By adding EDR to Intercept X for Server, IT managers can investigate cyberattacks against servers, a sought-after target due to the high value of data stored there.
Cybercriminals frequently evolve their methods and are now blending automation and human hacking skills to successfully carry out attacks on servers.
This new type of blended attack combines the use of bots to identify potential victims with active adversaries making decisions about who and how to attack.
The SophosLabs Uncut article, Worms Deliver Cryptomining Malware to Web Servers, underscores how easy it is for cybercriminals to leverage bots to discover soft targets.
The report explains an automated attack that can deliver a wide range of malicious code to servers that, as a class, tend to lag behind normal update cycles.
Anatomy of a Blended Cyberattack
Once the bots identify potential targets, cybercriminals use their savvy to select victims based on an organization’s scope of sensitive data or intellectual property, ability to pay a large ransom, or access to other servers and networks.
The final steps are cerebral and manual: break in, evade detection and move laterally to complete the mission.
This could be to quietly sneak around to steal intelligence and exit unnoticed, disable backups and encrypt servers to demand high-roller ransoms, or use servers as launch pads to attack other companies.
“Servers are often overlooked in the IT strategy of companies, hence it is time we realize that servers are critical infrastructure. said Sunil Sharma, Managing Director Sales for Sophos India & SAARC.
“As most malwares today are automated , it has become easier for attackers to find organizations with weak security postures.
Cybercriminals use stolen information for their own spear-phishing campaigns and crime sprees, and can even resell these at a premium on the Dark Web or to a private network of buyers.
This way an entire company could get potentially wiped out if cybercriminals infiltrate its servers with ransomware or malicious code, or exploit vulnerabilities to gain access.
Unfortunately, the mission critical nature of servers restrains many organizations from making changes, often significantly delaying patch deployment.”
Sophos explains how blended cyberattacks work in this video, Intercept X for Server with Endpoint Detection and Response (EDR).
Sophos Intercept X for Server with EDR
With Sophos Intercept X for Server with EDR, IT managers at businesses of all sizes now have visibility across an entire estate.
This allows them to proactively detect stealthy attacks, better understand the impact of a security incident and quickly visualize the full attack history.
“Cybercriminals are counting on this window of opportunity.
Once breached, organizations need to know the full context of what devices and servers were hit in order to improve security as well as answer questions based on stricter regulatory laws.
Having critical information about the attack can help businesses resolve issues much faster and prevent them from a repeat data breach.” said Sharma.
“If regulators rely on digital forensics as evidence of lost data, then businesses can rely on the same forensics to demonstrate that their data has not been stolen.
Sophos Intercept X for Server with EDR provides this required insight and security intelligence.”
Sophos Intercept X for Server with EDR expands Sophos’ offering of EDR, which was first announced for endpoints in October 2018. Sophos EDR is powered by deep learning technology for more extensive malware discovery.
Sophos’ deep learning neural network is trained on hundreds of millions of samples to look for suspicious attributes of malicious code to detect never-before-seen threats.
It provides broad, expert analysis of potential attacks by comparing the DNA of suspicious files against the malware samples already categorized in SophosLabs.
“Our research shows that concerns about security and skills shortages are top of mind with IT and security leadership at many organizations," said Fernando Montenegro, senior industry analyst at 451 Research.
“With cyber threats coming from multiple vectors and at a constant rate, businesses can’t afford to have a gap in their visibility.
We believe that, as security teams look for opportunities to enhance their protection, bringing together EDR features and visibility across endpoints and servers is a positive step towards greater efficiency.”
With Sophos’ EDR feature, IT managers also have on-demand access to curated intelligence from SophosLabs, guided investigations into suspicious events, and recommended next steps.
To maintain full visibility into the threat landscape, SophosLabs tracks, deconstructs and analyzes 400,000 unique and previously unseen malware attacks each day.
“Our customers use Sophos Intercept X with EDR for their endpoints, and the feedback we’ve had is that Sophos’ EDR is easy to implement, easy to use and easy to manage.
This reduces the skills needed to manage EDR and makes our customers much more effective at their protecting servers, a critical factor considering the high rate of attacks there,” said Sam Heard, president of Data Integrity Services, a Sophos partner in Lakeland, Fla.
“With EDR for servers, Sophos is building upon its industry leading Intercept X endpoint protection.
Sophos is also the only vendor to bring all of its security products together on one cloud-based management platform, Sophos Central, and connect its endpoint and network protection through Synchronized Security.
Adding EDR for servers is yet another key industry advancement that will protect our customers.”
Pricing and Availability
Pricing and availability details are available from Sophos partners worldwide.
For more information, please reference the SophosLabs Uncut article, Worms Deliver Cryptomining Malware to Web Servers, and a related article on Naked Security.
Additional information about Sophos Intercept X for Server with EDR is available on Sophos.com.
About Sophos
Sophos is a leader in next-generation endpoint and network security.
As the pioneer of synchronized security, Sophos develops its innovative portfolio of endpoint, network, encryption, web, email and mobile security solutions to work better together.
More than 100 million users in 150 countries rely on Sophos solutions as the best protection against sophisticated threats and data loss.
Sophos products are exclusively available through a global channel of approximately 47,000 partners.
Sophos is headquartered in Oxford, UK and is publicly traded on the London Stock Exchange under the symbol "SOPH."
More information is available at www.sophos.com.
