Sophos Extends Antivirus To Cloud

Antivirus and endpoint security vendor Sophos announced the release of Sophos Endpoint Security and Data Protection 9.5 for Windows, containing hooks to cloud-based databases to provide on-demand information about emerging security threats.

In particular, the software's scanning agent has the ability to check applications and files against an online Sophos database containing the latest information on known-bad code and application behaviors. Likewise, for Web browsing, the software can check URLs against a database of 11 million known-bad URLs. The company said it is adding 20,000 to 40,000 new URLs daily.

"We've allowed our e-mail and our Web customers to take advantage of some of this real-time information that we've provided in 9.5, but it's the first time we're extending it to the endpoint," said Arabella Hallawell, VP of corporate strategy for Sophos.

As that suggests, to help counter the continuing growth and severity of malware, antivirus vendors are increasingly moving their signature and profile databases to the cloud. Instead of clogging up businesses' bandwidth by constantly pushing large updates to endpoints, the endpoints query the cloud on demand.

But signatures only go so far, especially when it comes to zero-day attacks, for which no significant solution exists. To that end, the company said that the new 9.5 software contains a more refined host intrusion prevention system (HIPS), which compares applications before and at runtime with profiles stored in the cloud-based database to better identify malicious applications or files and reduce false positives.

Having endpoint-based HIPS isn't new, but most companies avoid using it. According to a Forrester Research study of North American small and midsize businesses -- 20 to 1,200 users -- only about 6% of organizations currently use HIPS, and only 8% plan to implement it within the next 12 months.

"The issue from HIPS has been the noise," said Mark Harris, VP of SophosLabs and global engineering operations for Sophos. "The uptake on this technology is relatively slow, because too often it requires the user or administrator to make a decision."

Furthermore, software may look like malware, yet still be legitimate. "A good example is Rapport, which is the security tool that a number of U.K. banks are asking customers to install," said Harris. "It does a lot of things you'd expect a banking Trojan to do: injects itself into processes and monitors things, and if you were using pre-run behavior protection, you'd get a lot of alerts."

Instead, using the live-lookup feature, the application can be given the green light, he said. "We're able to look at a file or program and say, yes it looks like it's doing bad things, but because we've got real-time visibility, it looks like it's an updater to a well-known program, or security software that banks want their customers to use."