Sophos unveiled advancements to Sophos Cloud Workload Protection, including new Linux host and container security capabilities. These enhancements accelerate the detection and response of in-progress attacks and security incidents within Linux
operating systems, improve security operations, and bolster application performance.
Cyberattacks
Distributed denial-of-service (DDoS) tools, cryptocurrency miners, and various types of backdoors are the top three Linux threats. This is according to research conducted by Sophos in a dataset from January through March 2022. DDoS tools accounted for nearly half of all Linux malware detections during this time. Probably this was a result of automated attacks attempting to reinfect updated servers rapidly and repeatedly.
SophosLabs has also detected a recent increase in ransomware attackers attempting to use tools targeting virtual machine hypervisors. Many of them run on Linux environments to carry out their attacks.
“Linux environments continue to grow in surface area as organizations around the world increasingly migrate workloads to the cloud. Even though Linux is widely considered to be one of the most secure operating systems, it still harbors inherent and application-based risks and it is not immune to cyberattacks,” said Joe Levy, chief technology and product officer at Sophos.
Sophos Cloud Workload Protection
According to Joe Levy, attackers target Linux hosts and containers because they are high value, and often under-protected.
Sophos Cloud Workload Protection already automates and simplifies the prevention and detection of these attacks on Windows systems. Sophos is now providing the same observations and capabilities to Linux operating systems through the integration of Capsule8 technology.
It provides powerful and lightweight visibility into on-premise, data center, and cloud-based Linux hosts and containers. this secures them from advanced cyberthreats.
Sophos Cloud Workload Protection also leverages analytics around attacker tactics, techniques, and procedures (TTPs) to provide cloud-native threat detections.
Availability
Sophos Cloud Workload Protection is now available with Sophos Intercept X Advanced for Server with XDR and Sophos Managed Threat Response. It is managed within the cloud-native Sophos Central platform.
It can also be deployed as a single agent solution that is ideally suited for security operations teams, delivering flexible, lightweight protection with optimized resource limits, without deploying a kernel module.
Sophos Cloud Workload Protection will also soon be available as a Linux sensor. Ideally suited for DevSecOps and security operations center (SOC) teams requiring deep insight into mission-critical workloads with a minimal performance impact. The Linux sensor will provide API integration into existing automation, orchestration, log management, and incident response solutions.
