Sophos unveils powerful cloud workload protection advancements

Sophos Cloud Workload Protection has been enhanced with new Linux host and container security capabilities, according to the company. 

These enhancements improve security operations and application performance by accelerating the detection and response to in-progress attacks and security incidents within Linux operating systems.

According to new SophosLabs research, the top three types of Linux threats detected by Sophos in a dataset from January to March 2022 were distributed denial-of-service (DDoS) tools, cryptocurrency miners, and various types of backdoors. DDoS tools accounted for nearly half of all Linux malware detections during this time period, most likely as a result of automated attacks attempting to reinfect updated servers quickly and repeatedly. SophosLabs has also observed a recent increase in ransomware attackers attempting to carry out their attacks using tools targeting virtual machine hypervisors, many of which run on Linux platforms.

“Linux environments continue to grow in surface area as organizations around the world increasingly migrate workloads to the cloud. Even though Linux is widely considered to be one of the most secure operating systems, it still harbors inherent and application-based risks and it is not immune to cyberattacks,” said Joe Levy, chief technology and product officer at Sophos. “Attackers target Linux hosts and containers because they are high value, and often under protected. Sophos Cloud Workload Protection already automates and simplifies the prevention and detection of these attacks on Windows systems, and now Sophos is providing the same observations and capabilities to Linux operating systems.”

Securing Linux Infrastructure

Sophos Cloud Workload Protection, which incorporates Capsule8 technology, which Sophos acquired in July 2021, provides powerful and lightweight visibility into on-premise, data center, and cloud-based Linux hosts and containers, protecting them from advanced cyberthreats. It uses analytics to provide cloud-native threat detections based on attacker tactics, techniques, and procedures (TTPs), such as:

• Container escapes: Identifies attackers escalating privileges from container access to hosts
• Cryptominers: Detects behaviors commonly associated with cryptocurrency miners
• Data destruction: Alerts that an attacker may be trying to delete indicators of compromise that are part of an ongoing investigation
• Kernel exploits: Highlights if internal kernel functions are being tampered with on a host

When threats are detected, Sophos XDR (extended detection and response) assigns risk scores to incidents and provides contextual data, allowing security analysts and the Sophos Managed Threat Response team to streamline investigations and focus on the highest priority incidents. Integrated Live Response also establishes a secure command line terminal to hosts for rapid remediation.

Sophos Cloud Workload Protection works in tandem with the Sophos Adaptive Cybersecurity Ecosystem, which serves as the foundation for the entire Sophos solution portfolio. The smart ecosystem unifies Sophos’ cloud-native security platform capabilities, including Sophos Cloud Workload Protection, Sophos Cloud Security Posture Management, Kubernetes security posture management, container image scanning, infrastructure-as-code scanning, cloud infrastructure entitlements management, and cloud spend monitoring, to ensure visibility, security, and compliance.

Availability

Sophos Cloud Workload Protection is now available in conjunction with Sophos Intercept X Advanced for Server with XDR and Sophos Managed Threat Response, and is managed via the cloud-native Sophos Central platform. It can be deployed as a single agent solution for security operations teams, providing flexible, lightweight protection with optimized resource limits without the need for a kernel module.

Sophos Cloud Workload Protection will also be available as a Linux sensor in the near future. The Linux sensor will provide API integration into existing automation, orchestration, log management, and incident response solutions, making it ideal for DevSecOps and security operations center (SOC) teams requiring deep insight into mission-critical workloads with minimal performance impact.