Review: Sophos Endpoint Security and Data Protection 9

I could also right-click a group or computer and order an immediate full scan. Being able to make changes, deploy policy, scan and check for errors also streamlines troubleshooting.

By clicking the Find New Computers button at the upper left, I imported my test machines into a new group called “Testmachines.” (An organisation could create groups based on location or department.) Computers go in groups, and policy gets applied to groups. The whole process took only a few right-clicks in tests, after which everything was neat and tidy. I could also use Find New Computers to scan my network for computers that were not being managed in ActiveDirectory.

I deployed a reasonable bunch of policies for computers connected to an internal network. Speaking of which, all network rules have the ability to be configured for multiple locations, so a laptop could be configured to allow Windows file sharing in the office but block it everywhere else.

I used pretty standard settings for AV and HIPS policy. I configured the firewall to inspect and log exceptions to policy, but not to block. This way, I could review logs and tweak firewall policy before blocking real traffic.

Application, Data Control

Application control is where it starts to get interesting. Applications and categories of applications can be blocked from installation and execution, or just logged. On the authorisation tab of the Application Control Policy editor, I could select application groups that have no reason to be on a workstation, such as file-sharing and games. The message a user sees when he or she tries to access one of these unauthorised applications can be customised, and events can be reported via SNMP and email. I could also enforce software update policy by, for example, allowing Firefox 3, but not Firefox 1 or 2. Updating policy to block an app not listed by Sophos is not done here, but rather under firewall settings.

A new addition in this version of the suite is data control. Sophos adapted its malware scanning and recognition engines to search for specific words and/or patterns in documents or web forms. Transfer can then be blocked or logged. Data Control rules search for patterns or content and then take appropriate action by either warning the user (in case of an authorised and intentional transfer), or warning and blocking the user.

Reporting is quite flexible, and Sophos does a great job streamlining the process of generating reports. Nine common reports come with the product to serve as templates for customisation.

The Alert and Event History report was helpful to me, as it highlighted the security events found on my test network. This made it very easy to see, for example, which computer was used to attempt a transfer of sensitive corporate data.

Reports open on top of the console. I found this frustrating because I would have liked to run the report, close it to check a setting, and run the report again. Any report can be scheduled to run regularly and emailed to recipients. In addition, email and SNMP alerts can be issued when error thresholds are surpassed for many different factors.

After pushing out policy, I examined my tests workstations to verify that they had been secured.

In short, everything worked much as it should.

In AV and HIPS testing, nine of 15 malware items were blocked from download. One of the six that were not blocked from download were blocked from installation, while four were blocked from execution.

Application control blocked me from running peer-to-peer apps and games. Device control worked as configured, and users are notified with a popup message that Sophos blocked the drive.

Data control also worked very well. I was able to block uploads of various file types containing different types of information. For example, I blocked the word “eweek” in a text file and 10 or more Social Security numbers in an Excel file.

Matthew D. Sarrel is executive director of Sarrel Group, an IT test lab, editorial services and consulting firm in New York.