Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

Sophos Extends Antivirus To Cloud

Live security lookups and a refined host intrusion prevention system scan for viruses, malware, and malicious Web sites.

Antivirus and endpoint security vendor Sophos announced the release of Sophos Endpoint Security and Data Protection 9.5 for Windows, containing hooks to cloud-based databases to provide on-demand information about emerging security threats.

In particular, the software's scanning agent has the ability to check applications and files against an online Sophos database containing the latest information on known-bad code and application behaviors. Likewise, for Web browsing, the software can check URLs against a database of 11 million known-bad URLs. The company said it is adding 20,000 to 40,000 new URLs daily.

"We've allowed our e-mail and our Web customers to take advantage of some of this real-time information that we've provided in 9.5, but it's the first time we're extending it to the endpoint," said Arabella Hallawell, VP of corporate strategy for Sophos.

As that suggests, to help counter the continuing growth and severity of malware, antivirus vendors are increasingly moving their signature and profile databases to the cloud. Instead of clogging up businesses' bandwidth by constantly pushing large updates to endpoints, the endpoints query the cloud on demand.

But signatures only go so far, especially when it comes to zero-day attacks, for which no significant solution exists. To that end, the company said that the new 9.5 software contains a more refined host intrusion prevention system (HIPS), which compares applications before and at runtime with profiles stored in the cloud-based database to better identify malicious applications or files and reduce false positives.

Having endpoint-based HIPS isn't new, but most companies avoid using it. According to a Forrester Research study of North American small and midsize businesses -- 20 to 1,200 users -- only about 6% of organizations currently use HIPS, and only 8% plan to implement it within the next 12 months.

"The issue from HIPS has been the noise," said Mark Harris, VP of SophosLabs and global engineering operations for Sophos. "The uptake on this technology is relatively slow, because too often it requires the user or administrator to make a decision."

Furthermore, software may look like malware, yet still be legitimate. "A good example is Rapport, which is the security tool that a number of U.K. banks are asking customers to install," said Harris. "It does a lot of things you'd expect a banking Trojan to do: injects itself into processes and monitors things, and if you were using pre-run behavior protection, you'd get a lot of alerts."

Instead, using the live-lookup feature, the application can be given the green light, he said. "We're able to look at a file or program and say, yes it looks like it's doing bad things, but because we've got real-time visibility, it looks like it's an updater to a well-known program, or security software that banks want their customers to use."

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/6/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5595
PUBLISHED: 2020-07-07
TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23 Model) contains a buffer overflow vulnerability, which may allow a remote attacker to stop the network functions of the products or execute...
CVE-2020-5596
PUBLISHED: 2020-07-07
TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23 Model) does not properly manage sessions, which may allow a remote attacker to stop the network functions of the products or execute a mali...
CVE-2020-5597
PUBLISHED: 2020-07-07
TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23 Model) contains a null pointer dereference vulnerability, which may allow a remote attacker to stop the network functions of the products o...
CVE-2020-5598
PUBLISHED: 2020-07-07
TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23 Model) contains an improper access control vulnerability, which may which may allow a remote attacker tobypass access restriction and stop ...
CVE-2020-5599
PUBLISHED: 2020-07-07
TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23 Model) contains an improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability, which may allow a remo...