Sophos introduces Intercept X for Server to block cyber attacks

Sophos announced Intercept X for the protection of servers against cyber threats. Sophos utilises deep learning neural network in order to identify a prospective harm in the form of code or unknown malware attacks.

Sophos Labs research indicates that 75 per cent of malware found in an organization is unique to that organization, indicating the majority of malware is previously unknown.

A recent Sophos survey reveals that two-thirds of IT managers worldwide don’t understand what anti-exploit technology is, leaving their organizations vulnerable to data breaches. Once inside a network, cybercriminals can use persistent and lateral moves to target and takeover servers to access the high-value data stored there, such as personally-identifiable information (PII), banking, tax, payroll and other financial records, proprietary intellectual properties, shared applications – all of which can be sold on the dark web or used for other types of attacks and monetary gain.

Servers can also suffer collateral damage from ransomware and run-of-the-mill cyberattacks. Attacks reaching servers can be more devastating to a business than attacks on endpoints, due to the critical data they hold.

Attackers also use breached servers as proxies to redirect traffic to malicious websites and are now installing cryptominers on server farms and cloud accounts, so they can generate crypto-currencies by stealing a company’s CPU, RAM, electricity, and other resources. The motives of cybercriminals based on how servers are utilized, what’s stored there and what can be leveraged for multiple crimes underscores the need for predictive, server-designed security with advanced anti-exploit technology that helps protect even unpatched systems.

In order to tackle various aforementioned threats to servers of organisations, Sophos claims below features to have been incorporated in the Intercept X for server:

Deep learning neural network

- Leverages the deep neural network from Intercept X to detect new and previously unseen malware and unwanted applications.

- Once deployed, the model constantly updates and identifies critical attributes resulting in decisions between benign and malware payloads.

Active adversary mitigation

- Blocks determined cybercriminals and persistent techniques commonly used to evade traditional anti-virus protection.

- Credential theft protection prevents theft of authentication passwords from memory, registries and local storage.

- Code cave utilization detects the presence of malicious code deployed into legitimate applications.

Exploit protection

- Prevents an attacker from leveraging known vulnerabilities.

- Protects against browser, plugin or java-based exploit kits even if servers are not full patched.

Master boot-record protection

- WipeGuard expands upon Intercept X anti-ransomware technology and prevents ransomware variants or malicious code that target the master boo record.

Root cause analysis

- Detection and incident response technology provides forensic detail of how the attack got in, where it went, and what it touched.

- Provides recommendations on what to do next after an analysis of the attack.

Cloud workload discovery for server

- Discovers and protects servers running on the public cloud, including Microsoft Azure and Amazon Web Services.

- Prevents risk exposure from rogue IT or forgotten assets.

As for the availability of the system, Sophos Intercept X for server is available from registered Sophos partners.