Cyfer Tech Blog

Cyfer Tech and Sophos: Leading the Way with CISA’s Secure by Design Initiative 

Embracing a Secure Future with Sophos and Cyfer Tech 

At Cyfer Tech, a proud Sophos Gold Partner, we are excited to share the significant strides Sophos is making in cybersecurity. As part of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure by Design initiative, Sophos has committed to an industry-leading pledge to enhance technology and product security. This initiative, launched on May 8, 2024, aims to foster a trustworthy digital ecosystem by embedding security as a core principle in all software design. 

A Commitment to Secure Design 

Sophos’s commitment to the Secure by Design pledge is built on seven core pillars: 

1. Multi-factor authentication 
2. Default passwords 
3. Reducing entire classes of vulnerability 
4. Security patches 
5. Vulnerability disclosure policy 
6. CVEs 
7. Evidence of intrusions 

These pillars are not just principles but actionable commitments that Sophos is integrating into their processes and products. 

Our Shared Vision 

At Cyfer Tech, we align with Sophos’s philosophy that trust must be earned and verified. Transparency and continuous improvement are fundamental to maintaining the integrity of security solutions. We recognize that cybersecurity is a challenging and dynamic field, and we are committed to providing our clients with secure, reliable solutions that evolve with the threat landscape. 

Progress on the Secure by Design Pillars 

1. Multi-Factor Authentication (MFA) 

Sophos Central enforces MFA by default, providing customers with robust security without additional costs. Efforts to reduce internet-exposed administrative interfaces have led to a 21.5% reduction over the past 18 months. 

Pledge: In the next 12 months, Sophos will release passkey support in Sophos Central and publish adoption statistics. 

2. Default Passwords 

Sophos Firewall requires users to create strong passwords during setup and leverages TPM-backed Zero Touch functionality for secure deployments. 

Pledge: Sophos will continue to disallow default credentials in all current and future products. 

3. Reducing Entire Classes of Vulnerability 

Sophos uses memory-safe languages and frameworks, systematically eliminating common vulnerabilities. Significant improvements, such as the rewrite of the Sophos Firewall VPN provisioning portal, demonstrate their commitment to security. 

Pledge: In SFOS version v21 and v22, Sophos will further enhance containerization to improve security. 

4. Security Patches 

Automatic security updates are standard for all Sophos SaaS services, ensuring customers always have the latest protections. 

Pledge: By September 2025, Sophos will introduce a feature to automatically schedule firewall firmware updates. 

5. Vulnerability Disclosure Policy 

Sophos’s responsible disclosure program has rewarded over $500,000 to researchers, fostering a collaborative security environment. 

Pledge: Sophos will increase transparency and rewards in their vulnerability disclosure program within the next year. 

6. CVEs 

Sophos prioritizes publishing CVEs for identified vulnerabilities and is committed to extending this practice to internal findings of high or critical severity. 

Pledge: Sophos will ensure consistent publication of CVEs for all identified high-severity internal vulnerabilities. 

7. Evidence of Intrusions 

Sophos provides comprehensive logging and auditing capabilities, essential for incident response. 

Pledge: Sophos will enhance integration capabilities in Sophos Central for better log management by July 2025. 

Looking Forward 

As we continue to collaborate with Sophos, Cyfer Tech is dedicated to keeping you informed about our progress. Our commitment to security and transparency ensures that our clients are always protected with the latest advancements in cybersecurity. 

Stay tuned for future updates as we move forward in our journey toward a secure digital future. 

At Cyfer Tech, we are not just keeping up with the latest in cybersecurity – we are helping to shape it. For more information on our partnership with Sophos and how we can support your cybersecurity needs, contact us today. 

Sophos XDR: Expanding their defense against active adversaries 

Sophos latest capabilities to help defend against sophisticated multi-stage attacks. 

Active adversaries are highly skilled cybercriminals who use advanced methods to bypass traditional security measures and execute multi-stage attacks. To combat these sophisticated threats, organizations need adaptive security controls that can detect, investigate, and respond effectively. 

Sophos continuously enhance their capabilities to provide robust defense against these advanced attacks. Leveraging the expertise of their Sophos X-Ops unit and telemetry from both Sophos and third-party solutions, they deliver top-notch protection, detection, and response. Their latest enhancements to the Sophos Extended Detection and Response (XDR) platform are designed to offer even greater power against active adversaries. 

Enhanced Sophos XDR Detections 

Configurable Suppression Rules 

Security operators now have more control over the detections generated by the Sophos XDR platform. With an intuitive suppression wizard, analysts can focus on critical detections by suppressing confirmed-benign events. These granular rules can be tailored based on severity, detection type, MITRE ATT&CK details, and more. 

Comprehensive Detection Summaries 

To aid quick decision-making and task execution, Sophos XDR detections now come with “natural language” descriptions. This enhancement ensures that threat alerts are immediately understandable to analysts of all skill levels, accelerating investigation and response times. 

Streamlined SophosLabs Intelix Integration 

Sophos Endpoint detections are automatically sent to SophosLabs Intelix for threat classification and analysis. This integration enriches detection details with high-fidelity threat intelligence, eliminating the need for manual submissions to SophosLabs. 

Enhanced Microsoft 365 Detections 

Sophos XDR now collects and analyzes comprehensive audit log data from Microsoft 365, identifying more threats than Microsoft’s own security tools. The latest platform detections focus on compromised accounts and Business Email Compromise. The integration with the “Microsoft Office 365 Management Activity API” is included at no additional cost. 

Sophos XDR Public APIs 

Sophos has introduced two new APIs to integrate Sophos XDR data into existing security operations tools and workflows. These APIs allow organizations to: 

• Accelerate investigation and response with automated workflows. 
• Centralize analysis of security telemetry. 
• Enrich Sophos XDR detections with additional threat intelligence. 

Increase Multi-Dimensional Visibility with Technology Integrations 

To provide a comprehensive view of active adversaries’ activities, Sophos XDR collects, correlates, and analyzes data from a wide range of sources. New integrations available for Sophos XDR and Sophos MDR customers include: 

• Forcepoint Next-Gen Firewall 
• F5 BIG IP Application Security Manager (ASM) 
• Cisco Umbrella 
• Cisco Identity Services Engine (ISE) 

Microsoft Graph Security Integration (Version 2) 

Their new version of the Microsoft Graph security integration, “Microsoft Graph security API (Alerts v2),” offers additional information from a range of Microsoft security solutions. This integration helps analysts accelerate detection, investigation, and response, and is included at no extra cost. 

Quickly Identify Vulnerable Endpoints and Servers 

Their new Device Exposure dashboard in the Sophos Central console provides an overview of endpoint and server devices missing critical OS updates. This visualization helps manage cybersecurity risks by highlighting the time elapsed since the last updates and offering customizable queries for further details. 

Vulnerability Management Delivered as a Managed Service 

Sophos Managed Risk, powered by Tenable, helps organizations identify and prioritize remediation efforts for their external attack surface. This service eliminates blind spots and focuses on exposures posing the highest risk. 

Recognized by Industry Experts and Customers 

Sophos XDR and Sophos MDR continue to receive high praise for their superior capabilities: 

• Leader in the 2024 IDC MarketScape for Worldwide Managed Detection and Response (MDR). 
• Leader in Frost & Sullivan’s 2024 Frost Radar™ for Global Managed Detection and Response. 
• The only vendor named a Gartner Customers’ Choice in multiple categories including Endpoint Protection Platforms and Managed Detection & Response Services. 
• Leader in G2 Winter 2024 Reports for EPP, EDR, MDR, XDR, and Firewall. 
• Leader for the 14th consecutive time in the Gartner® Magic Quadrant™ for Endpoint Protection Platforms. 

To learn more and explore how Sophos XDR can elevate defenses against active adversaries, contact our Cyfer Tech team.  

Sophos Email Awarded VBSpam+ Certification: A Benchmark in Email Security

At Cyfer Tech, we are thrilled to share some exciting news from our partners at Sophos. Sophos Email has achieved the prestigious VBSpam+ certification in Virus Bulletin’s latest email comparative review for June 2024. This recognition underscores Sophos Email’s outstanding performance and commitment to keeping your inboxes safe from threats. 

Unmatched Protection Against Malware and Phishing 

In a rigorous 16-day evaluation, Sophos Email was tested against over 140,000 malicious and spam-related emails. The results were nothing short of exceptional: 

• 100% Block Rate: Sophos Email successfully blocked all malware and phishing samples, making it the only solution in the test to achieve this feat. 
• Zero False Positives: The solution accurately classified all legitimate “ham” and newsletter emails without any false positives. 
• High Accuracy: Sophos Email identified over 99.98% of other unwanted mail, demonstrating its precision and reliability. 

This achievement reflects the high standards and continuous innovation that Sophos invests in their email security solutions, ensuring customers receive top-notch protection for their communication channels. 

A Testament to Sophos’ Commitment 

The VBSpam+ certification is a testament to the dedication and expertise of the Sophos Email and X-Ops teams. This accolade highlights the comprehensive approach Sophos takes to develop and refine their email security technologies, ensuring they stay ahead of the evolving threat landscape. 

Why This Matters 

In today’s digital-first world, email remains a primary vector for cyberattacks. The ability to effectively filter and block malicious emails is crucial for safeguarding sensitive information and maintaining operational integrity. Sophos Email’s stellar performance in this evaluation provides a strong assurance to businesses that their email communications are well-protected. 

Conclusion 

Cyfer Tech is proud to partner with industry leaders like Sophos, who continually push the boundaries of cybersecurity excellence. The VBSpam+ certification awarded to Sophos Email is not just an achievement; it is a promise of quality, reliability, and superior protection for our customers. 

Stay tuned for more updates and advancements from Cyfer Tech and Sophos. Together, we are committed to creating a safer, more secure digital environment for businesses worldwide. 

For more information, please visit our website or contact our support team.