GRTech
Sophos Partners with Tenable to Launch New Sophos Managed Risk Service
. New Fully Managed Solution Provides Visibility, Risk Monitoring, Prioritization, Investigation, and Proactive Notification to Prevent Cyberattacks
April 4, 2024 – Sophos, a global leader of innovative security solutions that defeat cyberattacks, today announced a strategic partnership with Tenable, the Exposure Management company, to provide Sophos Managed Risk, a worldwide vulnerability and attack surface management service.
The new service features a dedicated Sophos team that leverages Tenable’s exposure management technology and collaborates with the security operations experts from Sophos Managed Detection and Response (MDR) to provide attack surface visibility, continuous risk monitoring, vulnerability prioritization, investigation, and proactive notification designed to prevent cyberattacks.
The modern attack surface has expanded beyond traditional on-premises IT boundaries, with organizations operating frequently unknown numbers of external and internet-facing assets that are unpatched or under protected, leaving them vulnerable to cyberattackers.
This is evident in the newest Sophos Active Adversary Report, also released, which identifies three tasks that organizations must prioritize to minimize the risk of brazen intrusions that lead to ransomware or other types of attacks.
These include closing exposed Remote Desktop Protocol (RDP) access, enabling multi-factor authorization and patching vulnerable servers, all of which were top entry points in breaches handled by Sophos Incident Response in 2023.
The Sophos Managed Risk service can assess an organization’s external attack surface, prioritize the riskiest exposures, such as open RDP, and provide tailored remediation guidance to help eliminate blind spots and stay ahead of potentially devastating attacks.
“Sophos and Tenable are two industry security leaders coming together to address urgent, pervasive security challenges that organizations continuously struggle to control. We can now help organizations identify and prioritize the remediation of vulnerabilities in external assets, devices and software that are often overlooked. It is critical that organizations manage these exposure risks, because unattended, they only lead to more costly and time-consuming issues and are often the root causes of significant breaches,” said Rob Harrison, senior vice president for endpoint and security operations product management at Sophos. “We know from Sophos’ worldwide survey data that 32% of ransomware attacks start with an unpatched vulnerability and that these attacks are the most expensive to remediate. The ideal security layers to prevent these issues include an active approach to improving security postures by minimizing the chances of a breach with Sophos Managed Risk, Sophos Endpoint, and 24×7 Sophos MDR coverage.”
“While the latest zero day may dominate the headlines, the biggest threat to organizations, by a large margin, is still known vulnerabilities – or vulnerabilities for which patches are readily available,” said Greg Goetz, vice president of global strategic partners and MSSP, Tenable. “A winning approach includes risk-based prioritization with context-driven analytics to proactively address exposures before they become a problem. Sophos Managed Risk, powered by the Tenable One Exposure Management Platform, delivers outsourced preventive risk management, enabling organizations to anticipate attacks and reduce cyber risk.”
Specific key benefits of Sophos Managed Risk include:
- External Attack Surface Management (EASM): Advanced identification and classification of internet-facing assets, such as web and email servers, web applications, and public-facing API endpoints
- Continuous monitoring and proactive notification of high-risk exposures: Proactive notification when a new critical vulnerability is identified in an organization’s internet-facing assets
- Vulnerability prioritization and identification of new risks: Swift detection of high-risk and zero-day vulnerabilities, followed by real-time notification to ensure critical internet-facing assets are promptly identified, investigated and responded to by order of importance
“One of the biggest challenges organizations face when improving their security posture is prioritizing what to handle first. This type of guidance helps solve that issue and reduces the workload for security teams tasked with tackling vulnerability and exposure management,” said Craig Robinson, research vice president of Security Services, IDC. “Solutions such as Sophos Managed Risk can be a differentiator by enabling overwhelmed teams to take a more holistic approach to continuous monitoring and threat management.”
Sophos Managed Risk is available as an extended service with Sophos MDR, which already protects more than 21,000 organizations globally. The Sophos Managed Risk team is Tenable-certified and works closely with Sophos MDR to share essential information about zero-days, known vulnerabilities and exposure risks to assess and investigate possibly exploited environments.
“Sophos Managed Risk simplifies the difficult and resource consuming task of identifying vulnerabilities, really understanding the extent of risk exposure, and prioritizing necessary remediations,” said Kieron Stone, cybersecurity business development manager at Phoenix Software Ltd. “As a trusted managed service provider (MSP), this is a service we’re proud to stand behind, and nearly all our customers using it have already discovered significant vulnerabilities that they were previously unaware of. For organizations that don’t already have a well-defined vulnerability patching cadence, this is a must-have service for the identification of vulnerabilities and building that schedule; and for organizations that are already managing vulnerabilities, it’s a second set of eyes for added peace of mind that they’re not missing anything.”
Organizations benefit through regular interaction, including scheduled meetings with Sophos experts to review recent discoveries, insights into the current threat landscape, and recommendations for remediation and prioritizing actions. Additionally, organizations can initiate inquiries via the Sophos Central platform, allowing users to directly engage with the Sophos Managed Risk team for tailored support, reports and to review their latest prioritized alerts.
“You can’t fix what you can’t see. Sophos Managed Risk is shining a light on areas of exposure that require remediation in order to keep customers protected. Combining Sophos’ elite MDR experts with Tenable’s industry-leading exposure management technology gives us a full picture view of vulnerabilities with the guidance we need to minimize risk,” said Brooks Roy, president at Communications Consulting, Inc. “The real value add for us as a channel partner is having the ability to easily manage Sophos Managed Risk’s prioritized alerts across our customer base on the Sophos Central dashboard.”
Sophos Managed Risk is available with a term license through Sophos’ global network of channel partners and Managed Service Providers (MSPs). A Sophos MSP Flex version will be available in 2024.
With Black Friday and Cyber Monday around the corner, we’re entering a high-risk period for cybersecurity.
A recent Sophos report highlights that malicious emails were the second most common root cause of ransomware attacks in critical sectors, responsible for 25% of cases.
During peak shopping days, this threat intensifies.
Here’s what happens: with the surge in online deals, more employees may be shopping from their work computers, feeling that Cyber Monday is a legitimate time to do so.
This increases the risk of them clicking more freely and potentially exposing the organization to malicious links or phishing attacks.
To keep your organization safe, encourage your team to follow these simple tips:
• Use an ad blocker – Advertisements are not only tracking your every movement and collecting enough information on your habits to make the FBI blush, but they are also a major source of malicious links and deceptive content on the internet. Not only is your browsing safer, but also faster and uses less bandwidth. Two of our favorites are uBlock Origin and Ghostery.
• Use private browsing or incognito mode – To prevent your shopping habits and interests from following you around from site to site (and potentially revealing what gifts you might be purchasing to others using your device, bonus!), you should enable private browsing (Firefox) or incognito mode (Chrome). This will block tracking cookies and help the internet forget your travels as the waves wash away your footprints in the sand.
• Make your browser “privacy smart” – The Electronic Frontier Foundation (EFF) provides a browser extension called Privacy Badger designed to automatically make all the right choices around browsing whilst maintaining our privacy and blocking invisible trackers.
• Avoid using one account on multiple services – When logging into an e-commerce site it is often tempting to use the “Sign in with Facebook” or “Sign in with Google” button. While it takes a few more minutes to create a new login, it will provide more privacy as you are not sharing all of the sites you shop at with these tech giants.
• Use guest login when available – In addition to letting you use an account from other websites, many have an option to use a guest login rather than creating a new account. This is a great option if you don’t expect to need technical support or to do business on a recurring basis. Fewer passwords, fewer personal details, fewer problems if they get hacked.
• Don’t save card details – Many e-commerce sites will default to storing your credit card information in your profile for your “convenience” (or their hope you’ll shop there again). They can’t lose what they don’t have, so tell them not to store your credit card unless it is absolutely necessary.
• Use temporary card numbers – Many financial institutions now offer temporary or one-time use credit card numbers. You can open the app on your phone or in your browser and get a single-use disposable credit card number preventing card fraud and tracking when merchants share card processors. Sometimes you’re even able to specify a card limit per temporary number to further protect your account.
• Use credit, not debit – All of us need to be wary of overspending during the holidays, but it is best to leave the debit card at home. Credit cards offer significantly more protection against online fraud, and you are in the power position in a dispute. You can simply not pay your bill while disputing the charge, rather than having criminals directly drain your bank account of your hard-earned cash.
• Beware of direct messages via social media/chat apps – With modern generative AI technology it is almost trivial to create an entire fake online store and lure people to share their personal information and payment data with you. It’s safest to shop at established sites or those personally recommended to you by friends and family. Many unsolicited messages lead to data collection or theft.
• Don’t click deals in email that look too good to be true or are from businesses you don’t have accounts from – these could be phishing emails hoping to bait you into clicking links to bogus, malicious web sites.
This season, small steps can make a big difference in protecting against cyber threats.
GRTech
It’s Cybersecurity Awareness Month and Sophos has Some Tips for You!
In the mood of Cybersecurity Awareness Month, Christopher Budd, Director Sophos X-Ops, has compiled some tips for staying secure online.
Cybersecurity Pro Tips:
- Face Scans and Fingerprints are Safer Than Passcodes: Use features like Face ID or fingerprint scans for your devices as much as possible. These are safer than passcodes and devices have good built-in protections for this sensitive information.
- Use Multi-Factor Authentication: Use multi-factor authentication (MFA) whenever possible. This gives an important extra layer of security that makes it harder for cybercriminals to access your accounts. If you can’t use something more secure like secure authenticator applications or physical hardware security keys, use your phone number — it’s safer than using nothing. If you use MFA for only one thing, use it for your email: that’s what attackers want the most.
- Think Before You Share Publicly: Think twice before sharing any information publicly –cybercriminals can use it to access your accounts or to convince someone that they’re you.
- Think about those cute surveys on Facebook with questions about your first car, city you were born in: these are the same kinds of info cybercriminals can use to pretend they’re you and log into and take over your accounts.
- You Don’t Always Need (to keep) the App: Don’t feel pressured to download an app every time: you can often use the service’s website just as well. Apps collect much more data than websites, including your location, your contact list and other info you might not want to share.If you do download an app, think about deleting it when you’re done using it: you can always reinstall it next time you need it.
- Apps from app stores and websites that aren’t the official big names ones like Google Play, Apple’s App Store, Samsung’s Galaxy Store can be very risky. The official stores have security and privacy standards that can identify malicious activity. Always stick to official sources for downloading apps or, if they’re not on the official app stores, download the app from the developer’s official website or use the app’s web version.
- Be On Your Guard for Unexpected Emails and Text Messages: Phishing continues to be one of the most effective tactics cybercriminals use to compromise consumers. If you get an unexpected email or text message, ignore it or at least don’t interact with it (don’t open attachments, don’t click on links). If you think it might be legitimate, reach out directly to who you think sent it and check with them.
- Question Urgency in Emails and Calls: Cybercriminals use urgency to get you to let your guard down and make bad decisions. If someone contacts you saying they’re from a trusted organization like the IRS, police or your bank and need you to take action quickly or something bad will happen, stop and question it. Go to the trusted source like the number on the back of your credit card to independently validate the request.
- Practice Good Password Security: Every account should have its own unique complex password. A strong password is at least 12 characters long with a mix of numbers, upper- and lower-case letters, and punctuation characters. Passwords should not be based on any personal information, and the best ones use a phrase rather than single words. If these passwords are too tough to juggle, try a password manager to stay organized.
- Keep Everything Updated and Run Security Tools. Make sure all your apps and devices are always fully updated. Be sure to have some sort of security software on all of your phones and computers (even if you have a Mac).
- Get Rid of End-of-Life Devices and Software: Everything from operating systems to services to Wi-Fi routers “go stale” and must be replaced eventually. For example, it might surprise you, but your internet router is typically only supported with patches and updates for a few years after you get it. Attackers love out-of-date devices. When something is “out of support” it’s stale: get rid of it and replace it with something fresh.
- Back Up Your Data: While ransomware groups are mostly after businesses that can pay higher ransoms, they still go after people at home. It’s still important to have your data backed up so that you don’t have to consider paying a ransom.
Put Your Mind at Ease Regarding These Cybersecurity Concerns
Part of staying secure requires being able to filter out the noise and prioritize the security actions that matter. Here are things notto worry about. Focus your energy on real risks, not exaggerated threats.
- Public Wi-Fi is Safer Than You Think: Contrary to outdated advice, public Wi-Fi is generally safe due to encryption used by most websites and apps. Use it freely at airports or coffee shops, but avoid sensitive activities.
- Beware of Fearmongering Around New Tech Features: Not every new technology is as risky as it’s made out to be. For example, Apple’s NameDrop feature is generally safe and requires specific conditions to function. However, if you’re concerned, you can easily turn it off in settings.
Stop Stressing Over Public Chargers: The risk of “juice jacking” (data theft from public chargers) is extremely low. Don’t worry about using public phone chargers — just focus on real, more prevalent threats.
eSocialMint Inc., a tech startup based in Houston, is hoping to revolutionize social and professional events with its innovative new app.
Scheduled for launch in Nigeria at the end of the year, eSocialMint (eSM) offers a comprehensive platform that integrates features from popular apps like Facebook, TikTok, Zoom, WhatsApp, and Snapchat.
Designed to transform how events are conducted and experienced, eSM combines social media technology with advanced features such as virtual hologram technology.
Developed by IT architect Fisayo Olamigoke, eSM is available on both web and mobile devices. It offers a range of functionalities, including team events, social events, advertising, an eStore, and the unique “eSprayMe” feature.
This feature allows users to virtually spray money at events, replicating a popular Nigerian cultural practice while adhering to legal regulations.
Targeted at professionals, personal users, public institutions, and governmental bodies, eSM aims to save time and money by reducing the need for physical travel. With its cutting-edge technology and user-friendly interface, eSocialMint is poised to redefine the future of virtual interactions.
Portugal Football Club Signs on 19-Year-Old Nigerian- born Footballer, Yaqub Usman-Malah
Minister Commends Guards Brigade for Exceptional Service in Securing the Seat of Government
Spotify’s ‘Detty December’ Hub and Spotify’s ‘Songs of December’ now live
LASG Acquires New Outboard Engines For Optimum Boat Performance
Elon Musk builds Hotel in Mars, Sets to launch soon at $5million per night – Photos
