04-11-2018, 12:19 PM
Cheesy as it may seem, I can't say the end-point product that we use as no business in their right mind would disclose that information... except I can say that we use Darktrace as an AI tool on the network (rather than end-point) side. A bit of Googling will get the names of the main end-point AI tools.
Darktrace does almost the same as our end-point solutions, but for network traffic. I'm allowed to mention them as we have agreed that they can use our name in their publicity.
However, Darktrace is a SERIOUSLY expensive product, but it's seriously good at what it does - the company was set up out of Cambridge University (UK) with a bunch of Security Service, Secret Intelligence Service & GCHQ folk. Cunning stuff.
I'm not knocking Sophos - it is what it is. The thing is that all domestic AV is a compromise, and Sophos, AVG, ... etc. are all in that bracket. The basic rules on risk management are: Identify, analyse & understand the risks; reduce the attack surface; of the remaining risks, mitigate those you can and formally accept the remainder.
Companies serious about malware protection would never accept the risks associated with a deterministic scanner. You need a structured approach where every risk is understood (assuming you've identified all the risks, the main one being people).
Regarding GRC (Gibson Research) - that is exactly the same as the information theory stuff I just wrote about, except he's using really long strings, so you'd have to use a password manager.
The HEX string he provides has a full 256 bits of entropy, the second one about 388 bits out of a maximum possible 504, and the third string (reduced character choice compared to the second one) has about 375 bits of entropy.
All these are stupidly high numbers and largely pointless. 388 bits of entropy means that a brute force attack would take up to 2^388 attempts before a hit was found (in practice, the number is 50% of that value). As there are "only" about 2^265 atoms in the universe, you can see the silliness of all this.
Darktrace does almost the same as our end-point solutions, but for network traffic. I'm allowed to mention them as we have agreed that they can use our name in their publicity.
However, Darktrace is a SERIOUSLY expensive product, but it's seriously good at what it does - the company was set up out of Cambridge University (UK) with a bunch of Security Service, Secret Intelligence Service & GCHQ folk. Cunning stuff.
I'm not knocking Sophos - it is what it is. The thing is that all domestic AV is a compromise, and Sophos, AVG, ... etc. are all in that bracket. The basic rules on risk management are: Identify, analyse & understand the risks; reduce the attack surface; of the remaining risks, mitigate those you can and formally accept the remainder.
Companies serious about malware protection would never accept the risks associated with a deterministic scanner. You need a structured approach where every risk is understood (assuming you've identified all the risks, the main one being people).
Regarding GRC (Gibson Research) - that is exactly the same as the information theory stuff I just wrote about, except he's using really long strings, so you'd have to use a password manager.
The HEX string he provides has a full 256 bits of entropy, the second one about 388 bits out of a maximum possible 504, and the third string (reduced character choice compared to the second one) has about 375 bits of entropy.
All these are stupidly high numbers and largely pointless. 388 bits of entropy means that a brute force attack would take up to 2^388 attempts before a hit was found (in practice, the number is 50% of that value). As there are "only" about 2^265 atoms in the universe, you can see the silliness of all this.
sıʌǝɹq ɐʇıʌ `ɐƃuol sɹɐ
ʞɔıu
ʞɔıu
