Review: Sophos Endpoint Security and Data Protection 9

More and more corporate endpoint devices need to be protected against an increasing number of threats. Many of the suites designed to offer protection began life simply as antivirus or firewall applications. New functionality – such as application, data and device control – has been added to address new threats, but so has complexity. So, it’s nice to find a full-featured endpoint security suite that is as sleek and easy to configure and manage as Sophos Endpoint Security and Data Protection 9.

Sophos Endpoint Security and Data Protection 9 is a solid contender in the enterprise endpoint security market. Deployment and management are strong points, with a streamlined and straightforward management GUI. Pricing starts at $40 (£25) per client, and volume licensing discounts are available.

I installed Sophos Enterprise Console on a Windows Server 2003 SE SP2 system that was already configured as a primary domain controller in Active Directory. I used three Windows XP Pro SP3 workstations as test clients. All ran as virtual machines under VMware Workstation 6.5 on Windows Vista 64 with a 3GHz Intel Core 2 Quad Q6600, 8GB RAM and a 1.5TB hard drive. Installation went smoother than usual for an enterprise security software product.

When Sophos Enterprise Console launches, it displays a Dashboard containing alerts, errors and the update status of computers under management.

Click here for a look at Sophos Endpoint Security and Data Protection 9

I found the Dashboard to be of limited value. It does a great job of showing summary information that you can drill down into to take action. For example, I could click the link for the number of firewall events over a threshold and be taken directly into the interface to see all firewall events for that computer.

However, I found that once I checked the Dashboard and put out any fires, it made more sense to ditch it and use the full screen for the management interface.

There is a graphical indicator of overall system status in the lower right-hand corner of the Enterprise Console. The indicator is a green tick if all is well, and a red exclamation mark if there is trouble. During tests, when the indicator turned into an exclamation mark, I double clicked it and the dashboard popped up allowing me to see how the error affected my network as a whole. I could then drill down to address issues on individual computers.

Developing Policy

When implementing the suite, the first major task is to develop policy in its major security areas: anti-virus, HIPS (host-based IPS), firewall, NAC (network access control), application control, data control and device control.

However, a word of caution is necessary: Always test a new policy before widespread deployment to avoid deploying a policy that causes disruption of network, application and data services, such as a “block all” firewall rule or a NAC rule that would completely isolate a computer. This is largely a caution with all products in this class, but with Sophos, you get no warning that something could be broken if you take a particular action.

The basic interface of Sophos Enterprise Console is divided into three areas. Groups and policies are organised along the left, and the main pane shows computers. Clicking on a computer brings up more info, either in a new pane below or a pop-up showing details down to the individual log events, which is a fantastic help in troubleshooting.