Sophos Endpoint Security & Data Protection Dokumentacja Pobierz pdf (Strona 30)

SOPHOS ENDPOINT SECURITY AND DATA PROTECTION REVIEWER’S GUIDE

Ensuring protection with location awareness

Sophos Client Firewall lets you conﬁgure different policies for different locations

according to the location where computers are used, for example, in the ofﬁce

(on the network) and out of the ofﬁce. The Enterprise Console will then apply

different ﬁrewall settings to the computers depending on whether they are on

the network or not. This dual location conﬁguration is particularly important for

mobile computers such as laptops.

Preventing application hijacking and impersonation

Application-level ﬁltering is used to monitor application behavior, allowing

internet or network access only to applications that meet your speciﬁcations.

Sophos Client Firewall prevents application hijacking by monitoring inappropriate

application and system calls, and the launching of hidden processes. It also

uses a checksum method to foil attempts by spyware and other malware

to masquerade as a legitimate application, thereby preventing the theft of

conﬁdential information over the internet.

Stateful inspection scans incoming and outgoing data packets

Sophos Client Firewall uses stateful inspection to enhance security by keeping

track of packets to ensure only legitimate packets are allowed. Packets are

tracked in order to allow limited response communication. For example if an

outbound packet is sent then only those incoming packets originating from the

computer that has been communicated with (from the appropriate port) are

allowed through the ﬁrewall.

Central reporting and logging

The ﬁrewall provides a central report to the management console. This includes

unknown applications and trafﬁc, hidden processes and modiﬁed memory

events. This provides a simple way for you to understand potential areas of

security concern. In addition, the ﬁrewall’s log viewer lets you view, ﬁlter, and

save details of the connections that the ﬁrewall has allowed or blocked.

Monitor-only mode

The ﬁrewall can be deployed across your entire estate in an “alert only” mode.

It will discover all applications that are used on the network (taking into account

any LAN settings you have made). The results are reported back to the Enterprise

Console. This allows you to collect information about unknown trafﬁc and then to

reﬁne ﬁrewall policies accordingly without impacting user productivity.

Interactive working

The ﬁrewall can run in a learning (interactive) mode, asking the user how to deal

with detected trafﬁc. If this mode is enable, the ﬁrewall will display a pop-up on

the endpoint computer each time an unknown application or service requests

network access. The learning dialog asks the user whether to allow or block the

trafﬁc, or whether to create a rule for that type of trafﬁc.

1 2 ... 25 26 27 28 29 30 31 32 33 34 35 ... 40 41

Brak uwag

Sophos Endpoint Security & Data Protection Dokumentacja Strona 30