REVIEW: Sophos Endpoint Security and Data Protection 9 Suite Is Full-Featured, Well-Managed

Application, Data Control

Application control is where it starts to get interesting. Applications and categories of applications can be blocked from installation and execution, or just logged. On the authorization tab of the Application Control Policy editor, I could select application groups that have no reason to be on a workstation, such as file sharing and games. The message a user sees when he or she tries to access one of these unauthorized applications can be customized, and events can be reported via SNMP and e-mail. I could also enforce software update policy by, for example, allowing Firefox 3, but not Firefox 1 or 2.  Updating policy to block an app not listed by Sophos is not done here, but rather under firewall settings.  

A new addition in this version of the suite is data control. Sophos adapted its malware scanning and recognition engines to search for specific words and/or patterns in documents or Web forms. Transfer can then be blocked or logged. Data Control rules search for patterns or content and then take appropriate action by either warning the user (in case of an authorized and intentional transfer), or warning and blocking the user. 

Reporting is quite flexible, and Sophos does a great job streamlining the process of generating reports. Nine common reports come with the product to serve as templates for customization.

The Alert and Event History report was helpful to me, as it highlighted the security events found on my test network. This made it very easy to see, for example, which computer was used to attempt a transfer of sensitive corporate data.

Reports open on top of the console. I found this frustrating because I would have liked to run the report, close it to check a setting, and run the report again.  Any report can be scheduled to run regularly and e-mailed to recipients. In addition, e-mail and SNMP alerts can be issued when error thresholds are surpassed for many different factors. 

After pushing out policy, I examined my tests workstations to verify that they had been secured.

In short, everything worked much as it should.

In AV and HIPS testing, nine of 15 malware items were blocked from download. One of the six that were not blocked from download were blocked from installation, while four were blocked from execution.

Application control blocked me from running peer-to-peer apps and games.  Device control worked as configured, and users are notified with a popup message that Sophos blocked the drive.

Data control also worked very well. I was able to block uploads of various file types containing different types of information. For example, I blocked the word "eweek" in a text file and 10 or more Social Security numbers in an Excel file.

Matthew D. Sarrel is executive director of Sarrel Group, an IT test lab, editorial services and consulting firm in New York.