Sophos has recently released their Endpoint Protection Best Practices to Block Ransomware report. The report discusses configuring your endpoint solution to provide optimum protection with the rising threat of cybercrime. The study reveals ransomware attacks have increased in volume over the last year, with 66% of respondents in a survey reporting that their organization was hit by ransomware in the previous year, a 78% increase from last year.

This report is intended to assist organizations in setting up their endpoint security solution in the most effective way possible. It offers practical advice and guidance on how ransomware attacks are deployed, and how to configure a solution to provide the best possible protection against cyber threats.

Here are the key practices that are essential for ensuring the security of your organization’s endpoint devices:

• Turn on All Policies and Ensure all Features are Enabled: Enabling all the features and policies available in your endpoint security solution is a simple yet effective way to ensure optimal protection. These policies are created to target specific cyber threats and by ensuring that all the protection options are active, you can be sure that your endpoint is protected against both known and emerging ransomware.
• Regularly Review your Exclusions:  Exclusions in endpoint security solutions allow certain directories and file types to be excluded from malware scans, which can reduce system delays and false-positive alerts. However, a growing list of exclusions can weaken the overall security. Regularly review and minimize the number of exclusions, and ensure they are specific, such as excluding specific files by their full path rather than entire directories or drives. This helps prevent malware from bypassing security and running from the same folder.
• Enable Multi-Factor Authentication (MFA) within your Security Console: Multi-factor authentication (MFA) adds an extra layer of security beyond the traditional password. For users who have access to the security console, it is crucial to enable MFA across all applications. This ensures that access to the endpoint protection solution is secure, and prevents accidental or intentional attempts to change settings that could leave devices vulnerable to attacks. MFA is particularly important for securing Remote Desktop Protocol (RDP).
• Ensure Every Endpoint is Protected and Up-To-Date:It is important to regularly check your devices to ensure they are protected and have the latest updates. If a device is not working properly, it may not be secure and can be at risk for ransomware attacks. Utilizing endpoint security tools and implementing an IT maintenance program can aid in identifying and addressing any potential IT concerns.
• Maintain Good IT Hygiene Regularly: It is important to maintain good IT hygiene by regularly evaluating the performance and security of your devices and software. This can prevent potential cybersecurity threats such as ransomware attacks and save time in resolving future incidents. Implementing a program to check for configuration issues, monitor device performance, remove unnecessary programs, and ensure software updates are kept current, will ensure your devices and software are running at optimal levels.
• Proactively Hunt for Active Adversaries across your Network: Today’s cyber threats are often sophisticated, using legitimate tools and stolen credentials to evade detection. To combat these “living-off-the-land” attacks, it is crucial to proactively search for advanced threats and active adversaries. Once identified, it is important to take swift action to neutralize them. Technologies such as endpoint detection and response (EDR) and XDR can be used for threat hunting and neutralization. Organizations should fully utilize these technologies to strengthen their cybersecurity defenses.

Overall, the goal of the report is to help users get the most out of their endpoint security solution, ensuring that their systems and data are well-protected against cyber threats. By configuring your endpoint solution with these features, you can greatly improve the security of your organization and protect against a wide range of threats.

To learn more about configuring your endpoint solution for optimum protection, download the full report from Sophos by clicking this link.