Network and endpoint security vendor Sophos has launched Sophos Intercept X for Server, its next-generation server protection platform equipped with predictive deep learning technology.
Sophos’ deep learning neural networks are trained on hundreds of millions of samples to look for suspicious attributes of malicious code and prevent never-before-seen malware attacks. SophosLabs research indicates that 75% of malware found in an organisation is unique to that organisation, indicating the majority of malware is previously unknown.
“Servers are the bullseye for cybercriminals because they store valuable information and have a broader, system-wide organisational purpose than individual endpoints. An entire company could get potentially wiped out if cybercriminals infiltrate its servers with ransomware or malicious code, or exploit vulnerabilities to gain access. Once breached, attackers can get deep in the network and have the ability to do some serious damage, as well as exfiltrate data,” said Dan Schiappa, senior vice president and general manager of products at Sophos.
Cybercriminals use stolen information for their own spear-phishing campaigns and crime sprees, or they could resell it at a premium price on the Dark Web or to a private network of buyers. Sophos threat experts have seen access to compromised servers for sale on the Dark Web, in addition to the poached data itself – a bonus for cybercriminals, but a double whammy for businesses,” said Schiappa.
A recent Sophos survey reveals that two-thirds of IT managers worldwide don’t understand what anti-exploit technology is, leaving their organisations vulnerable to data breaches. Once inside a network, cybercriminals can use persistent and lateral moves to target and takeover servers to access the high-value data stored there, such as personally-identifiable information (PII), banking, tax, payroll and other financial records, proprietary intellectual properties, shared applications – all of which can be sold on the Dark Web or used for other types of attacks and monetary gain. Servers can also suffer collateral damage from ransomware and run-of-the-mill cyberattacks. Attacks reaching servers can be more devastating to a business than attacks on endpoints, due to the critical data they hold.
Attackers also use breached servers as proxies to redirect traffic to malicious websites and are now installing cryptominers on server farms and cloud accounts, so they can generate crypto-currencies by stealing a company’s CPU, RAM, electricity, and other resources. The motives of cybercriminals based on how servers are utilized, what’s stored there and what can be leveraged for multiple crimes underscores the need for predictive, server-designed security with advanced anti-exploit technology that helps protect even unpatched systems.
“Servers are critical infrastructure, but they are often overlooked in the endpoint strategy of many companies,” said Schiappa. “It’s not enough to simply install traditional endpoint protection on servers because they demand additional tools and features, such as cloud workload discovery, including Microsoft Azure and Amazon Web Services, and protection to mitigate risk from rogue or forgotten IT assets. Server-specific protection is necessary to a successful layered security strategy to reduce the risk of a data breach. Combined with Sophos’ Synchronized Security intelligence sharing and easy management from our Sophos Central dashboard, Intercept X for Server is a powerful addition that helps defend businesses from becoming the next victim.”
