Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

Sophos Extends Antivirus To Cloud

Live security lookups and a refined host intrusion prevention system scan for viruses, malware, and malicious Web sites.

Antivirus and endpoint security vendor Sophos announced the release of Sophos Endpoint Security and Data Protection 9.5 for Windows, containing hooks to cloud-based databases to provide on-demand information about emerging security threats.

In particular, the software's scanning agent has the ability to check applications and files against an online Sophos database containing the latest information on known-bad code and application behaviors. Likewise, for Web browsing, the software can check URLs against a database of 11 million known-bad URLs. The company said it is adding 20,000 to 40,000 new URLs daily.

"We've allowed our e-mail and our Web customers to take advantage of some of this real-time information that we've provided in 9.5, but it's the first time we're extending it to the endpoint," said Arabella Hallawell, VP of corporate strategy for Sophos.

As that suggests, to help counter the continuing growth and severity of malware, antivirus vendors are increasingly moving their signature and profile databases to the cloud. Instead of clogging up businesses' bandwidth by constantly pushing large updates to endpoints, the endpoints query the cloud on demand.

But signatures only go so far, especially when it comes to zero-day attacks, for which no significant solution exists. To that end, the company said that the new 9.5 software contains a more refined host intrusion prevention system (HIPS), which compares applications before and at runtime with profiles stored in the cloud-based database to better identify malicious applications or files and reduce false positives.

Having endpoint-based HIPS isn't new, but most companies avoid using it. According to a Forrester Research study of North American small and midsize businesses -- 20 to 1,200 users -- only about 6% of organizations currently use HIPS, and only 8% plan to implement it within the next 12 months.

"The issue from HIPS has been the noise," said Mark Harris, VP of SophosLabs and global engineering operations for Sophos. "The uptake on this technology is relatively slow, because too often it requires the user or administrator to make a decision."

Furthermore, software may look like malware, yet still be legitimate. "A good example is Rapport, which is the security tool that a number of U.K. banks are asking customers to install," said Harris. "It does a lot of things you'd expect a banking Trojan to do: injects itself into processes and monitors things, and if you were using pre-run behavior protection, you'd get a lot of alerts."

Instead, using the live-lookup feature, the application can be given the green light, he said. "We're able to look at a file or program and say, yes it looks like it's doing bad things, but because we've got real-time visibility, it looks like it's an updater to a well-known program, or security software that banks want their customers to use."

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12420
PUBLISHED: 2019-12-12
In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended fix but details will not be shared publicly.
CVE-2019-16774
PUBLISHED: 2019-12-12
In phpfastcache before 5.1.3, there is a possible object injection vulnerability in cookie driver.
CVE-2018-11805
PUBLISHED: 2019-12-12
In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA 3.4.3, we recommend that users should only use update channels or 3rd party .cf ...
CVE-2019-5061
PUBLISHED: 2019-12-12
An exploitable denial-of-service vulnerability exists in the hostapd 2.6, where an attacker could trigger AP to send IAPP location updates for stations, before the required authentication process has completed. This could lead to different denial of service scenarios, either by causing CAM table att...
CVE-2019-5062
PUBLISHED: 2019-12-12
An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 802.11w sessions. By simulating an incomplete new association, an attacker can trigger a deauthentication against stations using 802.11w, resulting in a denial of...