North Korean hackers are targeting software developers in a new malware campaign that uses a fake interview process to steal cryptocurrency.

The campaign targets developers, especially those in the finance and technology industries, with profiles on freelance websites such as Upwork or Fiverr. It offers well-paid job opportunities and targets specific, high-value individuals.

It uses typosquatting or compromised legitimate npm repositories that victims are persuaded to inadvertently download and execute.

Researchers at the Sophos Counter Threat Unit have attributed the campaign to Nickel Alley, a threat group operating on behalf of the North Korean government.

"The group notoriously targets professionals in the technology sector by advertising fake job opportunities, deceiving prospective candidates through a fake job interview process, and ultimately delivering malware," the company said in an advisory.

As part of its attacks, Nickel Alley often creates a fake LinkedIn company page to build credibility, with a coordinating GitHub account for malware delivery.

The website homepage is generic and advertises 'tech talent' and managed service solutions. However, different domains are included on the LinkedIn company page and the GitHub account – which researchers noted shows inconsistency and lack of attention to detail.

Nickel Alley ramping up operations

The advisory from Sophos comes after a June 2025 X post warned of a campaign involving targeted emails promoting job opportunities at the fake Astra Byte Sync company.

The threat actors hadn't actually built the website at the time the emails were sent, meaning that the site simply displayed the hosting provider’s default page.

Over the last year, the group has used the popular ClickFix tactic to deliver PyLangGhost RAT malware via fake job skills assessment tasks.

This involved the attacker-controlled web interface presenting an error informing the victim that they must run a command locally to fix the issue – a command that instead initiated a series of actions leading to PyLangGhost RAT.

It previously used a GoLang-based version known as GoLangGhost RAT.

Meanwhile, in October, Sophos analysts uncovered a targeted attack where the threat actors convinced a victim to download, or clone, the content of a GitHub repository and execute the code locally using the 'npm install' and 'npm start' commands.

The GitHub account masquerades as a software development company specializing in full stack web development and blockchain solutions, and contains links to an 'official' company website and a fake LinkedIn company page.

While the main aim of these attacks appears to be cryptocurrency theft, Sophos said the threat group has also made it clear that it plans to use initial access for further supply chain compromise or corporate espionage.

"Additionally, the threat group has strategically selected follow-on payloads based on profiling victims’ system. Software developers, especially those in the finance and technology industries, are at elevated risk due to Nickel Alley’s targeting profile," Sophos warned.

"Organizations should monitor command execution and network traffic that spawns from Node.js processes, as it may indicate malware retrieval. As a general security practice, organizations should encourage employees to report suspicious unsolicited social media or email-based recruitment contact."

FOLLOW US ON SOCIAL MEDIA

An overwhelming majority of organizations lack full confidence in their cybersecurity vendors, research from Sophos has revealed, highlighting growing challenges around trust and transparency.

The firm’s vendor-agnostic Cybersecurity Trust Reality 2026 report, which is based on responses from 5,000 organizations across 17 countries, dives into how trust is influencing sector risk and decision-making.

The study found that 95% of participants do not have full trust in their cybersecurity providers, while 79% said they struggle to assess the trustworthiness of new partners.

Almost two-thirds (62%) said they even find it challenging for their existing vendors. Additionally, more than half (51%) reported increased anxiety around the likelihood of a significant cyber incident as a direct result of this trust gap.

According to Sophos, the findings reflect a broader shift in how organizations evaluate cybersecurity effectiveness – with trust now a key factor alongside technical performance.

“Trust is not an abstract concept in cybersecurity, it’s a measurable risk factor,” explained Ross McKerchar, CISO at Sophos.

“When organizations can’t independently verify a vendor’s security maturity, transparency, and incident handling practices, that uncertainty flows directly into boardrooms and security strategies.”

Trust as a decision-making factor

Sophos’ report shows that organizations are increasingly looking for verifiable evidence when assessing cybersecurity vendors, rather than relying on marketing claims or blanket assurances.

The survey identified verifiable security artifacts as the most important driver of trust, including independent certifications, third-party assessments, and demonstrated operational maturity.

While CISOs prioritize transparency during incidents and consistent technical performance, senior leadership was found to place greater importance on independent validation, certifications, and analyst performance.

According to Phil Harris, IDC’s research director for governance, risk, and compliance solutions, the findings underline the growing pressure on businesses to validate vendor credibility as regulatory scrutiny and AI adoption continues to increase.

“With regulatory pressure increasing globally, organizations must be able to demonstrate due diligence in vendor selection – especially where AI is involved,” he commented. “Trust is shifting from a marketing message to a defensible compliance requirement.”

Transparency in the AI era

As AI continues to become more widely embedded in cybersecurity tools, services, and workflows, organizations are placing a greater focus on how vendors are deploying and governing these new technologies.

Sophos’ report found that a lack of accessible and sufficiently detailed information remains a critical barrier to making trust assessments, with survey respondents calling for greater transparency, accountability, and ongoing validation from providers.

“CISOs are being asked to prove trust, not assume it,” added McKerchar. “Cybersecurity providers must do the same.”

FOLLOW US ON SOCIAL MEDIA

Nearly half of companies paid a ransom to get their data back last year, according to new research, but they’re taking a hard line with hackers to strike fair deals.

In its latest State of Ransomware report, Sophos said this was the second highest rate of ransom payments in six years. However, more than half (53%) paid less than the original demand.

In nearly three-quarters (71%) of these cases, the hackers were haggled down, either through the victims’ own negotiations, or with help from a third party.

Chester Wisniewski, director, field CISO at Sophos, said that for many organisations, the threat of falling victim to ransomware groups is now “just a part of doing business”.

What Sophos’ research shows, however, is that victims are taking a more pragmatic approach to the situation and are recovering at a quicker pace.

"The good news is that, thanks to this increased awareness, many companies are arming themselves with resources to limit damage,” he said. “This includes hiring incident responders who can not only lower ransom payments but also speed up recovery and even stop attacks in progress."

Companies are getting better at negotiation, Sophos noted. The median ransom demand dropped by a third between 2024 and 2025, but the actual payment made also dropped by half.

Overall, the median ransom payment was a round one million dollars - this was also half the figure cited for the previous year.

Not all ransomware victims are successful

It's worth noting that 28% paid more than the initial ransom, largely due to extra demands from the hackers. Sophos said this usually happened because the attackers realized they could ask for more or they got frustrated.

Other causes included a lack of backups or a failure to pay up quickly enough.

Ransom payments varied by industry, with state and local government reporting paying the highest median amount at $2.5 million, while healthcare reported the lowest at $150,000.

Initial demands also varied significantly depending on the organization's size and revenue. The median ransom demand for companies with over $1 billion in revenue was $5 million, while those with $250 million revenue or less were asked for less than $350,000.

For the third year in a row, the number one technical root cause of attacks was exploited vulnerabilities, while 40% of ransomware victims said adversaries took advantage of a security gap that they hadn't been aware of.

Nearly two-thirds (63%) of organizations blamed resourcing issues as a major reason they fell victim to the attack.

Indeed, a lack of expertise was cited as the top operational cause in organizations with more than 3,000 people, and lack of people or capacity was most frequently cited by those with between 251 and 500 employees.

Enterprises are getting better at recovery

The good news is that 44% of companies were able to stop the ransomware attack before data was encrypted – a six-year high - with data encryption at a six-year low, with only half of companies having their data encrypted.

Only 54% of companies used backups to restore their data – the lowest percentage in six years.

However, the average cost of recovery dropped from $2.73 million in 2024 to $1.53 million in 2025.

Companies are getting faster at recovery, Sophos noted, which is a positive sign both in terms of preparedness and resilience. More than half (53%) fully recovered from a ransomware attack in a week, up from 35% last year.

Meanwhile, only 18% took more than a month to recover, down from 34% in 2024.

MORE FROM ITPRO

• The new ransomware groups worrying security researchers in 2025
• Ransomware missteps that can cost you
• Building ransomware resilience to avoid paying out

Cybersecurity giant Sophos has announced the appointment of seasoned industry executive Torjus Gylstorff as its new chief revenue officer.

As CRO, Gylstorff is tasked with leading Sophos’ global sales organization, including its partner and customer networks, as the company looks to drive sales of its portfolio of security offerings - such as its managed detection and response (MDR) services and solutions for endpoint, network, email, and cloud security.

Gylstorff arrives with 25 years’ experience in sales, channels, and business development across the technology and cybersecurity sectors, including leading global sales teams and building channel ecosystems.

Most recently, he served as worldwide sales leader for Thales’ Application and Data Security business, which followed a tenure as vice president of worldwide channels and alliances at Symantec.

Previously, he has also led emerging business initiatives at Blue Coat Systems, as well as held various leadership positions at Norman Shark, IBM, and Lotus Software.

With Gylstorff on board, Sophos is aiming to expand its presence beyond its existing customer base of more than 600,000 global organizations in the small- and mid-sized business market.

The new CRO will leverage his channel expertise to develop strategies that strengthen and drive additional business with both new and existing MSPs, the firm said.

“Our vision at Sophos is a world where organizations of any size and means have a clear path to superior cybersecurity outcomes, and the work we do every day aims to close the cyber security divide and protect more organizations in the most at-risk segments of the market,” explained Sophos CEO Joe Levy.

“The best and most efficient way to do this is by scaling with channel partners and MSPs.”

Levy added that Gylstorff’s extensive industry experience will be a key asset to the company as it looks to drive the next phase of its “go to market evolution.”.

“With Torjus, who has decades of experience in leading channel sales, managing sales operations and developing relationships with customers, we can scale faster and in a way that accelerates growth for partners, MSPs and Sophos,” he said.

The move by Sophos comes amid an exciting period for the cybersecurity giant, with the company having recently announced plans to acquire Secureworks as part of an $859 million deal.

The deal, revealed on 21 October, will see Sophos integrate solutions from both companies to create what it described as a broader and stronger security portfolio aimed at serving businesses at the small, mid, and enterprise level.

Sophos has announced plans to acquire cybersecurity firm Secureworks in a deal worth $859 million as it looks to bolster its portfolio.

The deal, revealed on 21 October, will see Sophos integrate solutions from both companies to create what it described as a broader and stronger security portfolio aimed at serving businesses at the small, mid, and enterprise level.

In its statement announcing the acquisition, Sophos said it expects the deal to strengthen the wider security community by bringing two industry leaders together.

Part of this mission will include merging the two companies' threat intelligence capabilities, which are well regarded in the industry.

According to the joint statement, the duo plan on boosting cyber resilience with their combination of security controls, AI tools, leading threat intelligence, and the combined experience of their security operatives.

Sophos will look to complement its existing strengths in managed security services and end-to-end security products with Secureworks’s security operations expertise and its Taegis platform, to provide holistic XDR and MSR solutions.

The acquisition will also see Sophos expand its current portfolio with new offerings such as identity detection and response (ITDR), next-generation SIEM capabilities, operational technology, and vulnerability risk prioritization.

“By combining complementary AI-driven security platforms powered by automated prevention, detection and response, the two organizations can deliver advanced solutions for defeating modern, persistent adversaries even faster”, the statement said.

Secureworks’ security expertise ‘perfectly aligns’ with Sophos’ cyber mission

Sophos, which itself was acquired by software investment fund Thoma Bravo for $3.9 billion, stated that its enhanced security offering made possible by the deal will give businesses the security capabilities to compete with cyber adversaries in an increasingly hostile threat landscape.

Discussing the deal, Joe Levy, CEO at Sophos, said Secureworks’ Taegis XDR platform will complement Sophos’ strengths in MDR.

“Secureworks offers an innovative, market-leading solution with their Taegis XDR platform. Combined with our security solutions and industry leadership in MDR, we will strengthen our collective position in the market and provide better outcomes for organizations of all sizes globally,” he stated.

“Secureworks’ renowned expertise in cybersecurity perfectly aligns with our mission to protect businesses from cybercrime by delivering powerful and intuitive products and services. This acquisition represents a significant step forward in our commitment to building a safer digital future for all.”

Wendy Thomas, CEO at Secureworks, added that the marriage of Secureworks’ XDR capabilities with Sophos’ endpoint, cloud, and network products will offer a robust solution to help businesses challenge threat actors.

“Our mission at Secureworks has always been to secure human progress. Sophos’ portfolio of leading endpoint, cloud, and network security solutions – in combination with our XDR-powered managed detection and response – is exactly what organizations are looking for to strengthen their security posture and collectively turn the tide against the adversary,” she explained.

“As Joe and I both believe, this transaction will strengthen our go-to-market offering with Sophos’ global scale, expertise and reputation.”

The transaction is expected to close in early 2025, subject to customary closing conditions.

The vast majority of small and medium-sized businesses (SMBs) have gaps in their cyber skills and expertise, according to research from Sophos.

96% SMBs find at least one aspect of investigating suspicious alerts difficult, with specific tasks including identifying which signals to investigate, prioritizing which signals to probe, or keeping accurate records.

Sophos’ survey fielded responses from 5,000 IT and cybersecurity professionals across 14 countries and was conducted in Q1 2024.

The security firm found that organizations with fewer than 500 staff - the definition of SMB for this report - perceive a shortage of in-house cybersecurity skills and expertise to be their second biggest security risk.

By comparison, this factor ranks seventh in cyber threats for organizations with over 500 staff members.

The report noted that smaller teams make it more challenging for IT workers to take time out for security education and means staff have fewer opportunities to benefit from peer-to-peer learning.

The report also found that a third (33%) of the time, no one is actively monitoring, investigating, or responding to security alerts in SMBs.

“SMBs are most acutely impacted by the cyber security skills shortage,” Ben Aung, Sage’s chief risk officer, told ITPro.

“They have neither the budgets nor career opportunities to compete against larger organizations for cybersecurity talent, and often lack the capabilities and resources to bring in new entrants and train them up,” he added.

Simplified solutions are key to SMB cybersecurity

As SMBs are critical to the supply chain of larger organizations, Aung said, it's important that governments, larger firms, and resellers meet the challenge of the SMB cyber skills shortage. The key, he thinks, is simplicity.

“These organizations can significantly reduce SMBs' cyber risks by offering technology and services which are secure, easy to configure and operate right out of the box,” he said.

“SMBs should be able to take advantage of digital tools and the cloud without needing a PhD in cyber security - it should be simple to enable multi-factor authentication (MFA), set user access permissions and important controls like security patching and data backups should just be set up by default,” he added.

Concerns over cyber skills shortages come amid a period of escalating threats for SMBs globally. Research from Kaspersky earlier this year, for example, found the number of cyber infections experienced by small businesses in Q1 rose by 5% compared to the same period in 2023.

Over 2,400 firms encountered malware on their systems, with the most common form of attack being trojans that often find their way into IT systems under the guise of legitimate software.

Similarly, a recent study from Vodafone found nearly half (43%) of all cyber attacks in the UK specifically target SMBs. The impact this has on small businesses cannot be understated, the study found, with around 60% of these leading to business closures within just six months.

More from ITPro

• Why ransomware attacks happen to small businesses – and how to stop them
• SMB security gaps drive new opportunities for channel players
• Cyber crime cost UK businesses more than £30 billion in 2023, and small businesses were among the worst hit

More than 180 software companies have signed up to CISA’s voluntary Secure by Design Pledge to take greater responsibility for the security of their products.

The pledge requires software vendors to place added emphasis on building security principles into the design and manufacture of their products.

CISA director Jen Easterly announced the project in April 2023, revealing the first round of commitments from high-profile companies including HP, IBM, AWS, NetApp, and Microsoft at the RSA Conference in May 2024.

As of 8 May, Easterly revealed the pledge had already received around 70 signees in this first round, and the program appears to be picking up momentum with approximately another 100 joining up over the following months.

The latest of these was enterprise identity specialist SailPoint, which announced on 30 July it would be taking the pledge, committing itself to seven distinct goals, each aimed at boosting the security of software products before they hit the market.

Rex Booth, CISO at SailPoint, said every technology company has a role to play in the continuing effort to stay ahead of threat actors and raise levels of cyber resilience across the board.

“Every technology provider is an unwitting part of the cyber battlespace. But unlike in the physical world, there’s no cyber army coming to our rescue. Each of us is responsible for the security of our products and, by extension, the security of those we serve,” he explained.

“The Secure by Design pledge is a great way to promote a sense of communal responsibility among those of us with the greatest potential for impact. At SailPoint, we are proud to join our peers and support this important initiative.”

Secure by Design Pledge will push firms to take ownership of security outcomes at the executive level

The founding goal of the Secure by Design Pledge is to encourage software builders to shoulder more of the responsibility for ensuring their solutions are secure when they reach the hands of end-users.

“As a nation, we have allowed a system where the cybersecurity burden is placed disproportionately on the shoulders of consumers and small organizations and away from the producers of the technology and those developing the products that increasingly run our digital lives,” CISA stated in a blog announcing the pledge.

‘Every technology provider must take ownership at the executive level to ensure their products are secure by design”.

The seven goals CISA wants firms to focus on reflect attack techniques it has observed in the current threat landscape, including increased use of multi-factor authentication (MFA), timely vulnerability disclosure, reducing use of default passwords, and improving customers’ ability to gather evidence of cyber intrusions affecting the manufacturer’s products.

The program asks software vendors to be able to demonstrate measurable progress towards achieving each of its seven targets, and one signee – Sophos – recently updated customers on its progress.

Sophos’ update gave further details on how it plans on meeting each of its seven targets, which include releasing passkey support for its cloud management, prohibiting the use of default credentials in all current and future products, as well as releasing a feature by September 2025 that will enable customers to automatically schedule updates for their Sophos Firewall.

Ross McKerchar, CISO at Sophos, noted that the project is not about meeting the goal and resting on one’s laurels, but instead to create a new way of thinking about how software products are designed.

“This is not a one and done initiative that CISA has created – it’s a much-needed way of thinking and framework that should be built into the design and architecture of security solutions”

Businesses that want to avoid the extra cost of on-premises hardware security appliances will find Sophos' Firewall Virtual appealing. Supporting all the main hypervisors, including VMware, Hyper-V, Citrix, and KVM, it allows businesses to virtualize all their security services and extend protection to the network perimeter, endpoints, and virtual environments.

There are no compromises on features as it delivers the same tough security measures as Sophos' XGS desktop and rackmount appliances. It's flexible too, as you can choose from a wide range of virtual models with licensing based on the number of virtual CPUs (vCPUs) and memory.

Licensing starts with one vCPU core and 2GB of RAM and goes all the way up to unlimited cores and memory. Even better, you can upgrade them in the future if you need to increase performance.

Sophos Firewall Virtual review: Installation and deployment

Broadcom's new VMware licensing strategy appears to have upset a lot of people so for our review, we opted to use Microsoft's Hyper-V and installed Firewall Virtual on a Dell PowerEdge server running Windows Server 2022. The process is simple enough as we downloaded the ZIP file from Sophos' support site which contained primary and auxiliary virtual hard disks (VHDs). 

Virtual machine (VM) creation is swift as you assign the primary VHD and a virtual switch which is your LAN connection to the appliance. Next, you add the auxiliary VHD and a second switch for the appliance's WAN connection and power it up.

From here on, deployment is no different to the hardware appliances as you point a browser at the VM's LAN address and follow the quick start wizard. Commendably, it started by updating the firmware to the latest SFOS v20 and insisted we change the default admin password.

It then assists with setting up LAN and WAN port address assignments plus DHCP services. We opted for routed mode so the appliance provides all security functions and the wizard enabled a default set of firewall security policies which included web filtering, anti-malware, and zero-day protection. If you want to try it out, let the wizard assign a temporary serial number which enables a 30-day trial of the SFVUNL unlimited version with all security services enabled

Sophos Firewall Virtual review: Security features

Sophos offers a good range of flexible licensing options with the XStream Protection bundle enabling everything on its books. Along with the base firewall license, this includes the network, web, and zero-day protection modules, deep packet inspection, central orchestration, and enhanced 24/7 support.

There is one catch as the XGS hardware appliances employ a dual-processor architecture that uses Sophos' Xstream flow processors to provide a dedicated hardware acceleration layer for the firewall, TLS 1.3 inspection, and IPsec VPNs. Called FastPath, the VMware version can use the VM's vCPUs for firewall acceleration only and this function isn't supported at all in Hyper-V with Sophos recommending turning it off from the CLI.

That aside, the virtual appliance offers all the same security measures and uses policies to combine firewall rules, service filters, and time schedules with other functions such as web and application filtering, intrusion detection, and email anti-spam for all common messaging protocols. A filtering feature makes it easy to find specific rules within complex policies and you can reset traffic counters back to zero without requiring an appliance reboot.

Application filters are extensive as Sophos currently provides over 3,600 predefined apps and you can create multiple custom policies that can be easily applied to specific firewall rules. Web filtering services are equally good as you have over 90 categories you can choose to block or allow and a predefined set of policies are included to get you started.

Sophos Firewall Virtual review: Monitoring and cloud services

The appliance's web interface opens with the Control Center dashboard which tells you everything you need to know about your security posture. It shows network activity, appliance utilization plus security issues and provides graphs for blocked and allowed applications and web categories with the User and device Insights section revealing activity for SSL inspection, ATP (advanced threat protection), and zero-day protection.

Cloud application usage is closely monitored and a list of those identified by the appliance is presented in the Control Center. One-click takes you to the cloud app list so you can decide whether to allow them. Permitted apps must be sanctioned by an administrator, unsanctioned ones will be marked and blocked while tolerated apps can be allowed but with a QoS (quality of service) rule applied to control bandwidth usage

Remote management is enabled when you register and authorize the appliance with your Sophos Central cloud account which now offers customizable dashboards. The firewall management section provides a report hub for viewing all security and policy events and you can load the Control Center interface from here as well.

Sophos Central also brings the appliance's Synchronized Security feature into play. This uses a heartbeat to monitor systems running the Sophos Intercept X endpoint agent and can isolate all systems in the same network zone if malware is detected on any of them.

Make sure you enable traffic logging on each firewall rule as this allows the appliance to gather information for its reporting services. It's worth it as Control Center can provide a wealth of valuable information so you can keep a close eye on areas such as firewall, malware, threat, application, web content filtering, and spam activity.

Sophos Firewall Virtual review: Is it worth it?

For network perimeter security services, the Sophos Firewall Virtual is a cost-effective alternative to hardware appliances and makes a lot of sense for businesses already heavily invested in virtualization. The Hyper-V version we tested doesn't support the FastPath feature but all the other security measures you'd expect to see in Sophos' XGS hardware appliances are present and correct, it's just as easy to deploy and can be easily upgraded with a new license to keep in step with demand.

Sophos Firewall Virtual requirements

Hypervisor – Microsoft Hyper-V, VMware ESXi 7, KVM, Citrix, Nutanix Prism

Managed service providers (MSPs) are struggling to contend with rampant cyber security skills shortages, according to a new study by IT security firm Sophos. 

Human staff, Sophos said, “remain central” to effective cyber security, with skilled professionals necessary to “configure, deploy, manage, respond to, and update technology solutions”.

The long-standing cyber security skills shortage is hampering MSPs' ability to effectively perform their role supporting clients, the study noted.

“The shortage of skilled professionals is well-known, and organizations are increasingly turning to MSPs to fill the gaps, exacerbating the challenge,” the report stated. “Technology alone cannot automatically stop every cyber threat”.

Reflecting this problematic shortage of in-house cyber security skills, the report stated that 66% of MSPs use a third-party vendor to deliver managed detection and response (MDR) services.

On top of that, a further 15% deliver MDR services as a joint effort, through a combination of their own security operations center (SOC) and a third-party vendor.

MSPs indicated that hiring new cyber security analysts to keep pace with customer growth and the latest cyber threats was a considerable challenge. The survey revealed that 34% of MSPs that provide an MDR service have an in-house SOC which, in turn, necessitates in-house specialist analysts.

The pace of technology is an issue for MSPs

Keeping pace with the latest cyber security solutions and technologies was also a key issue, cited as the single biggest challenge facing MSPs by 39% of respondents involved in the survey. 

“Given the speed of innovation in this space, it is unsurprising that many MSPs are struggling to keep up. As threats evolve, so do the cyber controls that stop them,” the report stated.

There are difficulties in the provision of cyber security vendors as well, as the study revealed that over half (53%) of MSPs work with just one or two cyber security vendors, while 83% use between one and five.

According to Sophos, MSPs estimate a reduction of 48% in their day-to-day management time where they are able to manage all their cyber security tools from a single platform.

Other challenges facing MSPs included providing out-of-house coverage, such as on the weekends or during holidays, and winning over new customers.

“The speed of innovation across the cybersecurity battleground means it’s harder than ever for MSPs to keep up with threats and the cyber controls designed to stop them,” Scott Barlow, vice president of MSP at Sophos, said.

“When you couple this with a global skills shortage, which has made it infinitely more difficult for many MSPs to attract and retain cybersecurity analyst resources, it's unsurprising that MSPs feel unable to keep pace with the changing threat landscape,” he added.

Sophos has announced the appointment of Joe Levy as its new CEO as the cyber security provider looks to expand its customer base in the midmarket.

Levy steps into the job having led the business as acting CEO since February 15 and has moved swiftly to name Jim Dildine as Sophos’ new chief financial officer.

A seasoned cyber security veteran, Levy brings 30 years’ leadership experience in cyber security product development, services, and companies, and has spent nine years at Sophos to date.

During his time at the company, he has helped drive its transformation from a product-only vendor into the broader cyber security organization it is today, including the development of an incident response team and managed detection and response (MDR) service now leveraged by 21,000 organizations globally.

Levy is also credited with creating SophosAI and Sophos X-Ops solutions and is well-versed in the workings of the channel, having worked closely with MSPs throughout his career.

In an announcement, Levy said his leadership strategy will place a focus on expanding Sophos’ customer base in the midmarket, which already includes 600,000 customers worldwide and generates more than $1.2 billion in annual revenue.

“Our goal is to help more organizations in the midmarket – the estimated 99% of organizations that are below the cyber security poverty line – be better at detecting and disrupting inevitable cyber attacks,” Levy said.

“Our envisioned approach to achieving this is to work with MSPs and channel partners that can scale alongside us with our innovative critical cross domain technologies – endpoint, network, email, and cloud security – and managed services that they can resell and co-deliver.

“Cyber attacks against the midmarket could severely impact the world’s ability to function; they are relatively under-protected compared to the 1%, and Sophos is on a mission to change that.”

Sophos’ new CFO will support expansion strategy

Jim Dildine, who has been named as the company’s new CFO as part of Levy’s leadership strategy, also adds extensive operation expertise and a wealth of experience in channel-partner based cyber security business. 

Most recently, Dildine spent four years serving as CFO at cyber security firm Imperva and has previously held the same role at Symantec’s enterprise security business. He has also held key financial roles, as well as chief technology officer, at Blue Coat Systems over a period of nine years.

At Blue Coat, Dildine oversaw considerable growth in market value while guiding the company through various ownership transactions, including its $4.6 billion sale to Symantec in 2016. He also led the company’s acquisition and integration of six security-focused companies during his tenure.

Commenting on his new role, Dildine said Sophos is “well on its way to breaking through to the next level” and achieving its growth ambitions.

“Everything the company has accomplished thus far is impressive, including how dedicated Sophos is to constantly be innovating its cyber security technology and managed security services for customers in the midmarket,” he said.

“Sophos is also equally committed to supporting its channel partners, MSPs, and staff around the world. I am looking forward to helping Joe accelerate growth and further position Sophos as a leader in the industry.”

Nearly 70 leading US software companies have agreed to join a voluntary pledge drawn up by CISA urging developers to incorporate secure by design principles into their products.

CISA director Jen Easterly said she has seen real change in the software ecosystem since the initiative’s announcement in April 2023, and on 8 May CISA announced the first round of commitments from high-profile companies at the RSA Conference in San Francisco. 

Easterly said the goal of the project is to promulgate better built in security to counter both the ongoing “scourge of ransomware” as well as a concerning rise in state-sponsored threat campaigns focussed on disrupting critical national infrastructure.

“[Nation-state threat actors] are burrowing into our critical infrastructure not for espionage, not for data theft, not for intellectual property theft, but specifically to launch disruptive and destructive attacks in the event of a major conflict”.

Easterly said this threat was “different in kind” to anything she has observed over the course of her career, and it is why the US government is prioritizing cyber resilience and implementing secure by design principles across as many digital products as possible.

The pledge consists of seven goals each with core criteria that defines what the manufacturers are pledging to work towards, which include examples of how they can demonstrate measurable progress towards achieving these targets.

Similarly, the pledge sets out a number of means by which the signees can demonstrate quantifiable progress towards their goals, but will give the companies some discretion to decide how best they can go about demonstrating their progress.

The first round of commitments included major players signing up to the pledge including Microsoft, IBM, AWS, CrowdStrike, GitLab, Sophos, Lenovo, NetApp, and HP.

Easy wins to bolster cyber resilience across the board

First up is increasing the use of multi-factor authentication (MFA) across software products, which it describes as the best defense against popular password-based attacks such as credential stuffing.

Companies that sign on to the pledge will be asked to take efforts to reduce the use of default passwords in their products, suggesting they switch to random, instance unique passwords or requiring the user create a strong password as soon as they begin the product’s installation process.

Within one year of signing the pledge, companies will also be expected to demonstrate the actions they have taken to significantly reduce the prevalence of one or more vulnerability classes in their products.

By eliminating vulnerabilities by class, CISA argues companies can prevent these flaws at scale which could significantly improve the efficiency of their efforts to keep their products secure.

The pledge wants software manufacturers to take ownership of the security outcomes of their customers, even after the product has been shipped. 

As such, it targets increasing the installation of security patches by asking companies to make it easier to install the updates. This could be achieved through introducing automatic update mechanisms or by providing patch support, for example.

Timely vulnerability disclosure is another important aspect to ensuring companies stay secure. By next year, signees are expected to publish their own vulnerability disclosure policy (VDP) that provides a clear channel to report flaws.

Moreover, the pledge hopes to boost transparency further asking its signatories to commit to demonstrating material improvements in the accuracy of their vulnerability reporting by providing an accurate Common Weakness Enumeration (CWE) and Common Platform Enumeration (CPE) fields in every CVE record for their products.

Finally, CISA wants companies to get better at recognizing and reporting unauthorized access to their internal systems. It states assenting companies should be able demonstrate a measurable uptick in their ability to gather evidence of cyber security instructions affecting their products.

“The only way we can make ransomware and cyber attacks a shocking anomaly”

The EU received formal approval on its own approach to boosting security postures across the board, the Cyber Resilience Act, in March 2024, which is a legal framework that sets out cyber security requirements for both hardware and software products sold in the region.

The framework targets similar problems currently rife among digital products such as improving the security of the software supply chain, and better vulnerability reporting from manufacturers, but importantly this approach is legally binding and those who fall foul could be prosecuted.

The UK has also introduced legislation looking to eradicate common security issues with its Product Security and Telecommunications Infrastructure (PSTI) act which, like the Secure by Design pledge, wants to get rid of default passwords - but in this case it's for smart devices, unlike software products.

CISA’s Secure by Design pledge does not incorporate hardware, but added that companies that wish to demonstrate progress in those areas are welcome to do so. 

More importantly, the goals outlined in the pledge are not legally binding, and it is not clear if the signatories can pick and choose which targets they want to try to meet, as the agency will have little recourse if they were to take this approach.

Speaking to this concern, Easterly argued that the strength of the approach centers around transparency, where customers will be able to see which vendors are taking security seriously.

“It is a voluntary pledge but the great thing is we have a platform to be able to advance radical transparency and so consumers that have to make decisions about what technology they buy will see whether these technology manufacturers actually took those steps”, she explained.

“I think it is the only way we can make ransomware and cyber attacks a shocking anomaly, and that is to ensure that the technology is more secure.”

The fact the pledge already has 68 high-profile software manufacturers signed on suggests software developers are more than happy to signal to regulators they care about improving the baseline security of their products, and as such could prove to be a useful way of getting industry buy-in without having to resort to the threat of legislation.

Cyber security provider Sophos has teamed up with exposure management specialist Tenable to deliver Managed Risk, a new vulnerability and attack surface management service for organizations around the world. 

By leveraging Tenable’s One Exposure Management Platform, the new service aims to help customers thwart cyber attacks through capabilities that include attack visibility, continuous risk monitoring, vulnerability prioritization, investigation, and proactive notification.

A dedicated team will work with Tenable’s exposure management technology as well as collaborate with security operations experts from Sophos Managed detection and Response (MDR) business, sharing information and data around zero-days, known vulnerabilities, and exposure risks to assess potentially exploited environments.

Sophos Managed Risk is available with a term license via the company’s network of channel partners and MSPs, with a Sophos MSP Flex version slated for availability later in the year.

In an announcement, Rob Harrison, Sophos’ senior vice president for endpoint and security operations product management, said the offering will help customers address “urgent, pervasive security challenges” that they consistently struggle to control.

“We can now help organizations identify and prioritize the remediation of vulnerabilities in external assets, devices and software that are often overlooked,” he explained. 

“It is critical that organizations manage these exposure risks, because unattended, they only lead to more costly and time-consuming issues and are often the root causes of significant breaches.”

Sophos said its latest research highlighted three key tasks that organizations must prioritize in order to minimize their risk: closing exposed remote desktop protocol (RDP) access, enabling multi-factor authorization (MFA), and patching of vulnerable servers.

“We know from Sophos’ worldwide survey data that 32% of ransomware attacks start with an unpatched vulnerability and that these attacks are the most expensive to remediate,” Harrison added.

“The ideal security layers to prevent these issues include an active approach to improving security postures by minimizing the chances of a breach with Sophos Managed Risk, Sophos Endpoint, and 24x7 Sophos MDR coverage."

Available as an extended service with Sophos MDR, the new Managed Risk offering will work to assess an organization’s external attack surface, prioritize the riskiest exposures, and deliver tailored remediation guidance to eliminate blind spots.

Sophos said customers will benefit from external attack surface management (EASM) for advanced identification and classification of internet-facing assets such as email servers, web apps, and public-facing API endpoints. Users will also be able to leverage continuous monitoring and proactive notification of high-risk exposures, as well as vulnerability prioritization and identification of new threats.

Additionally, organizations will benefit from regular interaction and scheduled meetings with Sophos experts to review discoveries, insights, and recommendations, as well as initiate enquiries with the Sophos Managed Risk team via the firm’s Central platform.

“While the latest zero day may dominate the headlines, the biggest threat to organizations, by a large margin, is still known vulnerabilities – or vulnerabilities for which patches are readily available,” commented Greg Goetz, Tenable’s vice president of global strategic partners and MSSP. 

“A winning approach includes risk-based prioritization with context-driven analytics to proactively address exposures before they become a problem.

“Sophos Managed Risk, powered by the Tenable One Exposure Management Platform, delivers outsourced preventive risk management, enabling organizations to anticipate attacks and reduce cyber risk.”

Sophos has confirmed that chief executive Kris Hagerman will step down as the company looks to consolidate its position as a cyber security as a service provider. 

Joe Levy will assume the role following Hagerman’s departure after being appointed president last year.

Hagerman, who will serve as an advisor to the company until April 1, has been CEO of Sophos since 2012. He's led the company through significant growth, with revenue reaching more than $1 billion, and its worldwide customer base growing from around 150,000 customers to more than 580,000.

He also led the company's successful IPO on the London Stock Exchange in 2015, and oversaw its sale to Thoma Bravo in 2020.

"I am proud of our team’s accomplishments over the last 12 years as we have transformed Sophos into a true next-generation cyber security leader and an industry innovator in delivering cyber security as a service," Hagerman said.

"I am excited to pass the baton to Joe Levy as president and acting CEO to lead Sophos into the future. Joe and I have worked closely together for over nine years, and he has been pivotal in leading our product, services and technology initiatives that have underpinned Sophos’ growth. He has my full and enthusiastic support."

Sophos eyes managed service gains

Levy has been with the company for nine years, having joined from Blue Coat Systems. Since the sale to Thoma Bravo, Levy is credited with turning the company from a product-only vendor into a global cyber security as a service company, with Sophos now having more than 20,000 managed services customers worldwide.

He also launched the company's operational threat intelligence unit, Sophos X-Ops, a 500-person team offering real-time and historical attack data. 

"I am extremely excited for the opportunity to further grow Sophos as a global cyber security leader. Many organizations worldwide are still neglected relative to the industry’s focus on securing large enterprises, leaving them exposed to opportunistic and targeted attacks," Levy said.

"Our immediate goal is to work with our partners to further expand our collective ability to secure organizations that are unprotected or need stronger cyber defenses."

Last January, Sophos announced that it was laying off 10% of its staff - around 450 people worldwide - as part of its restructuring.

The aim, it said, was to "achieve the optimal balance of growth and profitability" and to allocate more resources to its cyber security as a service operations.

"We’re pleased to appoint Joe as the President and acting CEO of Sophos. Joe’s hands-on career as a cybersecurity practitioner, innovator and successful business leader moves Sophos into a whole new level of competitiveness," said Chip Virnig, partner at Thoma Bravo and a Sophos board member.

"With his industry pedigree and accomplishments, Joe is well-positioned to lead Sophos in the direction the market is demanding."

Ransomware gangs are leveraging media coverage of attacks to pile pressure on victims to meet their demands, according to new research.

Analysis from Sophos X-Ops has highlighted the increasingly close relationship between ransomware groups and the media, suggesting that while hackers are traditionally secretive, some now see the potential in using their publicity to enhance extortion techniques. 

Victims may be concerned about the reputational damage they might suffer if the data or sensitive information was seized, or even the fines they could incur from bodies such as the Information Commissioner’s Office (ICO) for failing to prevent a data breach.

Sophos X-Ops said some hacking groups are explicit about promoting attacks via media channels to serve as a warning to victims. 

The study specifically pointed to the Dunghill ransomware gang, which threatened to “send the data to all interested supervisory organizations and the media” if their demands were not met.

In addition to using media coverage to ratchet up pressure on victims, threat actors are also making use of press coverage to generate positive publicity and boost recruitment, according to Sophos X-Ops’ research.

Ransomware gangs are aware of the coverage of their activities and have been observed to publicly correct outlets who are inaccurate in their reporting, the study noted. 

Sophos X-Ops said the trend points toward a concerted effort among some ransomware groups to develop a media strategy in an attempt to professionalize and commodify their image. 

Some have been found to publish press-releases and refine their branding to boost credibility with victims and journalists alike. Others, such as Vice Society, have even promoted content listing them as a 'top ransomware group'. 

Although increased publicity does also mean ransomware groups are exposed to a higher risk of law enforcement scrutiny, it also adds weight to their threats of leaking sensitive information.

Ransomware groups target better media relations

Sophos X-Ops’ investigation shows threat actors’ attitudes towards the media are shifting with the majority of groups covered in its analysis displaying a marked turn towards collaborating with the media on their public image.

Some ransomware groups granted interviews to journalists in which they shed a positive light on their activities in what may be an attempt to drive recruitment, according to Sophos X-Ops.

The RansomHouse group, for example, features a message on its leak site that directly addresses journalists, offering to share information through a PR channel on Telegram before it is officially published.

Prominent ransomware group Rhysida’s contact form lists journalists before recoveries on its contact form, suggesting its interest in shaping its public image comes before extracting ransoms from its victims.

Some ransomware gangs are frustrated by media coverage

These groups are not completely embracing the media’s coverage of their attacks, however, with some groups becoming increasingly belligerent towards outlets and journalists deemed to have misreported on incidents involving them.

ALPHV/BlackCat, for example, released a 1,300-word blog post on its leak site criticizing publications for failing to check sources and publishing false information.

Cl0p were also found to be hostile towards media organizations, appearing to resent outlets challenging the narrative constructed through their own disclosures.

The BBC was called out by Cl0p for misrepresenting the information supplied by the group, who stated “the only story is we want money for our work. If we have your business files you have to pay”.

SMBs and branch offices looking for a powerful security appliance will find Sophos' XGS 126w a worthy candidate. Inside this compact desktop model lurk two processors, allowing Sophos to claim an impressively high firewall IMIX (internet mix) throughput of 10.3Gbits/sec and 0.9Gbits/sec with all threat protection services enabled.

This superpower is achieved by teaming up a 2.6GHz dual-core AMD Ryzen Embedded R1600 CPU with Sophos' Xstream flow processor. The latter provides a dedicated FastPath hardware layer that handles TLS 1.3 encrypted traffic plus deep packet inspection (DPI) and application acceleration, with the latest SFOS v19 firmware adding IPsec VPNs to FastPath.

Network ports are plentiful, with the appliance offering 12 copper gigabit ports with 30W PoE+ on the last two and two gigabit SFP fiber ports for longer connection distances. The triplet of external aerials indicates that wireless is on the menu, although this is the older dual-band 2.4/5GHz 11ac variety.

Sophos' new licensing scheme presents a pick-and-mix buffet of features so you can choose only those security services you need. We've gone the whole hog with a three-year Xstream subscription, which activates the base firewall, all Xstream features, the network, web and zero-day protection modules, central orchestration, and enhanced 24/7 support. Email and web server protection are optional, with each costing £365 for three-year licenses.

Sophos XGS 126w review: Setup

Installation is a pleasant experience, as the web console's deployment wizard automatically upgrades the firmware to the latest version. All you need to do is set a strong admin password. The wizard configures the LAN port zones as well as internet access and enables essential protection with a default set of firewall policy rules that include anti-malware and web content filtering.

The appliance's local Control Center web console keeps you firmly in touch with the action, presenting a detailed overview of network activity, security issues, web traffic, and detected network attacks, plus blocked and allowed applications and web categories. The "User & device insights" section keeps a tally of the advanced security measures, and clicking on the zero-day protection portion opens a report on downloaded files sent to the Sophos cloud sandbox for further analysis to see if they can be safely released.

Policies make light work of security configuration: they bring together firewall rules, service filters, time schedules, web and application filtering, intrusion detection, and email anti-spam. The web filtering service offers 130 URL categories to block or allow, and SafeSearch and YouTube restrictions can also be enabled.

Application filters are equally extensive, with Sophos currently providing 3,532 signatures, 73 specifically for all Facebook activities. For more control over users and groups, you can download the Windows, macOS, Linux, iOS, and Android authentication clients from the web console and apply extra policies with daily upload and download restrictions and limits on internet usage.

The internal wireless AP supports multiple SSIDs with client isolation, and their traffic can be placed in separate network zones with custom security policies. Guest users can be presented with hotspots and acceptable use policies, but this Wi-Fi 5 AP doesn't support the more secure WPA3 encryption.

We have a Sophos Central account and registering the firewall with it provides full remote management services as the portal presents the same Control Center console.

There's more to be gained with the appliance's Synchronized Security feature, which uses a heartbeat to monitor systems running the Sophos Intercept X endpoint agent and isolate them if malware is detected.

The XGS 126w impresses with its easy deployment and deep set of security features. The Wi-Fi 5 access point is dated, but the appliance works seamlessly with the Sophos Central cloud service and its smart Xstream architecture delivers an impressive performance.

Sophos XGS 126w specifications

The arms race between security teams and threat actors is escalating as “dwell times” shorten, according to new research from Sophos. 

Dwell times, which mark the time from when an attack starts to when it is detected, dropped from an average of 10 days to just eight for all attacks, the analysis shows. 

This dip underlines the changing nature of attacks, Sophos said, with organizations becoming increasingly efficient at detecting and responding to incidents in rapid time. 

“As adoption of technologies like XDR (extended detection and response) and services such as MDR (managed detection and response) grows, so does our ability to detect attacks sooner,” said John Shier, field CTO at Sophos. 

“Lowering detection times leads to a faster response, which translates to a shorter operating window for attackers.”

While this may appear to be positive news for organizations, the reality is that rapid reaction times mean threat actors are accelerating attacks and adopting new techniques. 

Shier suggested that many organizations have become “victims of their own success” with regard to security practices, prompting a more aggressive approach from attackers and placing significant strain on security practitioners. 

“Criminals have been honing their playbooks, especially the experienced and well-resourced ransomware affiliates, who continue to speed up their noisy attacks in the face of improved defenses.”

For ransomware attacks, the most prevalent form of attack analyzed, dwell time dropped significantly from 10 days to five, Sophos found. 

Similarly, in more than three quarters (81%) of ransomware attacks, Sophos said the final payload was launched outside of conventional working hours. Of those that were deployed during traditional operating hours, only five occurred on a weekday. 

“The number of attacks detected increased as the week progressed, most notably when examining ransomware attacks. Nearly half (43%) of ransomware attacks were detected on either Friday or Saturday,” the firm said. 

With security teams acting swiftly to respond to threats in record times, malicious actors have become increasingly conscious of operating hours and are purposefully targeting firms at the most inconvenient times possible. 

Long-term, this means that organizations aren’t necessarily more secure, Shier said. 

“This is evidenced by the leveling off of non-ransomware dwell times. Attackers are still getting into our networks, and when time isn't pressing, they tend to linger. But all the tools in the world won't save you if you're not watching.”

Growing Active Directory risks

Among the most concerning finds from the Sophos report was a decrease in the time it takes for attackers to reach Active Directories (AD); on average, it took them just 16 hours.

Active directories are among the most critical assets for any organization, being used to manage identity and access to company resources. Gaining access to a directory would enable attackers to “easily escalate” system privileges and conduct malicious activity, Sophos said. 

The decreased dwell time in this regard should be a serious cause for concern for security teams, Shier warned. 

"Attacking an organization's Active Directory infrastructure makes sense from an offensive view. AD is usually the most powerful and privileged system in the network, providing broad access to the systems, applications, resources, and data that attackers can exploit in their attacks,” he said.

“Getting to and gaining control of the Active Directory server in the attack chain provides adversaries several advantages. They can linger undetected to determine their next move, and, once they’re ready to go, they can blast through a victim's network unimpeded.”

Technology touches every part of retail, and in addition to customer-facing points of weakness online and in the real world, retailers also need to ensure their own business operations and internal data are not breached.

The threat posed by ransomware attacks is extremely damaging for retailers, both in terms of immediate financial loss and also with regards to customer data. Yet many retailers are running outdated and fragmented IT infrastructures supported by overstretched IT teams.

Learn how retailers can keep things up and running, ensuring safety for staff and customers, by having a Sophos Managed Detection & Response team in their corner at all times.

Provided by

According to Sophos data, the average ransomware pay-out made by manufacturers in 2021 was £1.9 million ($2 million), which was higher than any other sector. This willingness to pay out high ransom demands in combination with a reliance on technology and automation in the sector makes it very appealing to cybercriminals.

There are countless examples of how manufacturers around the globe are finding themselves under attack from cybercriminals, which emphasises the need for them to prioritise strengthening their defences.

With a continually changing threat landscape and limited budgets, manufacturers are turning to Managed Detection & Response services from Sophos for 24/7 protection. Download this whitepaper to learn more.

Provided by

Don’t be deceived by its modest dimensions: the Sophos XGS 116 is a security powerhouse. Aimed at busy SMBs and branch offices, this desktop appliance boasts a raw firewall throughput of 7,700Mbits/sec, and even with full threat protection enabled it keeps up a creditable 685Mbits/sec.

That’s largely thanks to Sophos’ dual-processor architecture. The Xstream Flow Processor provides a hardware acceleration layer that’s optimised for specific network tasks, ensuring the main AMD CPU doesn’t get bogged down.

Connection options abound. The rear panel presents eight Gigabit Ethernet ports – with PoE+ on the last one – plus one fibre port. While there’s no built-in modem, an expansion bay lets you add VDSL2 or 3G/4G modules, although Sophos’ Flexi network cards only work with larger rackmount models like the XGS 3300.

The flexible licensing model allows you to choose which features you want, and there are plenty on offer. We’ve shown the price of a three-year Xstream subscription above, which enables the base firewall licence along with Xstream TLS 1.3 SSL inspection, deep packet inspection, network, web and zero-day protection modules, central orchestration and enhanced 24/7 support. The email and web server protection modules are optional extras, each costing around £142 for a three-year licence.

Deployment is easy thanks to the appliance’s web console wizard, which guides you through the steps required to get secure internet access up and running. We chose routed mode as we wanted the appliance to provide all security functions; protection starts immediately, with the wizard enabling a standard set of firewall security policies including web filtering and anti-malware.

Henceforth, the Control Center dashboard provides everything you need to know about network activity and security issues. Graphs provide a clear visual overview of web traffic and network attacks, plus blocked and allowed applications and web categories. The User and Device Insights section keeps track of activity in modules such as SSL inspection, advanced threat protection and zero-day protection, and clicking on an icon takes you directly to a more detailed report.

Remote management comes into play too, via the Sophos Central portal. After we’d registered the appliance with our account, we were able to bring up live reports in a web browser, and to access the appliance’s Control Center console remotely for full configuration.

Businesses with home workers will love the Synchronised Security feature, which extends firewall protection to remote systems running the Sophos Intercept X endpoint agent. A heartbeat service monitors and automatically isolates any that are compromised, while the application control feature detects unknown applications running on endpoints and pushes out firewall policies to secure them.

All of this is controlled via policies that bring together firewall rules, service filters, schedules and specific settings for intrusion detection, email, applications and web filtering. That last feature is particularly impressive: the appliance comes with predefined settings to get you started, but you can choose to block or allow sites in over 90 categories. Application controls are equally extensive, with more than 3,500 predefined filters supplied, including 12 for Twitter and 73 for Facebook, so you can finely control social networking in the workplace.

A new filtering feature in the latest firmware also makes it easy to find specific rules within complex policies, and lets you reset traffic counters to zero with a click – a big improvement on the previous release, which required a reboot.

All told, the XGS 116 delivers strong gateway security measures at a great price. It has the power to cope with high demand, and the integration with Sophos’ endpoint security software will appeal to businesses that want to extend their protection to home workers.

Sophos XGS 116 specifications

Retail companies that are impacted by ransomware pay less than a third of the amount of the industry average when meeting ransom demands, new research has revealed.

The average payment made to a ransomware organisation in the retail sector throughout 2021 was $226,000 (£197,000), significantly less than the industry average of $812,000 (£708,000) per incident.

Nearly one in four (22%) paid less than $1,000 (£871) for each incident, Sophos said, and the vast majority (70%) paid less than $100,000 (£87,000) whereas just 47% of the global average got away with paying less than six-figure sums.

The overall cost to remediate an attack was down on 2020’s numbers in retail too at $1.27 million (£1.1 million), a reduction from $1.97 million (£1.7 million) the year before.

Total costs of ransomware incidents can cover a wide variety of things including paying the ransom fee itself, the cost of recovering systems, a potential rise in cyber insurance premiums, and the cost of improving systems to prevent further attacks, among other areas.

Retail was largely spared from paying the highest prices for their ransomware attacks, but incidents still increased over the year, according to the researchers, with as many as 77% of all retail organisations being impacted in some way.

This figure represents a sizeable increase on the previous year’s of 44% and shows how retail is being targeted more frequently compared to the wider industry where 66% of companies were impacted on average.

Sophos said retail was the second-most targeted industry and was also reported slightly above average rates of data being encrypted in attacks - 68% vs the industry average of 65%.

Only 28% of retail organisations were able to stop their data from being encrypted after noticing an attack had begun - a figure that contributed to the reports that almost all companies (92%) said attacks impacted their ability to operate.

Retail firms are getting better at using backups to restore their data after it becomes encrypted - the industry’s long-recommended method of ransomware remediation.

73% of retail companies used backups following an attack, a figure that’s up considerably over the previous year’s 56%, but companies still report not benign able to get all of the data back.

Only 62% of all encrypted data was recovered, on average, in retail which is in line with the industry average of 61% - a drop from 67% in 2020.

The number of businesses that were able to recover the entirety of their data was also down on the previous year’s figures - 5% and 9% respectively.

“The key takeaway here is that paying the ransom will only restore a part of your encrypted data and you cannot count on the ransom payment to get you all your data back,” Sophos said.

The received wisdom in the industry has always been to never pay the ransom. In doing so, victims directly fund cyber crime and validate the business model itself.

However, many organisations are known to flout this advice in the hope of more quickly regaining access to data and their operations. Sophos’ research showed that 49% of all retail companies paid their attackers' ransom demands in 2021.

The dynamic between criminal and victim in a ransomware case is a mutually beneficial one, from the criminal’s perspective: the criminal encourages payment and repays the trust of the victim for paying the ransom in returning the encrypted files through a decryption key.

Sophos’ data would suggest that the dynamic is being exploited by the criminals and if victims continue to lose access to a sizeable portion of their files, it may discourage payment.

In cases where the victim restores from backups, the effectiveness of the recovery is only as effective as the backup strategy itself. If the backup is weeks old then the business will struggle to fully recover.

The past twelve months have brought challenges for almost all businesses, but they’ve also brought some terrific products. New generations of servers and appliances have arrived, offering levels of horsepower and capacity that would have seemed outlandish just a few years ago. At the same time, value has continued to climb, bringing new possibilities within reach of an SMB budget.

There’s been plenty of exciting developments for end users too. Stunning laptops, tablets and phones have turned our heads, along with powerful printers, scanners and screens. And while threats like phishing and ransomware haven’t gone away, the latest generation of security software is here to keep us safe.

As always, there’s no such thing as a perfect product – every business and every individual will have their own needs and preferences. But we’ve put together our selection of the greatest releases of the past twelve months, to reveal the standout products across a wide range of categories, and to celebrate the manufacturers who’ve driven innovation forward in 2021.

Best laptop 2021

WINNER: LG Gram 17

Weighing just 1.35kg, the Gram 17 is barely heavier than many 14in laptops – yet it has a huge, bright 17in display that’s fantastic for productivity and on-the-go presentations.

There’s plenty of horsepower here too, with an 11th-generation Intel Core i7 processor and 16GB of RAM on board. With nearly 13 hours of battery life it won’t conk out half-way through the day, and a spacious keyboard and trackpad mean it’s also a pleasure to work on for extended periods. Throw in Thunderbolt 4 and Wi-Fi 6 and you have an excellent do-it-all, go-anywhere computer for a very reasonable £1,599 exc VAT.

Read our full LG Gram 17 review

HIGHLY COMMENDED: Razer Book 13

Razer made its name with gaming laptops, but the company’s first business-friendly model is a big hit. It looks stylish yet serious, with a superb screen that challenges the MacBook Pro for brightness and colour quality. Performance is top-notch too, thanks to an Intel Core i7-1165G7 processor, and there’s a great selection of ports, including full-sized USB and HDMI connectors. At 1.4kg it’s a little weighty for a 13in laptop, but overall it’s a great, capable choice for an everyday working companion.

Read our full Razer Book 13 review

Best Chromebook 2021

WINNER: Acer Chromebook Spin 713

There are plenty of sub-£500 Chromebooks on the market, but Acer’s Chromebook Spin 713 feels like something much more expensive. Its 13.5in QHD screen has a comfortable 3:2 aspect ratio, and it flips all the way around so you can work in laptop, stand or tablet mode. Unusually, there’s an HDMI output too, giving you additional working options.

Wi-Fi 6 and Bluetooth 5 round out the feature set, and with a total weight of just 1.2kg the Spin 713 is deliciously portable too. It would have been nice if Acer had given that beautiful screen an anti-glare coating, but when the rest of the package is this good we can live with a few reflections.

Read our full Acer Chromebook Spin review

HIGHLY COMMENDED: Lenovo IdeaPad Flex 5

The Flex 5 is another Chromebook with a 360º-rotating screen, though its 16:9 aspect ratio is best suited to conventional laptop-style usage. It’s slimmer and lighter than the Acer Spin 713, and its bright display is less reflective. Connectivity is well covered with both USB Type-A and Type-C ports, along with Wi-Fi 6; if you’re looking for a no-nonsense Chrome OS workhorse, you won’t be disappointed.

Read our full Lenovo IdeaPad Flex 5 review

Best tablet 2021

WINNER: Apple iPad Pro 12.9in

With Apple’s mighty M1 processor, the iPad Pro is fully as powerful as a MacBook Pro. And it has several advantages over the laptop: at 680g it’s less than half the weight, and the touchscreen makes for a slick, tactile experience. The 120Hz mini-LED display is stunning, and a battery life of around 13 and a half hours means you can keep working all through the day and beyond.

No doubt, the 12.9in format is bulky for a tablet, while the optional keyboard pushes up the weight – and the price, which is already steep at £916 exc VAT for the base model. Even so, this is unquestionably the best tablet on the market: it doesn’t just excel at tablet tasks, it redefines what a tablet can do.

Read our full Apple iPad Pro 12.9in review

HIGHLY COMMENDED: Nokia T20

It’s short on flashy gimmicks, but Nokia’s T20 feels like a professional tablet. The aluminium build is strong and sturdy, performance and features are up to par, and while we felt the 10.4in screen looked a little cold, its 5:3 aspect ratio is very comfortable to work on. The most impressive part is the price – just £150 exc VAT for the Wi-Fi 5 edition, or £167 exc VAT for the LTE model.

Read our full Nokia T20 review

Best smartphone 2021

WINNER: Apple iPhone 13

The iPhone 13 improves on last year’s iPhone 12 models with better cameras and a bigger battery, adding nearly two hours of daily performance in our tests. You get more storage in the standard model too, up from 64GB to 128GB, and the latest Apple A15 Bionic CPU for true Android-smashing performance.

All the usual iPhone strengths are here, including an excellent screen and a vast library of high-quality apps for work or play. It’s hardly an adventurous update from the iPhone 12, but if you’re choosing a new smartphone today – and aren’t already enmeshed in the Android ecosystem – then the iPhone 13 is the obvious choice.

Read our full Apple iPhone 13 review

HIGHLY COMMENDED: OnePlus 9 Pro

Standing 163mm tall, the OnePlus 9 Pro is large, but it’s perhaps the most beautiful Android smartphone we’ve seen, with a tiny bezel and beautifully textured case. Its 120Hz AMOLED display is a joy to behold, and a collaboration with Hasselblad ensures excellent photo and video quality. Performance is very strong too, courtesy of a top-tier Snapdragon 888 processor; at £829 exc VAT it’s not a budget option, but you get what you pay for.

Read our full OnePlus 9 Pro review

Best desktop server 2021

WINNER: HPE ProLiant MicroServer Gen10 Plus

The MicroServer Gen10 Plus really can fit happily on a desktop, as its square chassis measures a mere 245mm along each side. Yet it’s powerful enough to run a wide range of business services, with your choice of a dual-core 3.8GHz Pentium Gold G5420 CPU or a quad-core 3.4GHz Xeon E-2224. Four integrated LFF SATA drive bays allow for plenty of storage.

The small size means there’s not much scope for internal expansion, but you do get a single PCI-E x16 slot, and remote management can be added via the cheap iLO5 enablement kit. With the entry-level diskless system starting at just £395 exc VAT, it’s an excellent SMB-friendly deal.

Read our full HPE ProLiant MicroServer Gen10 Plus review

HIGHLY COMMENDED: Dell EMC PowerEdge T550

The T550 is a real “tower of power” – we tested it with a 12-core 2.1GHz Xeon Silver 4310 CPU, but if you need more grunt it can handle twin CPUs with up to 32 cores each. It also supports up to 24 SFF or eight LFF drives, and a maximum of 1TB of DDR4 RAM. Dell’s comprehensive iDRAC9 remote management platform comes as standard, making this an ideal answer to demanding workloads.

Read our full Dell EMC PowerEdge T550 review

Best 1U server 2021

WINNER: Dell EMC PowerEdge R650

Dell’s latest PowerEdge R650 design crams an amazing amount of potential into a 1U chassis. It supports Xeon Scalable CPUs with up to 40 cores and a massive 4TB of memory, with space inside for up to ten SFF drives and 16 Intel Optane modules to accelerate performance.

If that’s not enough, you also get three PCI-E Gen4 x16 slots and an OCP 3.0 edge slot, plus Dell’s BOSS card for fast booting from SSD media. And as usual with Dell, the iDRAC9 controller provides terrific remote management. It’s not a budget option – our review unit came to £15,417 exc VAT – but the PowerEdge R650 is an incredibly powerful and space-efficient server.

Read our full Dell EMC PowerEdge R650 review

HIGHLY COMMENDED: Broadberry CyberServe Xeon

This low-profile server offers a solid chunk of power for just under £1,000. That gets you a quad-core Intel Xeon E-2224 CPU with 16GB of RAM – upgradeable to 128GB – and you’re free to fit your own drives in the four SFF bays and twin M.2 SSD slots. The single PCI-E Gen3 x16 slot can be used to add 10GbE networking, and the Asus motherboard supports web-based management, including full OS remote control and virtual media services as standard.

Read our full Broadberry CyberServe Xeon E-RS100-E10 review

Best 2U server 2021

WINNER: Broadberry CyberServe SP2 208-8I G3

The CyberServe SP2 208-8I G3 is designed for a hardcore server role. The system we tested came with a pair of 36-core Xeon Scalable Platinum CPUs, 512GB of DDR4 RAM, five 960GB SATA SSDs and eight 128GB Intel Optane PMEM 200 modules. This allows for insanely fast storage access – and to help you make the most of it, the system comes with not one but two dual-port Intel 100GbE network cards.

You can upgrade even further by going up to 26 SFF drives in total, plus eight NVMe drives, and the spacious 2U design allows for six free PCI-E Gen4 slots. It’s a magnificent hardware package, and while the £21,895 price tag won’t be within everyone’s budget, it’s superb value for what you get.

Read our full Broadberry CyberServe SP2 208-8I G3 review

HIGHLY COMMENDED: Dell EMC PowerEdge R750

Dell’s PowerEdge R750 comes in three versions – the R750xa is built for GPU-based workloads, while the R750xs is a cost-optimised version aimed at specific roles. The standard R750 is a great all-rounder though: the configuration we tested offered two 28-core 2GHz Xeon Scalable Gold 6330 CPUs and 1TB of RAM, upgradeable to a whopping 8TB using 256GB DIMMs. For storage you can choose between a 12-bay LFF backplane or a 16-bay SFF one, and add up to 24 NVMe SSDs. In short, there’s enough power and flexibility here for any business.

Read our full Dell EMC PowerEdge R750 review

Best storage array 2021

WINNER: HPE MSA 2060 Storage

With numerous hardware upgrades over the last generation, this is HPE’s fastest dedicated storage array ever. It’s also laden with powerful features: thin provisioning, snapshots and volume copies are all supported, along with striped SSD caches, RAID10, 5 and 6 options and HPE’s own MSA-DP+ array format, designed for improved performance and faster rebuild times.

The MSA 2060 even offers zero-configuration data tiering, automatically shunting data between regular SAS drives, fast solid-state storage and low-priority ML-SAS volumes according to usage. And it’s all configured and managed from a simple web portal, so there’s no need to be a storage expert to get the best from it.

Read our full HPE MSA 2060 Storage review

HIGHLY COMMENDED: Qnap TS-h2490FU QuTS Hero Edition

When performance is a priority, pure NVMe storage is the way to go. This impressive appliance can take up to 24 hot-plug U.2 drives, while Qnap’s 128-bit ZFS-based OS provides enterprise-class data integrity, with compression and deduplication options provided as standard. It’s all based on a powerful AMD EPYC processor, and it comes with a pair of dual-port 25GbE network cards, to ensure you can get the full performance from your storage.

Read our full Qnap TS-h2490FU QuTS Hero Edition review

Best NAS drive 2021

WINNER: Qnap TS-h973AX

Though it looks unassuming, Qnap’s TS-h973AX runs the company’s advanced QuTS hero OS, which offers an impressive range of native storage features. Those include fast, near-unlimited snapshots, transparent self-healing of data corruption and inline data deduplication and compression to make the most efficient use of your storage. Five LFF SATA bays plus four SFF bays provide plenty of room for expansion, while 10GbE and twin 2.5GbE network ports provide high-speed connections to the outside world.

In our tests the TS-h973AX provided fast read and write speeds, and there’s a whole library of apps to expand its capabilities, including backup and virtualisation tools. Costing just over £1,000 exc VAT for the diskless enclosure, it’s well within reach of smaller businesses.

Read our full Qnap TS-h973AX review

HIGHLY COMMENDED: Qnap TS-873A

Looking for a simple storage solution? The eight-bay TS-873A makes a great platform for Qnap’s lightweight, simple to manage QTS OS. Alternatively, for more advanced data-protection functions you can install the full QuTS hero OS and make use of all the same features as the TS-h973AX, above. Either way, it’ll run the full range of Qnap apps, and dual 2.5GbE ports help keep data flowing swiftly in and out.

Read our full Qnap TS-873A review

Best printer 2021

WINNER: Epson EcoTank ET-5880

Forget about overpriced cartridges – this A4 MFP uses bottled ink that works out to just 0.2p per mono page and 0.8p for colour. That alone will make it attractive to busy offices, but the ET-5880 has other strengths too, including a swish 10.9cm touchscreen, 802.11n wireless connectivity and excellent colour output. It comes with a pair of 250-sheet paper cassettes, so you won’t be continually restocking it, and the integrated scanner has its own 50-page duplex ADF.

The one caveat is a print speed of 25ppm in standard quality mode: that’s not exactly slow, but it’s unexceptional for a modern office printer. Even so, the Epson’s user-friendliness and phenomenally low running costs make it our top choice for 2021.

Read our full Epson EcoTank ET-5880 review

HIGHLY COMMENDED: Kyocera Ecosys

This freestanding laser MFP won’t suit the smallest offices, but it offers a 35ppm print speed and a wide range of downloadable apps to extend its printing and scanning functions. It’s easy to operate, with a big 7in touchscreen, a range of mobile apps and a clear web-based management console. The clincher is the price: the basic model with wired networking and a single 250-page sheet feeder costs just £696 exc VAT, and low-cost consumables work out to a very reasonable 1p per mono page.

Read our full Kyocera Ecosys M6235cidn review

Best scanner 2021

WINNER: Fujitsu ScanSnap iX1600

This desktop scanner has a great set of features, including integrated Wi-Fi, a 50-sheet ADF, double-sided scanning and a 4.3in colour touchscreen. It’s fast too: we were impressed to see it rip through our pile of test documents at 43ppm, creating 200dpi scans that were perfectly clear and clean enough for OCR and archival.

Even better, this hardware is partnered by one of the best software suites around. You can scan to a huge range of applications and cloud services, send scans directly to an email address or beam them to a mobile device. For anyone who needs to scan and share documents in a digital or cloud-first environment, the Fujitsu ScanSnap iX1600 is a terrific choice.

Read our full Fujitsu ScanSnap iX1600 review

HIGHLY COMMENDED: Canon imageFormula DR-S130

With its output tray folded away the DR-S130 takes up barely any more desk space than a sheet of A4. Yet it scans at a swift 30ppm, and thanks to Canon’s CaptureOnTouch V4 Pro software it can perform all the same scan functions as much pricier, bulkier models. You can set up profiles for different job types, run single- and double-sided scans, perform OCR and save the output in your choice of format and location. The only thing it can’t do is scan directly to cloud services, but for most individuals and SMBs it’ll fit the bill admirably.

Read our full Canon imageFormula DR-S130 review

Best monitor 2021

WINNER: Dell UltraSharp 25 USB-C

We don’t see a lot of 25in monitors, but the format works well for desktop productivity, and the Dell UltraSharp lives up to its name with a crisp 2,560 x 1,440 resolution. It also delivers excellent coverage of both the sRGB and DCI-P3 colour spaces, with an HDR400 certification for extended-range colour.

The final trump card is connectivity: the USB Type-C connector can handle both incoming video and outgoing power, so you can hook your laptop up to the big screen and charge it at the same time. It’s also possible to daisy-chain a second display via the DisplayPort connector, or to swivel the panel round through 90º and work in portrait mode. In short, it’s one of the cleverest monitors we’ve seen.

Read our full Dell UltraSharp 25 USB-C review

HIGHLY COMMENDED: Acer ConceptD CP5271UV

The CP5271UV is an exceptionally versatile monitor. It offers custom display modes for print editing, video and games, and also supports high-end features including HDR600 for deep-colour content, dynamic refresh rates up to 170Hz and an incandescent peak brightness of 480cd/m2. It makes a great office monitor too, with integrated gigabit Ethernet and four USB 3.1 ports. At £667 exc VAT it’s considerably more expensive than your typical desktop display, but if you're in the market for a high-end screen it’s a steal.

Read our full Acer ConceptD CP5271UV review

Best endpoint security suite 2021

WINNER: Sophos Intercept X Advanced

There’s a lot of hype around artificial intelligence, but it does have real applications: Sophos’ Intercept X suite uses machine-learning techniques to recognise malware and neutralise zero-day threats. It also includes a full range of traditional protections, defeating ransomware by intercepting encryption attacks and silently restoring the original file, and preventing data leaks by blocking the transmission of certain types of information.

The Advanced subscription adds an analysis centre, where you can forensically review attempted attacks, allowing you to identify and plug the gaps in your armour. It’s easy to deploy and manage too: a central web console lets you email out installer links to all clients, and then administer policies and settings for the whole site.

Read our full Sophos Intercept X Advanced review

HIGHLY COMMENDED: Kaspersky Endpoint Security Cloud Plus

Kaspersky’s highly flexible licensing lets you protect workstations, laptops, servers and mobile devices all within a single subscription. As well as blocking viruses and intrusion attempts, the software can watch over your network for suspicious activity, and manage Windows Updates from a central portal. The premium Plus subscription adds the Security for Microsoft 365 component, which integrates into Exchange Online, OneDrive, SharePoint Online and Teams, providing monitoring and protection for your services as well as your endpoints.

Read our full Kaspersky Endpoint Security Cloud Plus review

Best antivirus suite 2021

WINNER: Kaspersky Internet Security

Kaspersky is no stranger to our awards, and this latest version of its security suite shows why – in multiple independent tests it scored perfect 100% protection scores without a single false positive. Other notable features include browser protection, ransomware blocking, defences against webcam hijacking and even a fully featured firewall.

Do you need to pay for this type of protection? It’s true that Windows’ built-in security modules are nowadays very effective on their own. However, Kaspersky is much easier to configure, especially when it comes to customising firewall rules. It also has less of an impact on system performance, which makes the modest £15/yr subscription fee easy to swallow.

Read our full Kaspersky Internet Security review

HIGHLY COMMENDED: Avast Antivirus Free

Avast is our favourite free antivirus solution for several reasons. First, it does a great job of blocking malware: independent labs have found its protection on par with Microsoft Defender and ahead of several paid-for suites. What’s more, it’ll run on older editions of Windows – which is ideal if you still have legacy machines running Windows 7 or 8.1 that can’t be upgraded. You do have to put up with a few in-application adverts for Avast’s paid-for products, but if you can’t use Windows’ built-in protections – or just don’t want to – then Avast Antivirus Free makes a lightweight and effective alternative.

Read our full Avast Antivirus Free review

Sophos offers an impressive portfolio of security services and, as an early adopter of cloud management, it's ensured everything can be accessed from its Central administrative portal. Along with the Intercept X Advanced workstation and server endpoint protection on review, you can use Central to look after Sophos' Mobile threat defense package along with its XGS firewalls, Wi-Fi 6/6E access points, 100 and 200 series network switches, and zero trust network access service.

That's a lot to pack into one management portal, but Sophos has done a fine job of keeping it simple. The main dashboard provides an overview of your company's security posture, and all endpoint protection services are neatly separated into three sidebar menu categories for workstations, servers, and mobiles.

Along with essential malware and threat protection services, Intercept X Advanced supports multiple security policies plus application and device controls. It employs AI-based deep learning to defend against unknown malware, blocks ransomware attacks using behavioral analysis and enables a threat analysis center.

An XDR (extended detection and response) license allows you to create your own custom threat cases. This provides deeper malware analysis and threat intelligence, on-demand endpoint isolation, and suspicious event detection and prioritization to identify targeted attacks.

Sophos Intercept X Advanced: Setup

Deployment is swift. You place the Windows and macOS installers in a central distribution point or create users in the portal and email a link to them. A different agent is used for Windows servers but, in both cases, they only take ten minutes to install, connect to your portal account and retrieve a base security policy.

The base threat protection policy has all recommended security settings enabled and is always applied to users and devices if no other policy has been assigned. Other policies are provided for web, application, Windows firewall and device controls, and data loss prevention, although these are deactivated and require configuration and assignment. Policies present an extensive range of security measures and include CryptoGuard ransomware protection.

When any file is opened for writing, it places a temporary clean copy in a proprietary cache on the local drive and, if it detects malicious encryption activity, it will automatically roll back the file to its original state.

Custom policies are easily created by cloning the preconfigured ones and tweaking their settings to suit. These can be assigned to device groups, and if you import users via the free Active Directory (AD) sync tool or Azure sync service, you can apply policies to users so they're always protected no matter what device they have signed in to.

Sophos cuts through alert smokescreens as only unresolved events that need your attention to appear in the Central dashboard and cause email notifications to be issued. We used our malware collection to create a virus outbreak condition on one PC which was highlighted immediately, whereas other events such as successful malware removals and website blocks were only posted in the logs and reports section.

The portal's threat analysis center provides a basic dashboard showing the most recent threats. Selecting one provides a full analysis of events and a one-click option to clean up all associated files and Registry entries and block them so other devices can't run it. Sophos has also added a new XDR threat analysis center dashboard that provides smarter widget-based graphical views of malware detection.

Sophos Intercept X Advanced delivers a huge range of endpoint protection measures for the price. It's simple to deploy, device and user policies add flexibility and seamless integration with the Central cloud portal makes management simple.

This content originally appeared on ITPro's sibling magazine PC Pro. For more information and to subscribe, please visit PC Pro's subscription site. 

Provided by

Join Benedetto Conversano, Diageo and ex-IKEA CIO, as he shares exclusive insight into how your IT security team can fight ransomware.

In this webinar you will discover eight practical and actionable steps to fight ransomware, including:

• Why you should focus on impact rather than threats

• How to create and test a ransomware policy

• Developing a common cyber security language

Provided by

Along with the education sector, retail was the biggest industry affected by ransomware during 2020. As some retailers began trading online for the first time during the pandemic, and others saw an increase in their web traffic and online purchases, cyber criminals took advantage of the opportunities presented to them.

Managing this increase in security challenges, with many retailers still using legacy security systems, meant IT team’s cybersecurity workload increased by over 70%; also increasing their security knowledge and skills in the meantime.

Download this report and discover insights into the prevalence of ransomware within the retail sector, the associated costs and how retailers can be ready to face future threats.

.

This short-depth rack appliance is designed to keep up with busy networks. Along with a feast of copper and fibre network ports, Sophos’ XG 230 Rev.2 claims a mighty 32Gbits/sec raw firewall throughput – even with all of the security services enabled, it still pumps traffic through at a speedy 4.5Gbits/sec.

There’s room to grow further too, thanks to an internal expansion bay that supports eight different Flexi modules, with options ranging from PoE provision up to 10GbE and 40GbE connections. For redundancy, the appliance can accept an optional second power supply and a pair of network bypass ports to keep the traffic flowing even if UTM functions are temporarily disabled for any reason.

The price above is based on a three-year Sophos TotalProtect Plus subscription, a comprehensive SMB package that enables all network, web, email and web server protection services, along with Sandstorm cloud sandbox and FullGuard Plus support. The appliance also links up with the Sophos Central service, which extends protection to external endpoints and adds cloud management capabilities.

Clearly there are plenty of features to get to grips with, but the XG 230’s web console gets you off to a flying start with an installation wizard that secures admin access, configures the network ports, runs a firmware upgrade and applies a base security policy. Once your basic setup is in place, the console’s Control Center dashboard is equally impressive, providing a clear overview of network activity and security issues, with graphs showing web traffic and detected network attacks, as well as details of blocked and allowed applications and web categories.

Setting up remote management is easy as you can connect the appliance to your Sophos Central cloud account directly from the web console. Once authenticated, the cloud portal provides the same console as the local one, with live report dashboards and full access to all management features.

It’s very pleasing to see that any external devices running the Sophos Central endpoint agent appear automatically in the console, with no need for manual enrolment. Sophos’ Synchronized Security platform uses a “heartbeat” service to keep all supported products on the same page, with the synchronised application control feature automatically finding any unknown applications on remote endpoints and pushing out firewall policies to control them.

The appliance’s numerous ports can be grouped into various zones, providing a straightforward way to apply different security policies across groups of users and devices. If a device is reported as compromised, a setting in the firewall policy can immediately isolate all systems in the same zone.

Aside from that, you can set up firewall rules for sources and destinations, service filters, blocking actions and time schedules, and apply custom policies for web filtering, intrusion detection, email and application controls.

Those web-filtering options extend to 90 categories of URL that can be individually blocked or allowed, while the application controls currently support a whopping 3,530 predefined policies – including 73 just for Facebook activities. The Sandstorm feature intercepts any unknown files and sends them to a cloud sandbox, only allowing them to run locally if they’re deemed to be safe.

Although the appliance has no built-in Wi-Fi capabilities, it can function as a central controller for Sophos wireless APs, and it also supports Sophos’ SD-RED (Remote Ethernet Device) appliances, which let you easily extend your security policies to external offices. Just register your SD-RED box with the appliance, then ship it to a remote site and it will automatically set up an encrypted connection and start protecting traffic.

Overall, the Sophos XG230 Rev.2 is a powerful and flexible security appliance that’s well suited to SMBs. It’s packed with security measures while being easy to deploy, and Sophos Central integration provides great remote management and security for external users.

Sophos XG 230 Rev.2 specifications

Sophos was one of the first security specialists to embrace cloud-managed endpoint protection, and over the years its Central solution has evolved into something impressively sophisticated. The cloud portal works with more or less every security component Sophos has to offer, providing one-stop management for all workstations, servers and mobile devices.

It opens with a handy dashboard view showing the most recent alerts, a summary of devices and users, plus details of how your access controls are performing. A menu at the side provides swift access to individual protection components, and if you have a Sophos firewall it can also be managed from here.

The deployment process is clever too. You can download the agent from the portal and install it the old-fashioned way, which takes about ten minutes – but if your users are set up on Active Directory, you can use the Sophos AD Sync tool to import users and groups into the portal, then email installation links to everyone with just a few clicks. Active Directory integration then allows you to create security policies that follow users around, regardless of which device they’re logged into.

Protection starts as soon as the agent is installed, with a base security policy applied to everything. Real-time scanning and automatic cleanup are enabled (with live protection ensuring that the agent has the latest threat information from Sophos’ labs), and all internet traffic and downloads are monitored.

Web controls can be applied to selected users too. Four predefined URL-filtering policies are supplied, but it’s easy to tweak these or create new policies of your own. These can include web restrictions, blocking adverts and risky downloads and blacklisting specific URLs, IP address ranges and site categories.

Application usage is controlled in much the same way. Sophos provides a list of over 1,000 apps to choose from, in categories ranging from browser plugins and email clients to encryption tools and FTP clients. You can completely block access to particular applications or merely monitor and log their use.

Another noteworthy feature of the software is its data-loss prevention option, which prevents users from transferring files containing sensitive data, such as bank account details or personally identifiable information. We tested this by trying to email a spreadsheet containing personal email addresses outside of the organisation and found that the Sophos agent wouldn’t even let us attach the file.

The one area where Sophos proved a little erratic was alerting. During our tests we found that warnings about web-policy violations could take up to 50 minutes to appear in the portal dashboard and reports. The most important messages get through quickly, though: when we dropped our malware samples onto our test workstations, high-priority alerts appeared in the portal in one minute flat, with email warnings flying in shortly afterwards.

It’s also worth highlighting that the standard licence only covers workstations. If you want server protection, that’s an optional extra, starting at £69 per server per year. This works in just the same way as the desktop version, with the agent detecting the OS when it installs and configuring itself as needed.

Mobile coverage is another optional extra, but one that’s well worth considering, as the device management controls are stunningly good. Once we’d set up an APN, we were able to control virtually every feature and app on our iPads with remote locate, lock and wipe services all available.

No doubt about it, Sophos Central Endpoint Protection isn’t the cheapest option, especially if you’re looking to protect your entire hardware stack. Even so, its excellent protection features, user-centric policies and well-designed cloud portal make it a very appealing solution.

SMEs that want centralized network protection need look no further than Sophos' XG 125w as this gateway appliance is packed to the rafters with security features. It's no performance lightweight either, claiming a high raw firewall throughput of 6.5Gbits/sec and 1.5Gbits/sec with all UTM functions enabled.

The XG 125w offers eight copper Gigabit and an SFP fibre Gigabit port, while its expansion bay accepts optional DSL, 3G/4G or Gigabit SFP modules. It also provides 2.4GHz/5GHz 11ac wireless services with support for multiple virtual SSIDs and hotspot guest access facilities.

Installation is a doddle; the web browser quick start wizard guided us through securing administrative access, setting up the LAN and WAN ports plus a secure wireless network and adding an email address for alerting. We opted for the default routed mode of operation as we wanted the appliance to provide all security functions including firewalling.

The base appliance has firewall, VPN, authentication and secure wireless management services enabled with a perpetual license. The price we've shown includes a 3-year TotalProtect subscription which actives the network, web, email and web server protection modules while a TotalProtect Plus subscription adds Sophos' Sandstorm feature which uses cloud sandbox technology to mitigate zero-day threats.

The wizard creates a base set of security policies to enable anti-malware scanning and web filtering for common sets of undesirable categories. The intuitive console makes it easy to customise security, where we could group ports into zones, apply firewall rules to sources and destinations and add service filters, blocking actions and time schedules.

From the Protect section of the console, you can create security policies for web filtering, IDP, email and application controls. Web filtering offers over 100 URL categories while the application controls provide 3,200 predefined apps, and policies are swiftly applied by selecting them in your firewall rules.

Sophos' identity-based security opens up many extra security features. With this in action, we could apply Internet access and bandwidth usage policies, enforce data transfer limitations on uploads and downloads and have different daily, weekly, monthly and yearly limits for individual users and groups.

It's easy to implement; users authenticate to an external directory server or log in to the appliance using the free Sophos Client Authentication Agent (CAA). This can be downloaded directly from the appliance's captive web portal, which also has links for Linux and macOS clients plus certificates for Android and iOS mobiles.

We already use the Sophos Central cloud security service and loved the appliance's Security Heartbeat feature. All we needed to do was enter our Sophos Central credentials in the appliance's console and after registration, all our endpoint activity data was sent to the appliance, which displayed coloured status icons in the console's dashboard.

Minimum heartbeat conditions can be linked to firewall policies so if any remote endpoint detects a threat, the policy can immediately isolate all users and devices in the same zone. You can also use the SAC (synchronized application control) feature which detects unknown apps on Sophos Central endpoints and tames them with firewall policies.

The appliance's iView syslog server provides a wealth of free reporting facilities from the same console. With data logging enabled in our firewall policies, we could view graphs and charts on firewall, virus, spam, web content filtering and user activity, plus pull up a range of data protection compliance reports.

Along with a pleasantly swift deployment, the XG 125w impressed us with its depth of security features. Adding in its seamless integration with Sophos Central, the high performance and integral 11ac wireless services makes it our recommended gateway security appliance for SMEs.

Verdict

Along with a pleasantly swift deployment, the Sophos XG 125w impressed us with its depth of security features. Adding in its seamless integration with Sophos Central, the high performance and integral 11ac wireless services makes it our recommended gateway security appliance for SMEs.

Desktop chassis

1.6GHz Intel Atom C3508

4GB RAM

64GB SATA SSD

8 x Copper Gigabit, 1 x SFP Gigabit

2.4GHz/5GHz 802.11ac wireless

3 x 3 MIMO

3 x external aerials

HDMI

2 x USB 2

Micro USB

RJ-45 serial

Expansion slot

External PSU (max 2)

320 x 212 x 44mm (WDH)

3 year hardware warranty

Just 41 per cent of local government employees think their systems would suitably secure their organisation against cyber threats, while 50 per cent have no idea whether their systems are prepared or not.

That's the worrying picture painted by a SophOS study, which surveyed just shy of 3,000 local government and police workers about their attitudes towards cyber threats and security.

The results revealed that although the possibility and variety of attacks have increased, budget cuts mean they are not particularly well protected against threats.

Although the biggest cuts have been to workforce numbers, with just over two-thirds (67 per cent) claiming job losses provided the biggest savings, frontline services came in slightly behind with 63 per cent saying their department had been affected by the reduction of such services.

Some 62 per cent of respondents said they were planning on making cuts to IT services or merging IT with other departments or local governments on IT resources to save money and this will have a knock-on impact on security.

However, almost half of the people questioned said they had increased awareness of data security after they had learned about high profile attacks happening to other governments and upcoming EU legislation.

Data loss is the public sector workers' main security concern, while remote access and targeted attacks were secondary worries.

"With cyber crime at an all-time high and public sector budgets reducing year-on-year, it's more important than ever that organisations maximise the resources available to them," James Vyvyan, regional vice president of Sophos UK and Ireland, said.

"There is a clear trend towards local authorities partnering with neighbouring authorities to increase and implement shared services. This collaborative approach is certainly helpful in the fight against cyber crime. Our research indicates that local authorities and police may also be missing the opportunity to consolidate their IT and security technologies, which can deliver further savings, helping to protect jobs and frontline services. "

Security reseller Foursys has taken on three new vendors as it plans to grow its business over the next year.

It has signed up Secunia, which provides vulnerability management through application and operating system patching, two-factor authentication provider SecurEnvoy, and Rapid7, which offers security data and analytics software and services.

The three new vendors join Foursys’ existing vendors Sophos, Clearswift, Websense and Forescout.

James Miller, Foursys managing director, says the additional technology vendors were selected based on their technical merits.

“We always select new technology partners that have a specific channel focus, that can partner with us to provide a strong, complementary fit with our existing security portfolio and who can ultimately add value for our current clients,” he says.

Adam Bruce, Northern Europe channel manager at SecurEnvoy describes Foursys as “a good fit”, pointing to the VAR’s close relationship with Sophos, “as our technology integrates closely with both the Sophos Safeguard and UTM products.

For Secunia, the deal extends the vendor’s footprint in the UK and Ireland: “We are delighted to be working with Foursys as a technically advanced and customer-centric security VAR, and we look forward to adding new value to their existing client service offerings,” comments Victoria Bentham, Secunia’s UK regional director.

“We are delighted to partner with Foursys,” adds Rob Attree, EMEA sales director for Rapid7. “The company has a proven record of bringing impactful security solutions to market to help their customers implement effective security programmes.”

A year after its directors completed a management buy-out of the company, Foursys has moved its headquarters from Cambridge to new premises in Bury St Edmunds, offering a threefold increase in office space.

The 15 new jobs at the firm are being created to cover a range of roles in security consulting, support, sales and administration.

Endpoint security has traditionally been a tough nut to crack across businesses of all sizes as many solutions have a reputation for being difficult to deploy, a nightmare to manage and inconveniently expensive. These problems are exacerbated by the exponential growth of corporate mobile devices making it nigh on impossible to protect them all.

Worry not as the cloud is coming to the rescue of businesses frightened off by these concerns and Sophos Cloud is one of best solutions we've yet seen. Along with cloud managed anti-malware, web filtering and removable device controls, it offers tough security measures for iOS and Android devices.

It's also a top choice if you want your security policies to apply to users as well as devices. In our books, this makes Sophos Cloud highly versatile as we used it to create security policies that followed users regardless of which device they logged in from.

The Sophos Cloud portal provides plenty of information about endpoint security events and alerts.

Slick cloud portal

After signing up we were provided with our own dedicated cloud portal which gave us access to every feature. Its dashboard comprises three big panels with clear overviews of all alerts, activities and web stats.

The next tab provides views of your users, groups and devices plus options to enable iOS support. It's here that you also create security policies and monitor Active Directory users and groups.

The new server protection feature applies custom policies to these systems. They are more basic than standard policies but provide a range of tough measures including real-time and scheduled malware scanning, automatic blocking of known malicious web sites and Sophos' HIPS (host intrusion prevention system) which watches out for suspicious program behaviour.

Web filtering works well and, if permitted, users can play with the Sophos client software

Lengthy deployment

For testing we used the main lab network headed up by a Windows Server 2012 R2 Active Directory domain controller running the Hyper-V role and hosting an Exchange 2013 VM. For desktops we used a bunch of Windows 7, 8 and 8.1 hosts while for mobile testing we used an iPad 4.

Software deployment to our Windows systems was lengthy as the installer utility downloads the entire 156MB agent package for each one. A single install took up to 15 minutes whereas simultaneous installs on four devices took a total of 25 minutes.

It speeded up after this, though, as the agent was preconfigured for our account and each system appeared in the portal in seconds. Sophos also adds details of the current user logged in when the agent was installed and we used the new AD Sync tool to import users from our AD server.

We had problems with AD Sync's secure LDAP mode as it refused to access our server. Online help is minimal but we fixed it by selecting non-secure LDAP mode and changing the port number.

After importing our AD users we could assign custom security policies to each one

Policies and performance

Despite the focus on user-based protection, static devices such as desktops aren't left out in cold as a base security policy is applied to everything. The real-time malware scanner is enabled by default, access to removable media can be restricted or monitored and anti-tamper controls are active.

For web filtering, we could tweak the base policy or create new ones and choose from a wide range of settings. These include blocking dodgy file downloads, using one of four predefined URL filtering policies or setting our own web usage restrictions.

Alert responses are fast as after introducing real malware to our clients, the Action Center pane changed to red alert status in only 25 seconds. This was the same amount of time it took to push out a global USB storage device block policy.

A remote quick scan request to a Windows Server 2012 R2 system was fired up in less than 20 seconds and completed in 5 minutes while a locally run full scan of its 72GB system drive took 47 minutes. Sophos is a safe pair of hands as well with it scoring 96% for AV-Test's zero-day detection and returning a clean sheet in the widespread malware test.

Sophos offers extensive mobile device security features and includes options for iOS remote locks and wipes

BYOD beware

For mobile devices controls, iOS gets the lion's share. Along with passcode and complexity enforcement, we could control access to features such as the App Store, camera, screenshots and iCloud backup.

We also used policies to control which wireless networks mobile users could connect to and request alerts if their OS versions weren't up to date. Web filtering rules are on the cards and policies can be used to set company Exchange Server credentials.

Deployment to our iPad 4 required an Apple Push Certificate created and a download link for iOS emailed to the mobile user via the cloud portal. Once the Sophos Mobile Control app connected, it enforced our passcode policy, controlled access to apps by removing the icons for blocked ones and allowed us to issue remote lock and wipe commands from the portal.

Conclusion

Sophos Cloud is more expensive than products such as Trend Micro's Worry-Free cloud service but it beats everyone soundly for features. Its lightning quick portal, user based policies and top-notch mobile device support earns it a well-deserved Editor's Choice award.

Verdict

Combine the well-designed web portal, user based policies and top-notch mobile support and you have a quality cloud endpoint security solution. Sophos Cloud isn’t the cheapest but we think it’s well worth the extra outlay.

Agent: Windows XP Pro and Server 2003 upwards, Mac OS X 10.7 upwards. Mobile: iOS 7, Google Android 4.0 upwards

Security vendor Sophos published details of a 'trustworthy browser poll' last week, with a headline proclaiming Firefox "slams Chrome again" in the results.

Indeed it did, with 48 per cent of the 3,400 participants trusting it most. This compared with 27 per cent for Chrome, eight per cent for Safari, 7.4 per cent for Internet Explorer and just five per cent for Opera.

The remaining 4.6 per cent trusted browser clients such as Tor, Comodo Ice, Chromium and even Lynx, for those of you with a really long memory that stretches back as far as the text-only world wide web.

This last percentage group of stragglers also included the client we should all trust the most: none.

My advice would be the level of trust we place in any given browser client is irrelevant at best and dangerous at worst. To trust a web browser client is, frankly, security suicide.

What the poll was really harvesting is data on the browser client the participants mistrusted the least. It's a subtle difference, you may think, but it's an important one. No web browser client can be trusted, and all should be viewed with more than just a degree of caution.

Interestingly, the Facebook group where the poll appeared seems to share this view, if the comments there (and the accompanying post on the Sophos blog) are anything to go by.

User mistrust was refreshingly high, with some informed folk insisting they regularly use VMs for security when browsing. Others, however, admitted they didn't trust their browser yet seemed resigned to sacrificing their concerns at the alter of usability.

Within the enterprise, admin will know all too well about the best methods of using a browser within a security-centric ecosystem to minimise the risk of compromise.

What interests me most about this poll is that Sophos is primarily known as a vendor of security protection to the business sector, so the users who responded are (one imagines) business users.

The talk of trust is one that scares me, and the security to convenience ratio should scare you as well. If, like so many organisations today, your employees work at home or outside of the office, you need to be asking the question: do you trust them to be doubtful about the clients they use to access corporate data?

I think you know what the answer is, and that should prompt you to be ensuring that your BYOD and remote working security policy and risk mitigation infrastructure are up to scratch. Trust me on this one...

Security vendor Sophos has revealed plans to improve its delivery processes to make life easier for partners, especially those providing services to small businesses.

Speaking to Channel Pro, Sophos’ channel director, James Vyvyan, says the vendor’s focus is on “designing our solutions so that they are easy for partners to deliver and manage.”

He says: “For example, two of our UK partners are on the beta programme for our upcoming UTM product [Sophos acquired UTM vendor Astaro in July 2011], which means they are directly plugged into the people designing and making our products and can feedback from a partner perspective. This is important because if partners can deliver services in a cost-efficient way they will obviously make more money.”

With the exception of “three or four” accounts worldwide, the vendor pushes all its products through the channel, including £40m worth of business through its UK partners.

Half of this figure is generated by Sophos’ top 15 partners, says Vyvyan (pictured), who adds this same group – which includes firms such as Softcat, Trustmarque, Phoenix IT, Insight, TSG and SCC – has tripled their Sophos business over the past three years. He cites Softcat as an example, which did £2m of Sophos business in FY11, and finished on £3.3m in FY12.

The firm is currently identifying “the right type of partner” to join this top strategic tier. Vyvyan says this could be a VAR or managed service provider, dependent on the firm’s skills and reach. “Our focus is on a few partners and getting it really right with them. I would love to add two or three partners to that but only if they add value and quality,” he explains.

Sophos splits its channel organisation into ‘Solution Partner’, for volume sales, and ‘Strategic’, its VAR business. Vyvyan reveals the vendor is bulking up both with additional channel support. As well as the recent addition of two internal account managers to its Solution Partner channel, the vendor is looking to recruit a third, as well as a new field-based channel account manager to help develop its strategic channel.

“In order to meet global sales expectations we need to use the channel more, [but] in the UK we’re a long way down the road in comparison to the rest of the world,” claims Vyvyan.

The channel exec also hinted at further changes to be announced within the Sophos partner programme during the coming months.

Sophos is set to boost it’s network security credentials with the acquisition of Indian network security vendor Cyberoam.

The deal will add Cyberoam’s unified threat management (UTM), next-generation firewall and network security expertise to Sophos’ existing portfolio of products.

According to Kris Hagerman, CEO at Sophos, Cyberoam’s ‘channel first’ strategy and its pedigree in service and support was a key element for the acquisition: “The acquisition expands and accelerates our network security roadmap to grow our presence in UTM, advanced threat protection, wireless and next generation firewall,” he says.

In terms of integration, Sophos says it will be business as usual with no changes expected for either company’s UTM roadmap this year.

Hemal Patel, CEO of Cyberoam states that together, Cyberoam and Sophos form a powerhouse in network security. “Our global footprint, commitment to the channel and complete security portfolio are clear competitive differentiators.”

British firm Sophos had previously acquired UTM specialist Astaro in 2011.

There has been no word on the cost of the deal.

The group responsible for carrying out an attack on Tumblr, which resulted in abusive messages being posted on thousands of users' blogs, claim they warned the site an attack could happen weeks ago.

The blogging site was hit by a spamming group called GNAA yesterday who used the platform to post a 200-word anti-Tumblr rant on thousands of the firm's blogs.

"This is in response to the seemingly pandemic growth and worldwide propagation of the most F******G WORTHLESS, CONTRIVED, BOURGEOISIE, SELF-CONGRATULATING AND DECADENT B******T THE INTERNET EVER HAD THE MISFORTUNE OF FACILITATING," the post stated.

We contacted Tumblr two weeks ago...but they never got back to us.

In an interview with news site Gawker, a person reporting to be a GNAA spokesperson, said the group warned Tumblr an attack could take place weeks ago.

"Someone would have done a lot worse than just posting a message over and over if they didn't fix it right away," said the spokesperson.

"We contacted Tumblr about it about two weeks ago. We used the 'can't find what you're looking for' link at the bottom of the email troubleshooting page. They never got back to us."

The site is used to publish more than 70 million posts a day and reportedly hosts nearly 71 million blogs.

In a blog post, a Tumblr spokesperson said the firm had moved quickly to resolve the issue.

"We quickly identified the source, removed the posts, and restored service to normal," the post stated.

"No accounts have been compromised, and you don't need to take any further action."

In a further post on the Naked Security blog, Graham Cluley, senior technology consultant at security software vendor Sophos, was able to shed some light on how the attack was carried out.

"The worm took advantage of Tumblr's reblogging feature, meaning that anyone who was logged into Tumblr would automatically reblog the infectious post if they visited one of the offending pages," wrote Cluley.

"Each affected post had some malicious code embedded inside them...If your computer was logged into Tumblr, it would result in the GNAA content being reblogged on your own Tumblr," he added.

The cloud lends itself perfectly to offsite disaster recovery with and businesses have an enormous choice of hosted backup services.

DataFort's Hi-5 (www.datafort.com) differs from the majority as it's designed to provide on-site and off-site protection. In the event of a total disaster a business will be able to reinstate your critical systems and services either on-premises or in the cloud.

It also uses a pricing structure based only on the number of systems to be protected and not on the amount of data being stored offsite. This is preferable to capacity based solutions as all costs are up front and will only increase if you add more systems to the scheme.

Hi-5 is DataFort's premium disaster recovery service and is designed for businesses that can't tolerate more than two hours of total downtime. Costs start at 500 per server per month and this includes cloud disaster recovery invocation. If access to your premises is denied, DataFort will invoke VMs of your critical systems at its remote site and make them available to your users over the Internet.

Hi-5 deployment

To test Hi-5, we arranged for an engineer to come down to our lab at an agreed time and deploy the hardware. We were supplied with an HP ProLiant DL160 G6 1U rack server configured to take image based backups of our chosen systems every fifteen minutes. You don't touch the appliance as this is deployed headless and managed remotely by DataFort.

For our test systems we used a Windows Server 2008 R2 system running Hyper-V. Within this we had one VM running Server 2008 R2 as a PDC providing file and print services and another running Microsoft Exchange Server 2010.

The DataFort engineer set the local Hi-5 appliance to protect both systems. Initially, full image backups are taken and then updated regularly using snapshots. For cloud recovery, all data is replicated to DataFort's remote vaults and to speed things up the engineer can take an encrypted copy of the data back to HQ to seed the vault.

DataFort protects physical and virtual Windows servers and for testing we used two Hyper-V VMs

Data restoration testing

Disasters don't run to a schedule so to test Hi-5 we left it running for a while and invoked the various recovery services without warning. Initially, we used the tests systems for over a month and ran various file copies to them, edited documents stored locally and send and received emails using OWA during this period.

For our first test we deleted a 1GB folder on the PDC that contained 5,000 files. We called the standard DataFort support number which was answered after a couple of rings. File and folder recovery procedures are very straightforward as we advised DataFort that we wanted this specific folder restored from the latest backup.

The technician remotely accessed our local appliance and copied the folder back to its original location on the PDC. The process was very swift as the time from initial phone call to folder restoration was less than seven minutes. File versioning is also supported so if you want to go back in time you advise the technician what dates you're interested in.

Part of our Exchange recovery test involved deleting an entire user's mailbox which included 6,000 messages

Exchange granular recovery tests

Exchange server protection costs extra but provides full granular recovery so you can restore entire datastores, mailboxes and individual emails. Prices are very reasonable with DataFort charging 75 per Exchange datastore per month for this service.

To test this we engaged in some Exchange related mayhem. For one user we deleted a thread containing four emails from the previous month and from the Exchange admin console, we deleted another user's entire mailbox which contained nearly 6,000 messages.

We called DataFort support, asked for these all to be restored, grabbed a coffee and chilled out while they got on with it. Forty minutes later DataFort called us to say everything was back in place. A quick check confirmed that the four emails were back and the deleted user, their mailbox and all 6,000 emails had also been restored.

After invoking the Hi-5 cloud recovery, we could access our Exchange mailboxes using OWA and continue working as normal

Invoking the cloud

To simulate a complete disaster with access denied to premises, we pulled the plug on both the test server and local appliance and asked for cloud recovery to be invoked. DataFort called us back in 26 minutes to say that all our services were ready and waiting.

Sure enough, we could RDP to the remote PDC and Exchange servers and drive mappings remained in place. Using OWA we could remotely access all our Exchange user accounts and send and receive email - as far as our users were concerned this was the real thing.

Once the on-premises systems are restored, they are brought up to date using the remote backups. For those that have a secondary contingency site, DataFort also offers an optional service where it can deliver servers loaded with the latest images within one business day of the disaster.

Conclusion

During testing we found Hi-5 worked very well and delivered on DataFort's promises. Backup processes require no user intervention, data and systems recovery is equally non-stressful and it is comparatively good value. We can also vouch for DataFort's efficacy as we've been using its personal cloud backup service since 2004 and it's always been there whenever we've needed it.

Verdict

DataFort’s Hi-5 takes the strain out of backup and disaster recovery as it’s very simple to deploy, incurs no management overheads and is virtually transparent. It’s extremely good value as the price for each protected system includes unlimited storage capacity and our tests show it delivers when it’s needed most.

OS: Windows Server 2000 upwards (physical and virtual machine)

Options: Exchange granular recovery, £75 per datastore per month

PC users are being duped by a new type of malware that uses a fake Apple iTunes credit card charge to steal money from their bank accounts.

Security vendor Sophos is warning people to be on their guard against the scam, which typically starts with computer users receiving a malicious email informing them of a $699.99 Apple iTunes credit card charge.

"At first glance, recipients may find the malicious emails quite realistic as they use Apple's logos and formatting to appear like a genuine emailed receipt from the company," said Sophos in a statement.

Users' computers can be infected by malware that logs keystrokes and compromise bank accounts.

When users click on one of the links contained in the email, they are taken to a web page purporting to belong to the IRS, which houses a Blackhole malware kit.

This is typically used to exploit vulnerabilities in Java, Adobe Reader and Adobe Flash Player, Sophos warns, which can lead to systems getting infected by a Zeus/Zbot Trojan.

However, if none of the exploits work, users are instructed to download a more recent version of their web browser, which contains a copy of the Zeus banking Trojan.

"The end result is that users' Windows computers are infected by malware that can log keystrokes and compromise bank accounts," said Sophos.

Graham Cluley, senior technology consultant at Sophos, said users should always treat links in unsolicited emails with caution.

"Instead, users should go to the website of the company in question, or call the number on the back of your card or billing statement to find out the truth," he advised.

"This is especially important at this time of year, as we typically see increased criminal activity during the Christmas season," he added.

Social networking site Twitter has been commended for admitting it reset more user passwords than it intended to during a recent security blitz.

The company came clean about the gaffe in a blog post yesterday. In it, the firm explained that it regularly resets the passwords of accounts that appear to have been compromised.

"We reset the password and send an email letting the account owner know this has happened along with information about creating a new password," said the post.

"This is a routine part of our processes to protect our users."

The company then went on to confess that it reset more passwords than it needed to during a recent security clampdown.

"We unintentionally reset passwords of a larger number of accounts, beyond those that we believed to have been compromised [and] we apologise for any inconvenience or confusion this may have caused," the post concluded.

Speaking to IT Pro, Graham Cluley, senior technology consultant at security software vendor Sophos, said Twitter was right to admit its mistake, adding that it was unlikely to have caused users many problems.

"People end up trusting a company more when they admit they made a boo-boo than if they tried to initiate a cover-up," he said.

"It's inconvenient for those affected...and people who hadn't had their accounts compromised might panic they had been hacked, and waste time trying to determine if anything bad had happened."

Mozilla has rushed out a new version of its Firefox web browser following the discovery of a security hole that could have let hackers keep tabs on the websites users' visited.

The flaw was uncovered in the 16.0 release of the open source vendor's Firefox software earlier this week, resulting in the product being withdrawn from the company's installer page.

In a blog post, confirming the vulnerability, Michael Coates, Mozilla's director of security assurance, advised users to downgrade to the 15.01 version of Firefox until a patch was created.

"The vulnerability could allow a malicious site to potentially determine which websites users have visited and have access to the URL," wrote Coates.

"At this time, we have no indication that this vulnerability is currently being exploited in the wild."

The company released a Firefox software update for Windows, Mac, Linux and Android users yesterday.

Paul Ducklin, head of technology for Asia Pacific at anti-virus vendor Sophos, said in a further blog post that end users should not be put off from downloading the latest software.

"This latest issue reminds us that it's occasionally problematic to be too far ahead of the curve, [but] it's always risky to be behind," he added.

Skype users are being targeted by a worm that downloads malware to their PCs, and may even demand money to regain use of their machines.

The malware Trojan allows hackers to take control of infected computers and use them as part of botnets, but security researchers have warned that the Trojan can also download "ransomware" to infected PCs.

Affected users risk being locked out of their computers, and forced to hand over money in order to regain access to their data.

The Skype worm spreads by convincing users to click on messages with a link to the malware. The link usually refers to a user's new profile picture, with text such as "lol is this your new profile pic?".

According to security researchers at security vendor Sophos, the link then downloads a zip file, which contains a Trojan. The Trojan allows hackers to control the infected PC remotely over HTTP. The malware, according to Sophos' Graham Cluley, is a version of the Dorkbot worm.

The worm has been spreading for some time via other social networks including Twitter and Facebook, and could also spread via USB sticks, Cluley warned. But Skype users might be less wary of clicking on links than users of services such as Facebook, he suggested.

"We are aware of this malicious activity and are working quickly to mitigate its impact," the company said in a statement. "We strongly recommend upgrading to the newest Skype version and applying updated security features on your computer. Additionally, following links - even when from your contacts - that look strange or are unexpected is not advisable." Skype has also issued more detailed security advice to its users.

So far, only Windows PC users appear to have been targeted by the attack.

IT security specialist Foursys has grabbed the title of first Platinum Solution Partner under Sophos’ recently overhauled channel partner programme.

Sophos unveiled its new programme in July, which was re-designed to accommodate different business models, with partners selecting the partnership track that best suits them – reseller or solution provider.

Cambridge-based Foursys had been a Sophos Platinum Partner before the re-launch. Explaining the new status, the firm’s marketing manager, Andy Wool explains: “The ‘solution provider’ track allows us to offer additional services and a strategic Sophos focus to ensure our customers continue to receive the best service possible.”

“Platinum solution status is the highest level of Sophos technical accreditation and sales education,” comments Jonathan Bartholomew, channel sales manager for Sophos UK&I, who maintains the partner programme is designed to create and maintain long-term relationships.

“Becoming accredited as a Platinum solution partner allows partners to provide customers with additional services,” he says. “…Plus, as Sophos continues to invest in and acquire new technologies, there are clear opportunities to revisit customer.”

The new programme also incorporates parts of acquisition Astaro’s channel programme – and Foursys had to restructure its training accordingly. According to Wool, the VAR invests in a “comprehensive internal training programme for both sales and technical staff [involving] full day intensive sessions with our technical director and our other Sophos sales engineers who help carry out the training and role play in sales meeting environments and technical support telephone enquiries.”

Security vendor Sophos has expressed concern over the number of London Wi-Fi hotspots that use the obsolete Wired Equivalent Privacy (WEP) encryption method.

James Lyne, director of technology strategy at Sophos, recently embarked on a cycling tour of London on a bike kitted out with a wireless network detection system.

Using GPS technology, Lyne was also able to create a "heat" map, depicting levels of wireless network security around central London.

His experiment uncovered 106,874 wireless hotspots scattered across more than 91 miles of London. Eight per cent of these were unencrypted, while 19 per cent were secured using the outdated WEP method of encryption.

Speaking to IT Pro, Lyne said: "I don't think people connect the security of wireless with the kind of information that can be stolen and the type of attacks that are possible."

As long as it is still working, people don't bother changing it.

The remaining networks used WPA or WPA2 encryption, which Sophos has no truck with, providing users do not rely on default or easy passwords to access them.

Lyne said the widespread use of WEP could be partly down to the large numbers of legacy routers in the Capital.

"I have not seen a device for a good long time that is not, at least, capable of WPA encryption," he said.

"There is clearly a legacy [hardware issue] that needs to be handled...but, as long as it is still working, people don't bother changing it."

He also called on networking vendors to make their wireless routers easier for end users to configure, claiming some may not realise their settings are leaving them vulnerable to attack.

"Why in the wireless network configuration do they call [the encryption level] WPA2? Why don't they make the default level strong security' and, if [users] need a lower level, have a warning box pop up that...makes them aware of the risks," he suggested.

"I think there's a lot that can be done to simplify this and make these devices easier for people to set up."

Search giant Yahoo may have become the latest high-profile internet site to suffer a password leak after 453,491 of its users' login details were apparently posted online.

The username and passwords are said to belong to members of the Yahoo Voices content sharing network and were posted on the website of well-known hacking group D33Ds.

We hope that the parties responsible for managing the security of this sub-domain will take this as a wake-up call.

In an accompanying post, the hacking group said the attack should prompt Yahoo into tightening its security.

"We hope that the parties responsible for managing the security of this sub-domain will take this as a wake-up call, and not as a threat," said the group.

The breach follows on from last month's spate of password hacks, which blighted networking sites like LinkedIn, eHarmony and LastFM.

In another blog post by US security firm TrustedSec, it was claimed the information may have been obtained through an SQL injection attack.

"The most alarming part to the entire story was the fact that the passwords were stored completely unencrypted and the full 400,000+ usernames and passwords are now public," said the post.

"The passwords contained a wide variety of email addresses including those from yahoo.com, gmail.com, aol.com, and much more," it added.

At the time of writing, IT Pro was awaiting a response from Yahoo.

However, according to a report on the BBC News site, Yahoo said it was investigating the breach.

Anna Brading, a contributor to Sophos' Naked Security blog, said, even though D33Ds say they have no plans to use the data, it is accessible to anyone online.

"The only silver lining on the cloud is that the website hosting the passwords is temperamental, and people are experiencing difficulties accessing the information," said Brading.

"But maybe the access problems are being caused by so many people trying to access the stolen passwords at once? "

Google has denied Microsoft claims that its Android operating system has been compromised by malware, resulting in phones being corralled into a botnet by hackers.

Earlier in the week, Microsoft engineer Terry Zink claimed compromised Android devices were part of an international botnet used to push out spam.

In a statement released today, Google said it had found no evidence to support Zink's claims.

"Our analysis suggests that spammers are using infected computers and a fake mobile signature to try to bypass anti-spam mechanisms in the email platform they're using," said a Google spokesman.

An investigation by the search giant suggested junk emails originated on PCs but spammers formatted them to look like they were sent from Android smartphones.

It said the method was used to give the messages a better chance of defeating spam filters.

Other security researchers had backed Zink's view, before backtracking later.

"So one of two things is happening here. We either have a new PC botnet that is exploiting Yahoo's Android APIs or we have mobile phones with some sort of malware that uses the Yahoo APIs for sending spam messages," said Chester Wisniewski of security software vendor Sophos.

He added that one of the interesting data points supporting the argument that this is new Android malware is the unusually large number of originating IPs on mobile networks.

Mobile security company Lookout also cast doubt on Zink's claim. The firm's CTO and co-founder, Kevin Mahaffey, said insecure Android applications were most likely to blame.

"In order for the botnet explanation to be valid, each of the originating devices would have to be infected with mobile malware," he said.

"While this is certainly a possibility (and one that we can't refute), there is another explanation that we believe is significantly more likely," he said.

Regardless of how this spam campaign works, it was clear from initial reports that the Yahoo Mail Android app may play a key role, he added.

"After taking a detailed look at the app, we've found a number of issues that have potentially broader implications for all Android users of Yahoo Mail," he said.

Mahaffey confirmed he had been in contact with Yahoo about vulnerabilities in the app and said the search firm's mobile team was "actively working on these issues."

Software giant Microsoft has reportedly plugged a security hole in its Hotmail email service, which allowed hackers to access accounts and reset passwords.

The problem was made public by researchers at Vulnerability Labs last week in a post on its website, which contained details of how hackers have exploited the flaw.

"[It allows] attackers to reset the Hotmail/MSN password with attacker chosen values," said the post. "Remote attackers can bypass the password recovery service [and token-based protections] to setup a new password."

If successful, hackers are then able to gain unauthorised access to Hotmail and MSN accounts, it added.

It is not know how many of the 350 million Hotmail users from across the globe had been targeted by the scam. However, it has been claimed that Moroccan hackers had been planning to use the flaw to reset the accounts of up to 13 million users.

Hackers aren't interested in breaking into email accounts because they want to read your spam. They want to steal your identity.

Moreover, a report on Sophos' Naked Security blog claims videos detailing how to exploit the flaw had been circulating on YouTube for some time.

"Hackers aren't just interested in breaking into email accounts out of curiousity or because they want to read your spam," said Graham Cluley, senior technology consultant at Sophos, in the blog post.

"No, they're also interested in stealing your identity and perhaps using an email account hack as a method to crowbar their way into other online accounts under your control."

When contacted for comment, a Microsoft spokesperson told IT Pro: "Hotmail engineering teams are working hard on not only protecting accounts, but also on recover[ing] them."

They also revealed the firm has launched a new, "streamlined" recovery tool to help affected users regain access to their accounts.

The dismissive attitude of Apple users to computer viruses needs to change, as research from security vendor Sophos shows that 20 per cent of Macs carry Windows malware.

The firm explained that, while Windows malware is unlikely to cause much disruption to Mac users, it can be easily passed on to other computers.

Moreover, Sophos also discovered that approximately 1 in 36 Apple computers contain Mac OS X malware.

Mac users need to be responsible members of the internet community or they're going to continue passing on viruses

Its findings, published at Infosecurity Europe in London today, are the result of an analysis by Sophos of 100,000 Mac computers.

Sophos claimed that some of the Windows malware its research uncovered dated back to 2007 and would have been easily detected, if Apple users were not so laid back in their approach to anti-virus.

Speaking to IT Pro, Graham Cluley, senior technology consultant at Sophos, said the results, along with the discovery of the Mac-focused Flashback malware, should serve as a wake-up call for Apple users.

"For Mac users, the dream is over. They've been living in denial all this time. We've just found 600,000 users infected with Flashback. They are going to have to start running anti-virus," said Cluley.

"Mac users need to be responsible members of the internet community or they're going to continue passing on viruses to other people and contributing to the spam email problem."

He said part of the problem is that many Mac users consider their systems to be impervious to attack from viruses, making them a soft target for hackers and malware authors.

"If you're a bad guy writing malware, you wouldn't write it for computers that are constantly being updated with anti-virus signatures," said Cluley. "Why not write it for the platform where people are more laid-back about things like that?"

Hacking group Anonymous has followed up its threat to stage weekly attacks against the Government by taking the Home Office website offline.

The group used social networking sites Twitter and Tumblr to declare the launch of a Distributed Denial-Of-Service (DDoS) attack against the Home Office website on Saturday night.

In a series of tweets, published by the Anonymous Operations account, the group said the attack was in protest at the extradition of UK citizens to stand trial in the US.

According to a report on the BBC News site, the attack resulted in the site becoming inaccessible for several hours.

The Saturday night attack followed an earlier tweet by the group on 4 April, which read: "Expect a DDoS every Saturday on the UK Government sites."

Expect a DDoS every Saturday on the UK Government sites.

Graham Gluley, senior technology consultant at security vendor Sophos, said the decision to stage attacks at weekends is unlikely to have been a coincidence.

"My guess is that [a weekend attack] might make life more difficult for those responsible for maintaining the uptime of such sites," Cluley told IT Pro. "Fewer staff are likely to be at work, for instance, and it might be trickier to call in other expertise."

Moreover, he also advised the Government to be prepared for attacks from a range of sources, not just Anonymous.

"Just because Anonymous have made threats doesn't necessarily mean that anything will occur or that attacks will be successful," he explained.

"Nevertheless, departments which feel they may be in the firing line will no doubt be consulting with those who manage their site's infrastructure and internet traffic to see what they can do to assist during times of high traffic," he concluded.

Jeremy Nicholls, business development director for Europe, the Middle East and Africa (EMEA) at DDoS protection vendor Arbor Networks, said the Home Office take down should raise awareness of how susceptible all firms are to attack.

"Any business operating online can become a target, because of who they are, what they sell or who they partner with," explained Nicholls.

"Furthermore, the explosion of inexpensive and readily-accessible attack tools [allows] anyone to carry out DDoS attacks. This has profound implications for the threat landscape, risk profile, network architecture and security deployments of internet-connected organisations."

At the time of writing IT Pro was awaiting an updated response from the Home Office about Saturday night's attacks and the threat the group poses to other Government sites.

Romanian authorities have arrested a man they believe to be notorious hacker TinKode.

A 20 year old named Razvan Manole Cernaianu has been taken in by police under suspicion of attacking US Government servers, including those at the Pentagon and NASA.

TinKode's motivation has been more about mischief-making than the more malicious attacks we often see.

He has also been accused by the Romanian Directorate for Investigating Organised Crime and Terrorism (DIICOT) of selling a program designed to attack the US Government website, showing a video on his blog of websites he successfully hacked.

"In my estimation over the last few years TinKode's motivation has been more about mischief-making than the more malicious attacks we often see, fueled by a desire for publicity via his active Twitter and Facebook accounts," said senior technology consultant for Sophos, Graham Cluley, in a blog post.

"Perhaps now is a good time to remind everyone who thinks it's cool or amusing to expose an organisation's weak security that hacking into a site is still a crime, regardless of what your incentive may be."

Back in late 2010, TinKode claimed responsibility for downing the UK's Royal Navy website. He claimed to have done so with an SQL injection attack, asserting that he acquired usernames and passwords to different sections of the website, although the Royal Navy refuted the suggestion any classified information was taken.

TinKode was one of two hackers who claimed they were behind an SQL injection hit on Oracle-owned MySQL.com in early 2011.

Koobface has stopped infecting new machines, according to reports, following the public exposure of five people suspected to be behind the criminal operation.

Facebook and Sophos chose to release the names of those they believed to be running the Koobface botnet earlier this week.

Jan Droemer and Dirk Kollberg, German security researchers who wrote up an in-depth report on how they tracked the suspects, said servers running Koobface stopped responding after they released their information via a Sophos blog, according to Reuters.

Our decision to become transparent about this has had a 24-hour impact.

Koobface had stopped spreading via Facebook nine months ago but was continuing to propagate in different ways and via different social networks.

Kaspersky had estimated that Koobface had managed to infect between 400,000 and 800,000 machines in 2010. It first appeared in 2008.

The suspects left a vast trail of digital clues that led to their names appearing in reports, including Facebook pages.

They were also involved in more salacious affairs, including appearances at adult film conferences.

They also failed to lock investigators out of command and control (C&C) centre data, which eventually led to the leaking of their web pseudonyms.

Those identified have now erased social networking profiles found by the researchers.

"The thing that we are most excited about is that the botnet is down," said Facebook security official Ryan McGeehan.

"Our decision to become transparent about this has had a 24-hour impact. Only time will tell if it's permanent but it was certainly effective."

Facebook declared late on Tuesday it would continue to fight the botnet even though it had been banished from the social network.

"While we have been able to keep Koobface off Facebook, we won't declare victory against the virus until its authors are brought to justice," the company said in a blog post.

"We feel it is the interest of everyone online to work with law enforcement and the larger security community to identify the gang and see the full force of law brought to bear against those who have made millions in ill-gotten gains.

"To this end, we will be sharing our intelligence with the rest of the online security community in the coming weeks in an effort to rid the web of this virus forever."

Facebook and security researchers believe they have the names of the gang behind notorious botnet Koobface.

The social networking giant, which has been one of the main targets of the Koobface criminals, is expected to announced it will start sharing information it has on the group with the security community today, the New York Times reported.

Facebook is planning to name four men who it believes to be involved in the gang behind Koobface, a botnet that Kaspersky estimated had infected between 400,000 and 800,000 machines at its peak.

We wait to see what - if any - actions are taken to bring down the Koobface gang.

Koobface malware has primarily been spread via Facebook.

Investigators claimed the group is working in Russia and in plain sight. Despite the raft of information gathered on them, no prosecutions have been brought.

Leaving tracks uncovered

Sophos has been tracking the group, saying the crooks have made a number of mistakes, leaving digital traces across the internet. One error was not effectively locking people out of command and control (C&C) centre information.

"It turned out that the Apache web server on one of the active Command & Control servers (captchastop.com, 67.212.69.230) had the mod_status module enabled. Having enabled this web server module, any visitor is provided with public access to a live view of requests made to the web server, thereby revealing file and directory names," Sophos explained in a blog post.

"Although this mistake was noted and corrected at the end of October 2009, it was only days later when the gang made yet another mistake by installing the Webalizer statistics tool in a publicly accessible way, allowing for an even better insight into the structures of their Command & Control system."

The Webalizer statistics revealed in late 2009 that a file named "last.tar.bz2" was a full daily backup of Koobface C&C software, which were obtained by Sophos for full analysis.

This meant IP addresses relating to the gang could be obtained. More critically, Sophos was able to attain a PHP script used to submit daily revenue statistics via short text messages to five mobile phones. This meant the researchers had phone numbers to play with as well as nicknames of recipients.

The nicknames Krotreal, LeDed and PoMuC proved particularly helpful. They were used to track down profiles of potential subjects on sites including Facebook, Twitter and Flickr, as well as photos which provided yet more useful information.

Other data acquired from the C&C server indicated one of the suspects worked at a software development company called MobSoft, which was determined to be based in St Petersburg.

One of the company's contacts had a mobile number the same as one of those found in the aforementioned Koobface SMS data.

The PoMuC suspect was linked to a similar company to Mobsoft called Elitum.

Sophos also used information of suspects' family members from social networks to further their investigations.

Another lead was a picture of one of the suspects at a porn conference with his wife.

"The full evidence is in the hands of the law enforcement agencies, and we wait to see what - if any - actions are taken to bring down the Koobface gang."

Facebook had not offered any official comment on the Koobface situation at the time of publication.

Koobface initially targeted Windows PCs but moved to attacking Macs as well in late 2010.

Later that year, the botnet took a serious hit when servers hosting its C&C centre were taken down in the UK.

The main C&C centre was located on servers based at UK hosting company Coreix, which worked with police in removing criminal activity from their systems.

Facebook claimed to have effectively stopped Koobface spreading on the social network last year.

COMMENT: I was somewhat saddened to learn that security vendor Sophos had purchased a job lot of USB sticks from a lost property auction and discovered that security is still not a priority for, well, pretty much anyone it seems.

OK, first things first, let's get the fact that the lost property auction in question was in Australia and the sticks in question were lost on a public transport system. I mention this as you may argue that there's a huge difference between the average consumer approach to securing data on these thumb-drives and the average enterprise-level security strategy employed. My response is, sadly, far too many enterprise employees are carrying, and losing, such devices complete with unencrypted data for me to agree with you.

Indeed, from the largest enterprises - NHS data disasters anyone? - to the smallest of SMEs, when it comes to USB thumb drives it would appear that security is being stuck where the sun doesn't shine.

Quite apart from the small point that nobody needs to be carrying data around in their pockets on a device so vulnerable to loss or theft when much more secure alternatives to transporting data exist to do so without encrypting that device, and the data upon it, is tantamount to ITSec suicide.

Despite all of that, the Sophos study found that 100 per cent of the 50 lost USB sticks it purchased through the auction system contained unencrypted data. What's more, the researchers also found that 66 per cent contained malware.

Now, given that many employees seem quite happy to throw a bit of data onto a thumb drive to take work home with them, either in breach of existing security policies or because no such security procedures relating to the transport of data via mobile devices exists, one has to assume that malware being introduced to the corporate network via such a device is a real possibility. Yet another reason why, I would suggest, it is time to start taking USB sticks very seriously indeed.

Whenever I am asked about the subject, I always return the same three questions:

1. What data are you thinking of moving around like this?

2. What encryption methods are you thinking of using?

3. What on earth are you thinking?

The last one usually catches people by surprise, as they often haven't considered that the very same employees thinking about dumping data insecurely onto a thumb drive have a smartphone in their pocket, or a netbook in their bag, which could happily connect to a very secure VPN and grab the data from there without creating the same huge potential security hole.

Sure, USB sticks are cheap but in terms of security they are also pretty nasty. I'd rather see them included in a list of NOT ALLOWED ITEMS in an acceptable use policy document and confiscated on sight if spotted in the workplace. I admit this is unlikely to happen, so it usually ends up coming back to question number two and exploring the lack of encryption.

But it isn't just the encryption, or lack of, that's a problem. The management of these devices is also at fault. If your employees are going to use thumb drives no matter what, and sometimes it pays to be practical about such things, then much better they do so with your approval and under your control. By which I mean some kind of system which enables central management of the devices in terms of device auditing and data encryption as well as the ability to remotely wipe them clean of all data if lost or stolen.

If you are a large enterprise (other than the NHS, experience would suggest) then you probably already have something capable of doing this, and if not then you will surely have the budget to buy one in. At the smaller end of the enterprise equation, where the USB stick problem is most obvious, cost is an issue that is always thrown in my face when talking about security. Luckily, there are some reasonably low-cost solutions available which I have covered before for sister title PC Pro and are worth a look.

I'd still be happier if everyone took my stick it where the sun don't shine advice and did away with the problem of USB thumb drives altogether though...