REVIEW: Sophos Endpoint Security and Data Protection 9 Suite Is Full-Featured, Well-Managed

More and more corporate endpoint devices need to be protected against an increasing number of threats. Many of the suites designed to offer protection began life simply as antivirus or firewall applications. New functionality--such as application, data and device control--has been added to address new threats, but so has complexity. So, it's nice to find a full-featured endpoint security suite that is as sleek and easy to configure and manage as Sophos Endpoint Security and Data Protection 9. 

Sophos Endpoint Security and Data Protection 9 is a solid contender in the enterprise endpoint security market. Deployment and management are strong points, with a streamlined and straightforward management GUI. Pricing starts at $40 per client, and volume licensing discounts are available.

I installed Sophos Enterprise Console on a Windows Server 2003 SE SP2 system that was already configured as a primary domain controller in Active Directory. I used three Windows XP Pro SP3 workstations as test clients. All ran as virtual machines under VMware Workstation 6.5 on Windows Vista 64 with a 3GHz Intel Core 2 Quad Q6600, 8GB RAM and a 1.5TB hard drive. Installation went smoother than usual for an enterprise security software product.

When Sophos Enterprise Console launches, it displays a Dashboard containing alerts, errors and the update status of computers under management.

Click here for a look at Sophos Endpoint Security and Data Protection 9.

I found the Dashboard to be of limited value. It does a great job of showing summary information that you can drill down into to take action. For example, I could click the link for the number of firewall events over a threshold and be taken directly into the interface to see all firewall events for that computer.

However, I found that once I checked the Dashboard and put out any fires, it made more sense to ditch it and use the full screen for the management interface.

There is a graphical indicator of overall system status in the lower right-hand corner of the Enterprise Console. The indicator is a green check if all is well, and a red exclamation point if there is trouble. During tests, when the indicator turned into an exclamation point, I double clicked it and the dashboard popped up allowing me to see how the error affected my network as a whole. I could then drill down to address issues on individual computers.

Developing Policy

When implementing the suite, the first major task is to develop policy in its major security areas:  anti-virus, HIPS (host-based IPS), firewall, NAC (network access control), application control, data control and device control.

However, a word of caution is necessary: Always test a new policy before widespread deployment to avoid deploying a policy that causes disruption of network, application and data services, such as a "block all" firewall rule or a NAC rule that would completely isolate a computer. This is largely a caution with all products in this class, but with Sophos, you get no warning that something could be broken if you take a particular action.

The basic interface of Sophos Enterprise Console is divided into three areas. Groups and policies are organized along the left, and the main pane shows computers. Clicking on a computer brings up more info, either in a new pane below or a pop-up showing details down to the individual log events, which is a fantastic help in troubleshooting.

I could also right-click a group or computer and order an immediate full scan. Being able to make changes, deploy policy, scan and check for errors also streamlines troubleshooting.

By clicking the Find New Computers button at the upper left, I imported my test machines into a new group called "Testmachines." (An organization could create groups based on location or department.) Computers go in groups, and policy gets applied to groups. The whole process took only a few right-clicks in tests, after which everything was neat and tidy. I could also use Find New Computers to scan my network for computers that were not being managed in ActiveDirectory.

I deployed a reasonable bunch of policies for computers connected to an internal network. Speaking of which, all network rules have the ability to be configured for multiple locations, so a laptop could be configured to allow Windows file sharing in the office but block it everywhere else.

I used pretty standard settings for AV and HIPS policy. I configured the firewall to inspect and log exceptions to policy, but not to block. This way, I could review logs and tweak firewall policy before blocking real traffic. 

Next: Application, Data Control >>