Sophos Anti-Virus and Ransomware Protection

Sophos Advanced Workstation & Server Anti-Virus Defense

Sophos Endpoint is the solution of choice by San Diego Computer Consulting for all our clients. Sophos is one of the leaders in threat detection and provides a superior defense solution to protect computers from nefarious actors. Sophos advanced solutions are a suite of anti-threat tools that protect networks using a combination of automation, AI, and human threat teams to actively protect endpoints on a computer network. Sophos Endpoint software is bundled with Intercept X which is one of the very best threat services which actively looks for abrupt file changes and can stop them immediately and roll them back to their original state.

The Endpoint Security provides

-Detection of new and unknown malware and exploits using deep learning, an advanced form of machine learning

-It stops ransomware before it spreads with Sophos Crypto-guard.

-Blocks hackers and active adversaries from using the exploit techniques they use most in their attacks.

-Add expertise with intelligent (AI) endpoint detection and response.

Central Intercept X End Point Advanced with Intercept-X

Central Intercept X Advanced is the industry’s most comprehensive endpoint protection built to stop the widest range of threats. Includes all features in Central Intercept X Essentials plus multiple policies, control capabilities (Web, Peripheral, Application, DLP) and threat cases. For virtual environments, a light agent for Windows Desktop VM’s provides off-board scanning and protection.

San Diego Computer Consulting strongly recommends Sophos Endpoint solutions for all workstations and servers. We use Endpoint because it is loaded with features that really protect your computers and servers. The Sophos End Point Advanced uses AI to look for suspicious behaviors including real-time threat management and intelligence from Sophos Labs.

End Point Advanced comes with anti-malware, Web, application, & data control for comprehensive security.

The following Attack Surface services come default with Endpoint Advanced:

Web Security. Download reputation. Web Control with URL Blocking

Peripheral Control. Application Control.

Before any things runs on your computers/servers

Deep Learning Malware Protection. Anti-Malware File Scanning. Live Protection

Pre-execution Behavior Analysis. Intrusion Protection

Stop Running threats

Potentially Unwanted Application blocking. Antimalware Scan Interface

Malicious Traffic Detection. Exploit Protection. Active Adversary Mitigation.

Intercept X, Ransomware Guard Service

Sophos Intercept X Advanced is leading detection AI service that we include with all the computers and servers that we protect. Sophos Intercept X combines anti-exploit, anti-ransomware, and deep learning through AI to stop attacks before they impact your systems. Intercept X is so intelligent that when it detects any kind of file attack, it can stop them and roll the file back to its original state.

At San Diego Computer Consulting, we bundle Intercept X with all our client’s computers and servers. It is the combination of Sophos Endpoint and Intercept X that provides a strong base layer to protect our clients’ networks. Anti-Virus protection is not enough. Microsoft Defender built into Windows is not enough. AI from Intercept X is what makes Sophos the strong and most dependable solution for workstation and server protection form nefarious actors.

San Diego Computer Consulting's Risk Assessment & Reporting Utilities

Intercept X Highlights & Features

With the use of AI technology, Intercept X can stop unknown threats through detecting and blocking malware even if it not in the Sophos Labs database. It does so my verifying and scrutinizing files and their attributes from 100’s of millions of samples to identify threats without the need for a signature file.

Blocking Ransomware

Intercept X has some of the most advanced capabilities that detect and block the malicious encryption processes used in ransomware attacks. If detected, files that have been encrypted will be rolled back to a safe and original state.

Preventing Exploits and Reducing the Attack Surface

Intercept X uses technology to identify and quash exploit techniques uses by hackers to compromise devices, including the stealing of credentials. Intercept X stops and prevents techniques used throughout the attack chain in a hacking exploit. It works also by controlling the applications that can run on your computers within your environment including blocking malicious websites and potential unwanted applications.

taking-the-battle-to-ransomware-with-sophos-intercept-x-10-638

Sophos Central Intercept-X End Point Advanced with XDR/MTR

Add On Service: XTR-Extended Detection and Response

Extended detection and response referes to going beyond the endpoint and bringing in additional data sources including firewall, email, cloud and mobile. XDR takes the idea of EDR and extends it. It goes beyond the endpoint and server, incorporating data from other security tools such as firewalls, email gateways, public cloud tools and mobile threat management solutions. XDR is an emerging technology so data sources and functionality varies between vendors, but this diagram gives a good starting point to understand what XDR adds onto EDR.

XDR will incorporate the following threat hunting services:

Extend investigations to 30 days without bring a device back online
Use ATP and IPS detections from the wirewall to investigate suspect hosts
Compare Email header information, SHA’s and other traffic to malicious domains.

Add On Service: MTR-Sophos Managed Threat Response

Sophos MTR is an advanced product addon for workstations and servers. Sophos MTR is an amazing product because it actively attacks and takes targeted actions against complex threats that are posed to workstations and servers. With Sophos MTS your organization is armed with a 24/7 team of threat hunters and response experts who will act based on the decisions that are at the admin level. Sophos MTR uses machine learning technology and expert analysis for improved threat and detection. It provides more detailed and deeper investigation of targeted actions to eliminate threats in your IT network.

What differentiates this service is that the MTR Level products involve Sophos staff to actively watch your network and help contain and neutralize threats. This service becomes a managed service by Sophos who work to make sure your network is always being watched and is safe from threats.

EndPoint with MTR/XDR Standard Services:

24/7 Lead Driven Threat Hunting Confirmed malicious artifacts or activity (strong signals) are automatically blocked or terminated, freeing up threat hunters to conduct lead-driven threat hunts. This type of threat hunt involves the aggregation and investigation of causal and adjacent events (weak signals) to discover new Indicators of Attack (IoA) and Indicators of Compromise (IoC) that previously could not be detected.

Security Health Check Systems Keep your Sophos Central products–beginning with Intercept X Advanced with EDR–operating at peak performance with proactive examinations of your operating conditions and recommended configuration improvements.

Activity Reporting: Summaries of case activities enable prioritization and communication, so your team knows what threats were detected and what response actions were taken within each reporting period.

Adversarial Detections-Most successful attacks rely on the execution of a process that can appear legitimate to monitoring tools. Using proprietary investigation techniques, our team determines the difference between legitimate behavior and the tactics, techniques, and procedures (TTPs) used by attackers.