sophos.com/endpointlibrary

Not just for Endpoint!

Running Sophos XG Firewall or Sophos Central Server Protection? If so, we have new resource pages for you too.

The XG Firewall resource page and How-to Library give you easy access to all our most popular firewall resources, while the Server Protection resource page and How-to Library brings together all things Sophos Central Server.

You can read the original article, here.

To understand what cryptojacking is, you first need to understand cryptomining.

Cryptomining is a lot like gold mining in that, like gold, there are millions of cryptocoins in existence, they just haven’t all been made available yet. What miners do is extract them, by solving complex algorithms with powerful computer power harnessed from less powerful computers. Once they are verified, the miner is rewarded.

Cryptomining becomes cryptojacking when this is done illegally, without authorization. All cybercriminals have to do to make money through cryptomining is steal CPU power – from any user – to solve the algorithms and bring the cryptocoins to light.

Cryptojacking can happen in two different ways. An in-browser approach injects the script into a consumer’s browser and uses their CPU power to mine for coins. Alternatively, cybercriminals can bypass the browser and install a cryptominer directly on the consumer’s machine via a dodgy link.

To find out more about in-browser cryptominers vs installed cryptomining malware, and how to tell and what to do if you have a cryptominer installed, check out the Naked Security article «Cryptojacking for beginners – what you need to know».

Read the original article, here.

Sophos Intercept X Advanced was the top-ranked solution for both enterprise endpoint protection and small business endpoint protection in the new SE Labs endpoint protection test report (Apr-Jun 2018). Sophos received a 99% protection accuracy rating, 100% legitimate accuracy rating and 100% total accuracy rating. Each of these scores were the highest in the test.

This is the first time the combination of Intercept X and Central Endpoint Advanced (Intercept X Advanced) has been tested publicly and we are delighted with the results.

SE Labs tested endpoint solutions on their abilities to stop targeted and live, in-the-wild attacks in real time, as well as their false positive impacts. According to the SE Labs test: “Sophos Intercept X Advanced blocked all of the public and targeted attacks. It also handled the legitimate applications correctly”.

As a result, SE Labs awarded Sophos Intercept X Advanced its AAA award for both enterprise and small business protection.

Sophos was also recently ranked #1 for malware protection and exploit protection by MRG Effitas. The endpoint protection in Intercept X Advanced is driven by the combination of deep learning, anti-exploit capabilities, anti-ransomware technology, and other modern endpoint protection techniques – all paired with our foundational endpoint security technology.

Like Sophos, SE Labs is an active member of the Anti-Malware Testing Standards Organization (AMTSO). In fact, SE Labs were the first testing organization to achieve AMTSO Standard compliance.

You can read the original article, here.

Sophos is proud to be positioned among the “Visionaries” in the 2018 Gartner Magic Quadrant for Unified Endpoint Management (UEM).

Gartner states that: Unified endpoint management (UEM) tools combine the management of multiple endpoint types in a single console.

UEM tools perform the following functions:

• Configure, manage and monitor iOS, Android, Windows 10 and macOS, and manage some Internet of Things (IoT) and wearable endpoints.
• Unify the application of configurations, management profiles, device compliance and data protection.
• Provide a single view of multidevice users, enhancing efficacy of end-user support and gathering detailed workplace analytics.
• Act as a coordination point to orchestrate the activities of related endpoint technologies such as identity services and security infrastructure.

Sophos Mobile has evolved from a best in class mobile management software to becoming a fully-fledged UEM and security service that helps businesses spend less time and effort to manage and secure corporate and personal devices and users.

Sophos Mobile is the only UEM service that integrates natively with a leading next-gen endpoint security platform, supporting management of Windows 10, macOS, iOS, and Android devices.

Discover Unified Endpoint Management with Sophos Mobile at sophos.com/mobile

https://news.sophos.com/en-us/2018/07/24/gartner-names-sophos-as-a-visionary-in-the-first-uem-magic-quadrant/

Eric Vanderburg, Vice President of Cybersecurity at TCDI, highlights the key questions to consider when identifying your organisation’s data, its importance and the level of protection required…

I always figured that you would need to know what you have in order to protect it. However, I have seen far too many companies implement “best practices,” standards, or compliance programs without first understanding what they have to protect.

Asset inventory systems are bundled into many security systems or other management tools, but these systems track only hardware. IT systems management software tracks operating systems and software, but neither of these systems addresses the security need. The loss of a laptop or smartphone is a loss of a few hundred dollars. The loss of customer records, business strategies, software code or proprietary formulas, however, far exceeds the cost of the hardware. Thus, it is the data that information security needs to protect, and while the data does reside on top of hardware and software, the key to protecting data resides in first understanding the data.

Data can be described by the five W’s. Who, what, where, when and why.

Who created the data?

Presumably, someone created the data for a reason. This person, the data owner, has the initial responsibility for storing the data in an appropriate location and for granting access to the data, so it is important to know who these people are.

What information does the data contain?

Classify the data so that you can understand if it should be protected from loss or disclosure and how much effort should be expended in defending it.

Where is the data located?

The location of the data determines the level of organizational control that can be enacted over the data. An organization would have little control over data on a social network, but they may have a great deal of control over data in an Enterprise Resource Planning (ERP) tool.

When was the data created?

Other good questions include when was it accessed and when was it archived? This standard metadata, consisting of items such as creation, access and archive date, creator, file size, and type, are important because it can show how important the data is to the company. Less frequently used data is generally considered less important. It is also important to know when the data was last archived or backed up since this determines whether the data can be recovered if it is lost, stolen or corrupted.

Why does the data exist?

This is one of the most important questions because data that is not needed should be deleted. There is no reason to protect data that provides no value. This data is only a liability, for the loss of the data could impact the organization. Even if the loss is inconsequential, storing, indexing and managing data takes time and money, so organizations would be well served to remove nonessential data.

Why waste time and money implementing security that does not address the data itself? This all too common approach often results in some data being under protected or not protected at all, while other data is overprotected. Furthermore, since the organization does not know of some data, a breach of that data is more likely to go unnoticed. Understand the five W’s and create security controls, policies and procedures to govern how the data is used, stored, shared and deleted.

https://www.boldonjames.com/the-5-ws-of-data-identification-and-inventory/