Sophos Update

Removal of Inactive Devices for Endpoint and Server

• Sophos Central can be configured to remove devices automatically (Delete) if these have been inactive for a specified length of time
• Removing devices mean that these will no longer be listed on the Devices page and won't be managed by Sophos Central
• Removal does not delete Sophos software from the devices.
• Devices can be included in setup based on how long these have not checked in to Central, and exclusions can be set up as well.

Sophos DNS Protection is now available

Sophos is announced in mid June that they have added DNS Protection as part of their Xstream Protection to licensed Firewall customers.

Sophos DNS Protection is a valuable service that enhances network security. Here’s what you get:

• Malicious Domain Blocking: Sophos DNS Protection instantly blocks access to unsafe and unwanted domains across all ports, protocols, and applications. It covers both managed and unmanaged devices, providing an extra layer of security.
• Real-Time Threat Intelligence: Backed by SophosLabs’ AI-powered threat intelligence, it offers real-time protection from high-risk domains. When a malicious domain is detected, this information is instantly shared across all customers, ensuring immediate protection for everyone1.
• Easy Deployment: You can set up Sophos DNS Protection in just a few minutes. It’s a cloud-based service managed via Sophos Central.
• Policy Controls: You can configure policies to control domain categories or specific domain lists. This allows you to tailor the protection to your organization’s needs.
• Visibility and Reporting: The service provides comprehensive dashboarding and reporting, giving you insights into the domains visited from your network.
• Integration: Sophos DNS Protection’s log data and intelligence are shared with other Sophos products, enhancing overall threat detection and response.

Remember, it’s available at no extra charge for Sophos Firewall customers with the Xstream Protection bundle. So, it’s a win-win in terms of security and cost savings!

Sophos - Leader for the 14th Time

2023 Gartner® Magic Quadrant™ for Endpoint Protection Platforms

Threats change. Sophos continues to be recognized.

For the 14th consecutive time, Sophos has been named as a Leader in the 2023 Gartner® Magic Quadrant™ for Endpoint Protection Platforms.

We believe this ongoing recognition is a testament to our relentless innovation, deep threat expertise, and continuing adaptation that enables us to defend customers from even the most sophisticated adversaries.

Endpoint protection that works for you and with you

Sophos Endpoint delivers unparalleled threat protection and powerful EDR and XDR tools. Designed for real-world environments and real-world threats, highlights include:

• CryptoGuard anti-ransomware protection that detects and rolls-back both local and remote ransomware attacks
• 60+ exploit mitigations that are deployed automatically – no configuration required
• Adaptive Attack Protection which automatically applies more aggressive protection when a device is under attack
• Critical Attack Warning that identifies an active estate-wide attack and proactively notifies customers so they can take immediate preventative action

Comparison Scores for the Account Health Check

The Account Health Check capability makes it easy for Sophos Endpoint and Server users to optimize their security posture and has already proved hugely popular. We continue to extend this feature, and customers can now compare their own health scores with the average scores of other organizations with a similar number of devices, providing context and motivation for improvement.

In the example below, the customer has an overall score of 49 which is well below the average score of 97. Customers can also compare each of the individual health check scores (e.g., protection installed, policies) to identify where to focus. The drop-down on the right enables users to select their desired comparison cohort.

Continued Industry Recognition

Sophos Endpoint continues to garner high praise from experts across the industry, and recent recognition includes:

• 100% Total Protection Score and two AAA awards in the SE Labs Q2 Endpoint Protection report. Sophos detected and stopped  both commodity, real-world cyberattacks and simulated targeted attacks with 100% accuracy
• Sophos named a Leader by Frost & Sullivan in their inaugural XDR Radar Report
• Sophos awarded Best Endpoint Security in the CRN® Tech Innovator Awards
• Sophos named a Leader in the 2022 Gartner®️ Magic Quadrant™️ for Endpoint Protection Platforms

To learn more about Sophos Endpoint and start a free trial for yourself, visit our website or speak to your Sophos representative or partner.

Gartner, Magic Quadrant™ for Endpoint Protection Platforms, Peter Firstbrook, Chris Silva, 31st December 2022

GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally, Magic Quadrant is a registered trademark of Gartner, Inc. and/or its affiliates and are used herein with permission. All rights reserved.

Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

Introducing the Sophos Incident Response Services Retainer

With tangible ‘readiness’ now a key component for cyber resilience, I’m excited to announce the launch of the Sophos Incident Response Services Retainer. It provides all organizations (whether an existing Sophos customer or not) with speedy access to Sophos’ industry-first fixed-cost incident response service in the event of a breach.

The retainer also includes external vulnerability scanning and critical preparedness guidance, enabling organizations to proactively improve their security resilience by pinpointing and resolving issues that reduce the likelihood of a breach in the first place.

Every Minute Counts

The need for go-to incident response support that can activate immediately has never been higher, as revealed in the latest analysis of Active Adversary behavior by Sophos X-Ops:

• The median dwell time in ransomware attacks fell from nine days in 2022 to five in the first half of 2023
• Attackers take just 16 hours on average to reach Active Directory (AD)
• 90% of ransomware attacks occur outside standard weekday business hours

The Sophos retainer cuts red tape, allowing Sophos incident responders to quickly jump into active cyberattacks to investigate and remediate them, minimizing business impact.

The Importance of Preparedness

Planning and preparedness are complementary elements of an incident response strategy. Having a plan is essential, but you also need to be prepared to implement that plan at short notice – and as the research shows, more likely than not outside standard working hours. The Sophos Incident Response Services Retainer gives you on-demand access to a team of incident response experts that will rapidly stop active attacks and get you back to normal operations.

Reducing Cyber Risk for All Organizations

The Sophos Incident Response Services Retainer is available to non-Sophos organizations as well as customers already using Sophos’ endpoint, XDR, network, email, and other security products, or Sophos MDR Essentials. Endpoint configuration health checks and device audits are also included in the retainer for existing Sophos customers.

Organizations that prefer broader services in one package can purchase Sophos MDR Complete, which automatically includes full-scale incident response.

To learn more about this exciting new service, read the Service Brief and speak to your Sophos representative or partner.

Coming Soon: Critical Attack Warning in Sophos Central

Adaptive Attack Protection came to Sophos Endpoint earlier this year, automatically deploying an elevated level of protection if adversary activity is detected on a particular device. Coming soon, the new Critical Attack Warning extends Sophos Endpoint’s context-sensitive defenses with an estate-wide approach that alerts if adversary activity is detected across multiple devices in the customer’s environment.

When the Critical Attack Warning threshold is met, an alert will be sent to all admins in the Sophos Central account to inform them of the situation and provide attack context and details. Customers can respond themselves using Sophos XDR, seek assistance from their partner, or engage the Sophos Incident Response team, all from within Sophos Central

We’re planning to make Critical Attack Warning available to all customers running Sophos Intercept X Advanced and Sophos XDR via a staged roll-out, due to begin later this month.

Introduction to ZTNA

ZTNA Masterclass - Introduction to ZTNA from Sophos on Vimeo.

Sophos Techvids a great place to learn more about Sophos Products

A great place to visit to view tech tips on using Sophos Protection products. Start here to learn more and view the video below to learn more about this site.

Steps for Setting up Sophos Email Protection through Office 365

Here are the steps on how to set up Sophos email protection through Office 365: For more info

1. Sign in to Sophos Central.
2. Click Email Security > Settings.
3. Click Domain Settings/Status.
4. Click Add Domain.
5. Enter your email domain details, the direction of traffic, and delivery destination details.
6. Next, click Verify Domain Ownership.
7. Copy the TXT value presented in the Verify Domain Ownership dialog. This value is specific to your email domain.
8. Create a TXT DNS record in the root level of the domain name you entered earlier and paste the TXT value that you copied earlier. You can give it the same TXT name as shown or use @ .
9. Once the new TXT DNS record entry is saved, click Verify.
10. Click Exchange then go to Exchange Admin Center.
11. Click Mail flow then click Connectors.
12. The Connectors screen appears. Click the + to add a new connector.
13. Select Partner Organization in the From field.
14. Select Office 365 in the To field.
15. Click Next.
16. Enter a name for the connector. Sophos Email Connector is recommended.
17. Enter a description (optional).
18. If you want to turn the connector on immediately after saving, leave Turn it on checked. Otherwise, uncheck the box to turn it on later.
19. Click Next.
20. Select Use the sender's domain.
21. Click the + to add a sender domain.
22. Enter * to apply the settings to all sender domains.
23. Click Next.
24. Click Save.

Once you have completed these steps, Sophos will start scanning all incoming and outgoing emails for malware and other threats. This will help to protect your organization from a variety of cyberattacks.

Here are some additional tips for setting up Sophos email protection through Office 365:

• Make sure that you have the latest version of Sophos Central and Sophos Email Security installed.
• You may need to create a new Sophos user account for each user in your organization.
• You can use Sophos to create custom policies to control how emails are scanned and delivered.
• Sophos provides a variety of reports that can help you to track the effectiveness of your email security solution.

For more information on setting up Sophos email protection through Office 365, please refer to the Sophos documentation.

Ransomware Attacks: How Sophos CIXA MDR Can Help You Stay Secure

Ransomware attacks are one of the most serious threats to businesses today. They can cripple your operations, damage your reputation, and cost you a fortune in ransom payments and recovery expenses. According to a recent report by Sophos, the average ransom paid by organizations in 2020 was $170,404, and the total recovery cost was $1.85 million.

To protect yourself from ransomware attacks, you need more than just antivirus software or firewalls. You need a comprehensive solution that can detect, respond, and recover from these sophisticated attacks. That's why PAconnect recommends Sophos CIXA MDR (Managed Detection and Response) to our clients.

Sophos CIXA MDR is a cloud-based service that combines advanced endpoint protection, threat intelligence, and 24/7 expert monitoring and response. It leverages artificial intelligence and machine learning to identify and stop ransomware attacks before they can encrypt your data or spread to other devices. It also provides you with a dedicated team of security experts who can help you contain, investigate, and remediate any incidents.

With Sophos CIXA MDR, you can benefit from:

 Enhanced visibility and control over your endpoints

• Reduced risk of data loss and downtime
• Improved compliance and regulatory requirements
• Lower total cost of ownership and operational complexity

 If you want to learn more about how Sophos CIXA MDR can help you protect your business from ransomware attacks, contact PAconnect today. We are a certified Sophos partner with years of experience in delivering IT solutions and services to our clients. We can help you assess your security needs, implement Sophos CIXA MDR, and provide ongoing support and guidance.

Don't let ransomware attacks ruin your business. Trust PAconnect and Sophos CIXA MDR to keep you secure.

Paconnect suggests Sophos Central Email Protection Plus

If you are looking for a reliable and advanced email security solution for your organization, PAconnect suggests considering Sophos Email Protection Advanced. This is a cloud-based service that integrates with Microsoft 365 and other email platforms to provide comprehensive protection against malware, phishing, impersonation, data loss, and encryption.

Sophos Email Protection Advanced uses artificial intelligence (AI) to detect and block new and emerging threats, such as ransomware, zero-day attacks, and business email compromise (BEC). It also leverages Sophos Labs threat intelligence and cloud sandboxing to analyze email attachments and URLs for malicious behavior. Additionally, it offers advanced impersonation protection that can identify phishing attempts that try to spoof trusted senders or domains.

Sophos Email Protection Advanced also helps you secure sensitive data and comply with regulations by offering policy-driven email encryption. You can choose from different encryption options, such as TLS, attachment and message encryption (PDF and Office), or full web portal encryption. You can also create multi-rule data loss prevention (DLP) policies to scan emails and attachments for financials, confidential contents, health information, and personally identifiable information (PII). Sophos Email automatically encrypts messages that contain sensitive data or allows users to encrypt their own messages using an Outlook plugin or an O365 add-in.

Sophos Email Protection Advanced is easy to set up and manage from a single console in Sophos Central. You don't need to redirect your MX records or install any hardware or software. You can also synchronize your email protection with other Sophos products, such as endpoint, firewall, mobile device security, zero trust, and public cloud security. This gives you a unified view of your security posture and enables you to respond faster to threats.

Sophos Email Protection Advanced is a powerful and flexible email security solution that can protect your organization from the most sophisticated email threats. You can try it for free for 30 days or request a quote from Sophos. Sophos has over 30 years of experience in data protection and supports over 27,000 organizations with advanced email threat protection and data security.

PAConnect, Sophos and Cowbell: A Strategic Partnership for Cybersecurity

Cybersecurity is one of the most pressing challenges for businesses in the digital age. As cyber threats become more sophisticated and frequent, organizations need to protect their data, systems and reputation from potential breaches and attacks. However, cybersecurity is not a one-size-fits-all solution. Different businesses have different needs, risks and budgets when it comes to securing their digital assets.

That's why PAConnect, a leading IT solutions provider, has partnered with Sophos and Cowbell, two of the most innovative and trusted names in the cybersecurity industry. Together, they offer a comprehensive and customized cybersecurity package that combines cutting-edge technology, expert services and tailored insurance coverage.

Sophos is a global leader in next-generation cybersecurity solutions that protect millions of users across 150 countries. Sophos offers a range of products and services that cover endpoint protection, network security, cloud security, mobile security and more. Sophos also provides 24/7 threat intelligence and response through its SophosLabs and Sophos Managed Threat Response teams.

Cowbell is a cyber insurance company that leverages artificial intelligence and data science to assess and mitigate cyber risks. Cowbell offers cyber insurance policies that are tailored to each business's unique risk profile and exposure. Cowbell also provides proactive risk management tools and resources to help businesses improve their cybersecurity posture and resilience.

By partnering with Sophos and Cowbell, PAConnect can offer its clients a holistic and integrated approach to cybersecurity that covers prevention, detection, response and recovery. PAConnect can help its clients select the best Sophos products and services for their specific needs and budget, as well as provide installation, configuration, maintenance and support. PAConnect can also help its clients obtain the optimal Cowbell cyber insurance policy that covers their potential losses in case of a cyber incident.

With this strategic partnership, PAConnect, Sophos and Cowbell aim to provide businesses with the peace of mind that they are protected from cyber threats at all levels. Whether it's a ransomware attack, a data breach, a phishing scam or any other cyber risk, PAConnect, Sophos and Cowbell have the solutions to help businesses stay secure and resilient.

PR: Sophos Named the Only Leader Across MDR, XDR, EDR, Endpoint Protection, and Firewall by G2

OXFORD, United Kingdom, April 05, 2023 (GLOBE NEWSWIRE) -- Sophos, a global leader in innovating and delivering cybersecurity as a service, today announced it is named the only Leader across the G2 Grid® Reports for Managed Detection and Response (MDR), Extended Detection and Response (XDR) Platforms, Endpoint Detection and Response (EDR), Endpoint Protection Suites, and Firewall Software in the G2 Spring 2023 Reports. These categories include the enterprise, mid-market and small business segments, and rankings are based on validated customer reviews.

“As adversaries become more sophisticated and elusive, defenders at organizations of all sizes should implement a defense-in-depth strategy that includes protection, detection and response at every point along the attack chain and covers their entire environment. This layered approach should be inclusive of endpoint security, network security, email security, and cloud security, and augmented by threat hunting and remediation services by subject matter security experts. Attackers have refined their methods so much that this range is necessary to stay secure,” said Raja Patel, senior vice president of products at Sophos. “The fact that IT and security professionals recognize Sophos as the Leader across these key categories is validation that Sophos delivers the best and most comprehensive set of products and services required for modern day cybersecurity.”

More Articles on the 3CX Compromise

CSO has a good report and responsible things to do to keep yourself safe.It is worth a read.

Computer Weekly also had an article you can read here.

An updated report from Sophios can be found here. Sophos is one of the first security companies finding, protecting. and reporting on this problem. They are again proving to be on the front edge of the security business.

3CX Desktop Attack: Sophos Customer Information

Here is a good article from Sophos that describes what is going on.

3CX CEO Nick Galea is urging users to uninstall the affected software, which includes versions 18.12.407 and 18.12.416 of the Windows app. The company is working on an update to fully resolve the threat. In the meantime, 3CX says users can use its web-based app as a substitute.

I have moved back to an earlier version of the app in the meantime but we have heard that another update should be available shortly to take care of this issue.

Last week's announcement of Sophos and Cowbell Partnership

Sophos has partnered with Cowbell Cyber Inc. to provide businesses with an easier way to access cyber insurance. The partnership will allow our clients to directly share their security health information with Cowbell to facilitate optimal premium quotes and policies and gain access to Cowbell insurance through Sophos.

The partnership is a further step in Sophos’ journey to support its customers in the efforts to mitigate cyber risk. Specifically, Sophos endpoint customers will be able to ‘opt-in’ to share with Cowbell their endpoint security health status from the Sophos Central platform, using a secure API. The partnership will also allow Cowbell to offer its cyber insurance coverage to Sophos customers in the U.S. through the opt-in sharing of endpoint health security data.

The benefits of the partnership include easier access to cyber insurance for businesses, optimal premium quotes and policies, and the ability to share endpoint security health status with Cowbell to facilitate optimal premium quotes and policies.

Sophos Demonstrates How to Make ChatGPT a Cybersecurity Co-Pilot

I've already talked about Microsoft's new copilot applications and now they're working with their desktop apps, here's an article- press release from Sophos discussing GPT-3 which is the language model behind ChatGPT in how it might be an integral part of deciphering malicious activity found in their data lake. this isn't quite there yet, but this may be an integral part of being able to quickly and more precisely determine if an attack has happened and then help with the possible mitigation of the event. It's worth a quick read if you are interested in this subject.

CRN Post:Sophos CTO Joe Levy On Surging MDR Demand And Endpoint Security Updates

Managed detection and response (MDR) ‘continues to be the fastest-growing offering in the history of Sophos as a company,’ Levy tells CRN.

Services Revolution

Since transitioning its managed threat response offering to a managed detection and response (MDR) service at the end of November, Sophos has seen strong demand that’s not expected to be slowing down anytime soon, Sophos CTO Joe Levy told CRN. The cybersecurity giant disclosed a suite of new endpoint security capabilities that will help feed into the MDR service — as well as the underlying extended detection and response (XDR) platform that helps to power the MDR. The updates include new account health check capabilities and “adaptive active adversary protection,” which offers the ability to disrupt attacks that are in progress and “buy more time for responders,” Levy said.

News: Sophos named a Leader in 2022 Gartner®️ Magic Quadrant™️ for Endpoint Protection Platforms

By Anthony Merry   news.sophos.com   March 2, 2023

We are thrilled to announce that Sophos has, once again, been named a Leader in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms (EPP). This marks our 13th consecutive recognition as a Leader.

A Leader, again

We believe a key factor contributing to our continued Leader position is our relentless focus on innovation. While threats and operating environments have evolved over the last 13 reports, Sophos has continued to keep customers ahead of even the most advanced attacks.

Sophos’ services and products are powered by Sophos X-Ops, our cross-domain threat intelligence unit that brings together deep expertise across the attack environment. Armed with this deep understanding, we are able to build powerful, effective defenses against even the most advanced threats. Unparalleled ransomware protection, deep learning artificial intelligence, exploit prevention, and active adversary mitigations in our endpoint protection stop attacks cold.

Further advancing our cybersecurity leadership with the recent launch of the newly enhanced Sophos MDR service, Sophos is the first endpoint security vendor to deliver MDR across both its own product portfolio as well as customers’ existing security deployments. Sophos MDR now integrates telemetry from third-party endpoint, firewall, cloud, identity, email, and other security technologies as part of the Sophos Adaptive Cybersecurity Ecosystem, further accelerating threat detection and response.

Most trusted MDR service

Sophos MDR is the world’s most trusted MDR service, protecting more than 15,000 organizations against advanced threats that technology alone cannot stop. It addresses the growing need for flexible managed services and threat response options, meeting customers – ranging from small businesses to large corporations – where they are.

Learn more about our service and speak with our security advisers to discuss how Sophos MDR can help you.

Double recognition is a double honor

Our Gartner Magic Quadrant for EPP recognition follows Sophos being named a 2021 Gartner® Peer Insights™ Customers’ Choice for Endpoint Protection Platforms.

To us, being recognized in the Gartner Magic Quadrant for EPP and named a Gartner Peer Insights Customers’ Choice for EPP is a tremendous honor and, we believe, testament to the quality of our protection and service we provide.

Read the full report at https://www.sophos.com/en-us/report/magic-quadrant-endpoint-protection-platforms

---