Sophos, a global leader in next-generation cybersecurity, today unveiled new advancements to Sophos Cloud Workload Protection, including new Linux host and container security capabilities.

These enhancements accelerate the detection and response of in-progress attacks and security incidents within Linux operating systems, improve security operations and bolster application performance.

According to new SophosLabs research, distributed denial-of-service (DDoS) tools, cryptocurrency miners and various types of backdoors were the top three types of Linux threats detected by Sophos in a dataset from January through March 2022. DDoS tools accounted for nearly half of all Linux malware detections during this time, likely due to automated attacks attempting to reinfect updated servers rapidly and repeatedly.

SophosLabs has also detected a recent increase in ransomware attackers attempting to use tools targeting virtual machine hypervisors, many of which run on Linux environments, to carry out their attacks.

“Linux environments continue to grow in surface area as organizations around the world increasingly migrate workloads to the cloud. Even though Linux is widely considered to be one of the most secure operating systems, it still harbors inherent and application-based risks and it is not immune to cyberattacks,” said Joe Levy, Chief Technology and Product Officer at Sophos.

“Attackers target Linux hosts and containers because they are high value, and often under-protected. Sophos Cloud Workload Protection already automates and simplifies the prevention and detection of these attacks on Windows systems, and now Sophos is providing the same observations and capabilities to Linux operating systems.”

Securing Linux Infrastructure

Through the integration of Capsule8 technology, which Sophos acquired in July 2021, Sophos Cloud Workload Protection provides powerful and lightweight visibility into on-premise, data center, and cloud-based Linux hosts and containers, securing them from advanced cyberthreats.

It leverages analytics around attacker tactics, techniques, and procedures (TTPs) to provide cloud-native threat detections, including:

  • Container escapes: Identifies attackers escalating privileges from container access to hosts
  • Cryptominers: Detects behaviors commonly associated with cryptocurrency miners
  • Data destruction: Alerts that an attacker may be trying to delete indicators of compromise that are part of an ongoing investigation
  • Kernel exploits: Highlights if internal kernel functions are being tampered with on a host

Once threats are detected, Sophos XDR (extended detection and response) assigns risk scores to incidents and provides contextual data that enable security analysts as well as the Sophos Managed Threat Response team to streamline investigations and focus on the highest priority incidents. Integrated Live Response further establishes a secure command line terminal to hosts for rapid remediation.

Sophos Cloud Workload Protection seamlessly integrates with the Sophos Adaptive Cybersecurity Ecosystem, which underpins the entire Sophos portfolio of solutions.

The smart ecosystem unifies Sophos’ range of cloud-native security platform capabilities, including Sophos Cloud Workload Protection, Sophos Cloud Security Posture Management, Kubernetes security posture management, container image scanning, infrastructure-as-code scanning, cloud infrastructure entitlements management, and cloud spend monitoring, to ensure visibility, security, and compliance.

Availability

Sophos Cloud Workload Protection is now available with Sophos Intercept X Advanced for Server with XDR and Sophos Managed Threat Response and is managed within the cloud-native Sophos Central platform.

It can be deployed as a single agent solution that is ideally suited for security operations teams, delivering flexible, lightweight protection with optimized resource limits, without deploying a kernel module.

Sophos Cloud Workload Protection will also soon be available as a Linux sensor. Ideally suited for DevSecOps and security operations center (SOC) teams requiring deep insight into mission-critical workloads with minimal performance impact, the Linux sensor will provide API integration into existing automation, orchestration, log management, and incident response solutions.


Edited by Luis Monzon
Follow Luis Monzon on Twitter
Follow IT News Africa on Twitter

Sign Up for Our Newsletters

Get notified of the best deals on our WordPress themes.

You May Also Like

UBA & Cellulant Join Forces to Unite Africa’s Payments Ecosystem

Nigeria’s United Bank for Africa (UBA), and Cellulant, a leading Pan-African payments company, have announced a partnership that will extend payment services for merchants and consumers across 19 key African…
View Post

South Africa’s Dis-Chem Takes a Swing at WhatsApp Commerce

Clickatell, a CPaaS innovator and Chat Commerce leader, has been selected by leading South African retailer, Dis-Chem Pharmacies, to enable WhatsApp as its customer communication channel to engage with its…
View Post

Vodacom & Accenture Join Forces for Bespoke Cybersecurity

South African telco Vodacom and Ireland-based IT services company Accenture have partnered to launch Vodacom Managed Security services through Vodacom Business. The partnership was publically announced yesterday via press release.…
View Post

TymeBank Launches Medical Insurance App for South Africans

TymeBank, the South Africa-based exclusively digital retail bank, has announced a new partnership with National HealthCare for affordable medical insurance to consumers, through the launch of TymeHealth, an app-based offering…
View Post

Towards a Stable & Sustainable Future with Power 4.0

A digital overhaul of the power and utilities sector – Power 4.0 – is delivering enhanced process efficiency, improved asset utilization, centralized visibility, better regulatory compliance, enhanced sustainability and stellar…
View Post

Nokia Kenya Dodges a $260,000 Fine in Service Centre Contract Feud

A Kenyan court has reportedly rejected a petition filed by Kenyan dealer TechnoService which is seeking Sh150-million ($257,832.60) from cellphone manufacturer Nokia for allegedly selling some of its businesses to…
View Post