sb-eu logo
Story image

Sophos XG Firewall adds lateral movement protection

03 Dec 2018

Sophos has added lateral movement protection capabilities to its XG Firewall offering. The new capabilities will help to prevent targeted, manual cyber attacks and exploits from further infiltrating a compromised network.

Cybercriminals often gain access through weak entry points and brute-force Remote Desktop Protocol passwords.

From there, they can cause severe damage to systems through lateral movement because they can move around, steal information, disable controls and backups, and more.

Examples like the SamSam ransomware, BitPaymer, Dharma and Ryuk all use similar lateral movement techniques to conduct attacks.

Sophos senior vice president and general manager of products, Dan Schiappa, explains:

“Many organisations are set up to protect against automatic bots, but not interactive, human-driven attacks. If active adversaries get into a system they can ‘think laterally’ to troubleshoot roadblocks, evade detection and move around. It’s hard to stop them unless the right security measures are in place.”

“Most lateral movements happen on the endpoint, which is why synchronizing security is important. Attackers will attempt to advance using non-malware techniques, such as exploits, Mimikatz and privilege escalation. The network needs to know to respond and automatically shut down or isolate infected machines before anyone or anything spreads further.”

He believes that lateral movements can be stopped by sharing intelligence from the firewall and endpoints. Isolation of infected systems is critical for businesses.

 “Unfortunately, many business environments could have blind spots on their network switches or LAN segments, and these can become secret launch pads for attacks.”

Sophos XG Firewall is now able to stop threats from spreading, even when it doesn’t have direct control over traffic.

It also works in conjunction with other Sophos offerings, including the Intercept X Advanced with Endpoint Detection and Response (EDR).

They both connect via a ‘Security Heartbeat’ in Sophos’ Synchronized Security technology that enables the automatic isolation of high-risk endpoints from other endpoints on the same broadcast domain or network segment. 

Additional new and enhanced features in Sophos XG Firewall include: •  Protection Enhancements - Deeper, broader IPS coverage with increased granularity in patterns - JavaScript cryptojacking protection •  Sandstorm Sandboxing Enhancements -   Intercept X integration to identify zero-day threats before they enter the network -  Deep behavioural, network and memory analysis with machine learning, CryptoGuard, and exploit detection •  Networking Enhancements -   New Sophos Connect IPSec VPN client with support for Synchronized Security •   Education Features -   Chromebook client authentication support for user-based policy and reporting -  User/group policy support for SafeSearch and YouTube restrictions

Sophos XG Firewall is available from registered Sophos partners worldwide.

Story image
CrowdStrike integrates with ServiceNow program to bolster incident response
As part of the move, users can now integrate device data from the CrowdStrike Falcon platform into their incident response process, allowing for the improvement of both the security and IT operation outcomes.More
Story image
Kaspersky finds red tape biggest barrier against cybersecurity initiatives
The most common obstacles that inhibit or delay the implementation of industrial cybersecurity projects include the inability to stop production (34%), and bureaucratic steps, such as a lengthy approval process (31%) and having too many decision-makers (23%). More
Story image
The guide to digital security in unstable times
An increase in vulnerability across different sectors has meant that 2020 has seen more than its fair share of cybersecurity incidents. One of the most effective ways to combat the perils of today’s cyber-threats is to gain a better knowledge of the threat vectors looming over the heads of organisations. More
Story image
Proofpoint launches new SMB focused security awareness training
Proofpoint has launched security awareness training for small to medium businesses (SMBs) with the aim of reducing successful phishing attacks and malware infections to almost zero. More
Story image
Phishing scam imitates SharePoint & OneNote for nefarious clicks
Sophos researchers say that the attackers take a slightly different approach to the standard ‘fake login’ phishing email.More
Story image
75% of IT execs 'worried' about being targeted in cyber-attack
A new report from ConnectWise has shed light on the widespread concern about cyber-attacks, with 91% of SMB executives considering a move to an MSP if it provided the 'right' solution.More