1

I’m looking into ways we can improve the security of our org. We’re all on prem still, ESXi hosts and Exchange Server.

Currently pretty much all we have is Sophos X-Intercept (no XDR/MDR) and an email filter. I was looking into the Sophos MDR, what do you guys think of it?

No logging other than event logs on DC’s.

We have an older Cisco ASA, should we replace that with something newer? What softwares would you guys recommend we look into?

Is there some sort of software/appliance to monitor network traffic we should look into?

We’re pretty basic here so anything will help.

8 Spice ups
2

Up-to-date antivirus is a good start. I think it was Roger Grimes (KnowBe4) who posted several weeks ago that the two most efficient pathways into your systems are via phishing and vulnerabilities that exist in unpatched/unsupported hardware and software. Using that logic and given limited resources (time/money) I would make sure that all your software/hardware is supported and patched, and begin a training program for your organization that covers email and web safety practices. Good luck.

@roger-knowbe4

2 Spice ups
3

Yep, social engineering is involved in 70% to 90% of all successful attacks. Unpatched software is involved in 20% to 40%. Those two root access methods account for 90% to 99% of the risk in most environments. Yes, you can be hacked other ways, but mitigating those two things very well is probably the difference between becoming a victim or not for most organizations. It is the failure of most organizations to appropriate focus on those two root causes first and best that allows hackers and malware to be so successful.

I cover it more here: The Two Best Things You Can Do to Protect Yourself and Organization

Thanks for the shoutout, @spiceuser-m3bdp ​

3 Spice ups
4

Completely agree with the earlier comments - nothing to add there.

However, I would highly recommend also adding a monitoring solution that gives you visibility into your network. A good monitoring solution can verify certain metrics such as the patch status, installed software and ensure that good security practices are not in place but also being maintained (password policy, insecure protocols, …) Log monitoring should also be part of the solution, so you can see suspicious activity, track movement on the network and so forth. Lots of solutions out there, each with their own pros and cons. For smaller/medium size companies I recommend EventSentry most of the time.

BTW, there is nothing wrong with being on premise. A lot of folks are either going back to premise after being in the cloud, or only moving select services to the cloud. The main driving factor behind that decision from what I have gathered is the often extremely high cost.

1 Spice up
5

Some time ago we have conducted research on state of vulnerability remediation, which I recommend you to check: 2023 State of Vulnerability Remediation Report | Action1 (actually, we have more materials you might consider useful, for example How to Manage Security Vulnerabilities article).

But simply put:

  • Patch management: Consider implementing a robust patch management system. Patch management involves regularly updating and applying software patches and updates to address known vulnerabilities in your systems and applications. Latest LastPass hack is a horrendous example of what can happen if you forget updating your systems.
  • Logging and SIEM: Implement a centralized log management system and Security Information and Event Management (SIEM) solution to collect and analyze logs for proactive threat detection.
  • Network Traffic Monitoring: Deploy a network traffic monitoring tool like Cisco Stealthwatch, Darktrace, or Zeek to detect suspicious activities on your network.
  • Firewall Upgrade: Consider upgrading your outdated Cisco ASA firewall to a modern Next-Generation Firewall (NGFW) for advanced security features.
  • Vulnerability Management: Use a vulnerability management solution like Tenable.io, Qualys, or Rapid7’s InsightVM to identify and prioritize security vulnerabilities.
  • User Awareness Training: Conduct regular security awareness training to educate users about best practices, phishing, and social engineering risks.
  • Incident Response Plan: Develop a plan outlining steps to be taken during security incidents, including roles, responsibilities, and escalation procedures.
6

Thanks everyone! Lots of good info!