Sophos (LSE: SOPH), a global leader in network and endpoint security, today announced Sophos Intercept X for Server, next-generation server protection with predictive deep learning technology that provides constantly evolving security against cyber threats. Sophos’ deep learning neural networks are trained on hundreds of millions of samples to look for suspicious attributes of malicious code and prevent never-before-seen malware attacks. SophosLabs research indicates that 75 percent of malware found in an organization is unique to that organization, indicating the majority of malware is previously unknown.

A recent Sophos survey reveals that two-thirds of IT managers worldwide don’t understand what anti-exploit technology is, leaving their organizations vulnerable to data breaches. Once inside a network, cybercriminals can use persistent and lateral moves to target and takeover servers to access the high-value data stored there, such as personally-identifiable information (PII), banking, tax, payroll and other financial records, proprietary intellectual properties, shared applications – all of which can be sold on the Dark Web or used for other types of attacks and monetary gain. Servers can also suffer collateral damage from ransomware and run-of-the-mill cyberattacks. Attacks reaching servers can be more devastating to a business than attacks on endpoints, due to the critical data they hold.

Sophos demonstrates hacking and advanced exploit techniques that cybercriminals use in this Video of How Active Adversaries Attack in Real-Time (also found on Sophos.com/Servers).

“Servers are the bullseye for cybercriminals because they store valuable information and have a broader, system-wide organizational purpose than individual endpoints. An entire company could get potentially wiped out if cybercriminals infiltrate its servers with ransomware or malicious code, or exploit vulnerabilities to gain access. Once breached, attackers can get deep in the network and have the ability to do some serious damage, as well as exfiltrate data,” said Dan Schiappa, senior vice president and general manager of products at Sophos. “Cybercriminals use stolen information for their own spear-phishing campaigns and crime sprees, or they could resell it at a premium price on the Dark Web or to a private network of buyers. Sophos threat experts have seen access to compromised servers for sale on the Dark Web, in addition to the poached data itself - a bonus for cybercriminals, but a double whammy for businesses.”

Attackers also use breached servers as proxies to redirect traffic to malicious websites and are now installing cryptominers on server farms and cloud accounts, so they can generate crypto-currencies by stealing a company’s CPU, RAM, electricity, and other resources. The motives of cybercriminals based on how servers are utilized, what’s stored there and what can be leveraged for multiple crimes underscores the need for predictive, server-designed security with advanced anti-exploit technology that helps protect even unpatched systems.

“Servers are critical infrastructure, but they are often overlooked in the endpoint strategy of many companies,” said Schiappa. “It’s not enough to simply install traditional endpoint protection on servers because they demand additional tools and features, such as cloud workload discovery, including Microsoft Azure and Amazon Web Services, and protection to mitigate risk from rogue or forgotten IT assets. Server-specific protection is necessary to a successful layered security strategy to reduce the risk of a data breach. Combined with Sophos’ Synchronized Security intelligence sharing and easy management from our Sophos Central dashboard, Intercept X for Server is a powerful addition that helps defend businesses from becoming the next victim.”

The need for server protection exists in organizations of all sizes, with smaller businesses being potentially at more risk than larger, better resourced enterprises as Frank Dickson, research vice president, Security Products with IDC commented, “The small- and mid-sized markets (SMBs) face challenges for server protection as they need the same level of protection as their enterprise counterparts, yet protection must be in an extremely easy to use offering. Additionally, sadly, SMBs are too often tempted to use underpowered, inappropriate PC endpoint offerings to protect servers as a way to save cost, forcing SMB server security vendors to provide compelling, affordable offerings that are also appropriate for a smaller or understaffed IT department.”

Regarding Sophos’ approach directly, Dickson continued, “Sophos addresses the ease-of-use factor by integrating their products on Sophos Central, so there’s one dashboard for Partners and customers to manage each security layer regardless of being on premise or in the cloud. The new Intercept X for Server significantly advances server protection with deep learning, anti-exploit and other key technology elements. The anti-exploit technology has a client right on the server, a necessary requirement based on the manner in which hackers leverage server vulnerabilities to breach systems. Given the readily available and inexpensive exploit kits for sale on the Dark Web, even cybercriminals with little expertise can launch powerful attacks, making sophisticated, server specific protection a fundamental requirement.”

Sophos partners familiar with the new product echoed Dickson’s observations:

“Sophos understands that servers need their own set of security criteria, like the lockdown feature in the current server solution, and the new ability to discover cloud workloads. Many of Riverlite’s clients, companies with under-staffed IT personnel, require us to keep cloud deployments secure and free from disruption,” said Simon Barnes, principal consultant at Riverlite in St. Neots, Cambridgeshire, UK. “Having assets in the cloud or migrating and using public clouds can be daunting to any business. It’s important that MSPs have the right security in place to protect these ‘invisible’ servers, which are easily forgotten from an overall security strategy. This type of exposure weakens a company’s security posture. If any unprotected server is attacked it can wreak havoc on an entire business. We’re looking forward to upgrading and adding Intercept X for Server to our customers’ security portfolios.” 

Syndesi is a Managed Service Provider (MSP) with particular interest in the unique cyber security challenges faced by the education sector, including data theft, disruption of operations and compromised technology assets. “For attackers, K-12 schools are a particularly attractive target because they store and handle the personal data of students, parents and staff. Many school districts are vulnerable due to budgetary constraints or limited IT resources, making them an easy target,” said Paul Gibbs, vice president of Syndesi Solutions, based in Athens, Alabama. “An integrated, layered security system that stops ransomware, malware and data theft is paramount. We can now add Intercept X for Server with deep learning technology and Synchronized Security to strengthen the protection of sensitive assets stored on school servers and at other customer sites. We’ve already seen situations where Sophos Intercept X has blocked ransomware on endpoints almost immediately after its first appearance. If servers are hit with ransomware or malware, it’s devastating, so we’re excited for this quick response and the synchronized intelligence-sharing at the server layer as well.”

New features in Sophos Intercept X for Server include:

Deep Learning Neural Network

Leverages the deep neural network from Intercept X to detect new and previously unseen malware and unwanted applications
Once deployed, the model constantly updates and identifies critical attributes resulting in more accurate decisions between benign and malware payloads
Active Adversary Mitigation

Blocks determined cybercriminals and persistent techniques commonly used to evade traditional anti-virus protection
Credential Theft Protection prevents theft of authentication passwords from memory, registries and local storage
Code Cave Utilization detects the presence of malicious code deployed into legitimate applications
Exploit Protection

Prevents an attacker from leveraging known vulnerabilities
Protects against browser, plugin or java-based exploit kits even if servers are not full patched
Master Boot-Record Protection

WipeGuard expands upon Intercept X anti-ransomware technology and prevents ransomware variants or malicious code that target the Master Boot-Record
Root Cause Analysis

Detection and incident response technology provides forensic detail of how the attack got in, where it went, and what it touched
Provides recommendations on what to do next after an analysis of the attack
Cloud Workload Discovery for Server

Discovers and protects servers running on the public cloud, including Microsoft Azure and Amazon Web Services
Prevents risk exposure from rogue IT or forgotten assets
Availability

Sophos Intercept X for Server is available from registered Sophos partners worldwide. Additional information can be found on Sophos.com. To sign up for a free 30 day trial, click here.