Sophos, a US-based global next-generation cybersecurity company, has unveiled advancements to Sophos Cloud Workload Protection including new Linux host and container security capabilities.
These advancements according to Sophos will accelerate the detection and response of in-progress attacks and security incidents within Linux operating systems, improve security operations and bolster application performance.
Linux is open source operating system software that sits underneath all of the other software on a computer, receiving requests from those programs and relaying these requests to the computer’s hardware.
Joe Levy, chief technology and product officer at Sophos stated that Linux still accommodates application based risk despite being a secured operating system.
“Linux environments continue to grow in surface area as organizations around the world increasingly migrate workloads to the cloud. Even though Linux is widely considered to be one of the most secure operating systems, it still harbors inherent and application-based risks and it is not immune to cyberattacks,” Joe said.
He disclosed that attackers’ targets Linux hosts and containers because they are high value, and often under-protected and Sophos Cloud Workload Protection already automates and simplifies the prevention and detection of these attacks on Windows systems by providing the same observations and capabilities to Linux operating systems.
Read also: United Kingdom aid partners KPMG, others to raise cybersecurity awareness among small businesses
According to new Sophos Labs research, distributed denial-of-service (DDoS) tools, cryptocurrency miners and various types of backdoors were the top three types of Linux threats detected by Sophos in a dataset from January through March 2022.
DDoS tools accounted for nearly half of all Linux malware detections during this time, likely due to automated attacks attempting to reinfect updated servers rapidly and repeatedly.
The Lab research also detected a recent increase in ransomware attackers attempting to use tools targeting virtual machine hypervisors, many of which run on Linux environments, to carry out their attacks.
Meanwhile, Sophos Cloud Workload Protection provides powerful and lightweight visibility into on-premise, data centre and cloud-based Linux hosts and containers, securing them from advanced cyberthreats through the integration of Capsule8 technology, which Sophos acquired in July 2021.
The technology leverages analytics around attacker tactics, techniques and procedures (TTPs) to provide cloud-native threat detections, including container escapes, crptominers, Data destruction and kernel exploits.
Container escapes according to Sophos identifies attackers escalating privileges from container access to host while Cryptominners detects behaviours commonly associated with cryptocurrency miners.
Similarly, Data destruction alerts that an attacker may be trying to delete indicators of compromise that are part of the on-going investigation while Kernel exploits highlight if internal functions are being tampered with on a host.
However the Cybersecurity noted that once threats are detected, Sophos XDR (extended detection and response) assigns risk scores to incidents and provides contextual data that enable security analysts as well as the Sophos Managed Threat Response team to streamline investigations and focus on the highest priority incidents
Sophos Cloud Workload Protection will also be available as a Linux sensor.
