sb-au logo
Story image

Sophos extends endpoint detection offering to servers

06 Jun 2019

Network and endpoint security solutions provider Sophos has announced Intercept X for Server with Endpoint Detection and Response (EDR).

By adding EDR to Intercept X for Server, IT managers can investigate cyber attacks against servers, a sought-after target due to the high value of data stored there.

Cybercriminals frequently evolve their methods and are now blending automation and human hacking skills to successfully carry out attacks on servers.

This new type of blended attack combines the use of bots to identify potential victims with active adversaries making decisions about who and how to attack.

SophosLabs Uncut research underscores how easy it is for cybercriminals to leverage bots to discover soft targets.

The report explains an automated attack that can deliver a wide range of malicious code to servers that, as a class, tend to lag behind normal update cycles.

Anatomy of a blended cyberattack

Once the bots identify potential targets, cybercriminals use their savvy to select victims based on an organisation’s scope of sensitive data or intellectual property, ability to pay a large ransom, or access to other servers and networks.

The final steps are cerebral and manual: break in, evade detection and move laterally to complete the mission.

This could be to quietly sneak around to steal intelligence and exit unnoticed, disable backups and encrypt servers to demand high-roller ransoms, or use servers as launch pads to attack other companies.

“Blended cyberattacks, once a page in the playbook of nation-state attackers, are now becoming regular practice for everyday cybercriminals because they are profitable. The difference is that nation-state attackers tend to persist inside networks for long lengths of time whereas common cybercriminals are after quick-hit money making opportunities,” says Sophos chief product officer Dan Schiappa.

“Most malware is now automated, so it’s easy for attackers to find organisations with weak security postures, evaluate their payday potential, and use hand-to-keyboard hacking techniques to do as much damage as possible.”

Sophos Intercept X for Server with EDR

With Sophos Intercept X for Server with EDR, IT managers at businesses of all sizes now have visibility across an entire estate.

This allows them to proactively detect stealthy attacks, better understand the impact of a security incident and quickly visualise the full attack history.  

“When adversaries break into a network, they head straight for the server. Unfortunately, the mission-critical nature of servers restrains many organisations from making changes, often significantly delaying patch deployment,” Schiappa says.

“Cybercriminals are counting on this window of opportunity. If organisations do fall victim to an attack, they need to know the full context of what devices and servers were hit in order to improve security as well as answer questions based on stricter regulatory laws,” he adds.

“Knowing this information accurately the first time can help businesses resolve issues much faster and prevent them from a repeat data breach.

“If regulators rely on digital forensics as evidence of lost data, then businesses can rely on the same forensics to demonstrate their data has not been stolen. Sophos Intercept X for Server with EDR provides this required insight and security intelligence.”

Sophos Intercept X for Server with EDR expands Sophos’ offering of EDR, which was first announced for endpoints in October 2018.

Sophos EDR is powered by deep learning technology for more extensive malware discovery.

Sophos’ deep learning neural network is trained on hundreds of millions of samples to look for suspicious attributes of malicious code to detect never-before-seen threats.

It provides broad, expert analysis of potential attacks by comparing the DNA of suspicious files against the malware samples already categorised in SophosLabs.

“With cyber threats coming from multiple vectors and at a constant rate, businesses can’t afford to have a gap in their visibility,” says 451 Research senior industry analyst Fernando Montenegro.

“We believe that, as security teams look for opportunities to enhance their protection, bringing together EDR features and visibility across endpoints and servers is a positive step towards greater efficiency.”

Story image
Data leakage concerns dominate cloud security perceptions - Bitglass report
How secure is the public cloud? That’s what many IT and security professionals are asking as data leakage becomes a pressing concern for organisations and their data protection strategies.More
Story image
Forescout expands integrations with partner solutions
Expanded partnerships and integrations with Splunk, CrowdStrike and CyberArk allow for better IT and OT security posture for joint customers.More
Story image
Zerto launches security solutions for containerised applications
The company has launched its beta program of Zerto for Kubernetes (Z4K), an extension of its Zerto Platform, to support next-generation, cloud native applications.More
Story image
Is the 'fast follower' mentality holding back anti-money laundering in Australia?
The decade-old rules-based systems cannot keep up with sophisticated cyberattacks and money laundering threats on their own, writes FICO financial crimes leader for APAC Timothy Choon.More
Story image
Forrester names Thycotic a Leader in privileged access management
Thycotic received the highest possible score in 11 of the 24 criteria in the study, including SaaS/cloud, innovation roadmap, and integrations, deployment, supporting products and services, commercial model, and PIM installed base.More
Story image
Video: 10 Minute IT Jams - SonicWall VP on the benefits of Boundless Cybersecurity
Today's interviewee will discuss the ins and outs of the company's Boundless Cybersecurity solution and how it can help APAC organisations adjust to the new normal, as well as explaining the 'cybersecurity business gap'.More