Securing with Sophos - Sophos Day Belux 2014

Editor's Notes

• #12: Our Design principle for Sophos Cloud is to provide Sophos security with Cloud Simplicity The same trusted endpoint protection now available as a cloud-based/ cloud managed service with instant deployment.
• #13: What is Sophos cloud? Sophos Cloud is a Cloud Managed security service. The initial version of Sophos Cloud delivers cloud-managed endpoint security as a service. The management console is hosted by Sophos which means there is no server to set up and security can be deployed instantly. A small client anti-malware software (or agent) is installed on the protected computers. Users - regardless of where they are – either in the office, working remotely working or traveling - will get complete coverage everywhere with real time policy refresh, and the latest threats and software updates. And because the management is hosted by Sophos in the cloud, users will get automatic updates and upgrades through the management console.
• #14: Smaller and growing businesses like yours may not have a lot of resources but are still concerned about cybercrime having a negative impact on your business. Your IT resource is far too precious to focus a lot of time on security. You need security that is easy to deploy. Sophos Cloud doesn’t require a server. And you can start with a trial account that take minutes from sign up on line to deployment. <Click> The second need is effective protection everywhere. Growing business like yours typically have remote and roaming workers. You want to ensure they are protected the same way as office users. Sophos Cloud provides automatic threat updates and real time policy refresh so your roaming workers are always protected against the latest threats. In addition, we know that 90% of threats are coming from web. Sophos Cloud automatically blocks web threats before they reach your computers. What’s more, Sophos Cloud uses security best practice to automatically resolve issues for you. Whenever we can, we make dealing with issues easier and quicker than ever. <click> We know that security is not your only job, so a solution must be easy to manage and maintenance free. Sophos cloud’s management console is accessible from anywhere. And because the server is hosted by Sophos, we provide automatic software updates and upgrades, which means it is maintenance free for you. <click> Lastly, you want a solution the is economical. We offer per user licensing. Your user may have a desktop and a macbook air for travel, but that stil counts as one user. Sophos Cloud is subscription-based, so you can add users as you grow. And we have flexible licensing terms with available annual or multi-year subscriptions, and monthly subscriptions are coming soon. Again, Sophos cloud means no equipment procurement or maintenance costs, automatic updates and upgrades, and per user licensing.
• #16: Improved exclusion capabilities (2008/r2, 2012/r2) Automatic exclusions (2008/r2, 2012/r2) Competitive intelligence – against competitor’s server product  focus on set up/ configuration. No plan to put server AV on 3rd party test. Performance test - > 3rd party accolade (general Sophos, not product specific) download reputation – first in cloud. (server?)  APT/ network-aware threat detection. Guidance on what collateral -
• #25: The original Cloud Endpoint license (EP-Cloud) introduced with v1 was retired when v2 was released. All customers with this license were automatically upgraded to CEA.
• #27: Set up is extremely easy. If you start with the trial, complete a simple form and Sophos Cloud will send you an activation email. That leads you to set up your account log in.
• #28: We know that setting up an account without deploying endpoint client doesn’t really help anybody. So the first experience after you sign in is this “lightbox” that urges you to deploy the software.
• #29: Simply deployment via email
• #30: Policy can be set by the user or by the group, and will automatically apply to all the computers under that user or group.
• #31: A dashboard that shows actions required, if any, is also included to give you tremendous visibility into your deployment.
• #32: The reports give you at a glance views of all the devices, computers and users protected. You can also view reports by users, by computers or by devices
• #35: - Data Protection that doesn’t end at the office door: With Mobile Content Management for iOS devices, SMC is the only EMM vendor to offer individual File Encryption, ensuring each document that is connected to the server remains secure, allowing users to remain productive by collaborating safely. Gated entry to each file allows organizations to rest assured that their documents and data remain safe – not just in the office, but anywhere & everywhere their users go.   - Integrated Security: Mobile devices are essentially computers that travel everywhere with users; hence, mobile devices need the same level of AV protection, to ensure users can remain productive and safe. Sophos Mobile Control is the only vendor to provide integrated AV and Web Filtering for Android devices – Android devices encompass 70% of smartphone sales, yet Android devices are the most susceptible to malware; last year there were about 80,000 malware samples detected. With SMC 4.0, users get integrated anti-malware, which protects users from malicious websites and other threats; this can be integrated into the SMC console and centrally managed through SMC. Additional web filtering protection helps ensure that Android devices remain secure, and organizations have reduced risk data breaches with our UTM integration which blocks network access based on compliance status of device (SMC also integrates with Checkpoint & Cisco for Network Access Control).     -User-Centric: the only EMM vendor to offer user-based pricing, Sophos makes it easier for organizations to calculate the costs of implementing BYOD in their environment  
• #36: With this new and exciting feature, we are extending our promise of “Encryption Everywhere” by offering built in Mobile Encryption into SMC. Cloud storage makes it easy for your customers’ users to access files from any location. But after news of data breaches, can they be sure that their data is really safe? Data protection shouldn’t end at your office door. SMC now makes it easier for you to collaborate with colleagues and business partners. And it enables persistent encryption because each document that is connected to the server remains secure. What makes us different? We are the only EMM vendor to offer individual file encryption: with AirWatch/Mobile Iron, if someone gets access to your dropbox account, they automatically get access to a users’ content. With SMC, each document is gated and therefore even if they get into the dropbox account, they cannot access individual files without a key. Gated entry to each file allows organizations to rest assured that their documents and data remain safe – not just in the office, but anywhere & everywhere their users go. Currently, iOS first  Android to follow. Encryption Everywhere Gartner called out the importance of this in their 2014 MQ report - “Sophos' mobile content management transparently encrypts files leaving a PC or mobile device to prevent data leakage. This integrates with third-party file storage providers and enables companies to securely use low-cost third-party storage.”
• #37: Screen shot of Mobile Encryption app, automatically built into SMC. We support DropBox, Egnyte, Google Drive, etc Available only on iOS If device is not compliant, the access to the SME app will be blocked
• #38: Integrated AV (malware protection): With SMC, users get integrated anti-malware which provides full functionality to protect your Android device without reducing performance or battery life. Android devices encompass 70% of smartphone sales, yet Android devices are the most susceptible to malware; last year there were about 80,000 malware samples detected. With SMC, users get integrated anti-malware which provides full functionality to protect your Android device without reducing performance or battery life. -SMC (with built in SMSec) Helps users avoid undesirable software that may lead to data loss and unexpected costs.  -SMSec is integrated into the SMC console and centrally managed through SMC -Admins have full control over the app settings and can block infected or outdated devices. Other EMM vendors don’t offer built in Anti-malware, they have a 3rd party that provides that capability.  Web Filtering: Sophos Mobile Control is the only vendor to offer Web Filtering for Android devices. Admins can define 14 categories that they allow/warn/block, filtering web access on Android devices. Sophos is the only EMM vendor to extend this endpoint functionality to mobile devices, offering additional robust protection for Androids to prevent access to data-stealing web pages.  Network access control: Organizations have reduced risk data breaches, since SMC can be programmed to block network access based on device compliance status. In 4.0, SMC integrates with Sophos UTM. SMC controls a user’s network access via Wi-Fi and VPN based on the compliance status of device: if you have a roach device, you can block VPN or Wi-Fi access. - SMC also integrates with Checkpoint & Cisco for network access control (however, only for controlled VPN/Wi-Fi access only)
• #39: Integrated AV (malware protection): With SMC, users get integrated anti-malware which provides full functionality to protect your Android device without reducing performance or battery life. Android devices encompass 70% of smartphone sales, yet Android devices are the most susceptible to malware; last year there were about 80,000 malware samples detected. With SMC, users get integrated anti-malware which provides full functionality to protect your Android device without reducing performance or battery life. -SMC (with built in SMSec) Helps users avoid undesirable software that may lead to data loss and unexpected costs.  -SMSec is integrated into the SMC console and centrally managed through SMC -Admins have full control over the app settings and can block infected or outdated devices. Other EMM vendors don’t offer built in Anti-malware, they have a 3rd party that provides that capability.  Web Filtering: Sophos Mobile Control is the only vendor to offer Web Filtering for Android devices. Admins can define 14 categories that they allow/warn/block, filtering web access on Android devices. Sophos is the only EMM vendor to extend this endpoint functionality to mobile devices, offering additional robust protection for Androids to prevent access to data-stealing web pages.  Network access control: Organizations have reduced risk data breaches, since SMC can be programmed to block network access based on device compliance status. In 4.0, SMC integrates with Sophos UTM. SMC controls a user’s network access via Wi-Fi and VPN based on the compliance status of device: if you have a roach device, you can block VPN or Wi-Fi access. - SMC also integrates with Checkpoint & Cisco for network access control (however, only for controlled VPN/Wi-Fi access only)
• #40: Web Filtering: Sophos Mobile Control is the only vendor to offer Web Filtering for Android devices. Admins can define 14 categories that they allow/warn/block, filtering web access on Android devices. Sophos is the only EMM vendor to extend this endpoint functionality to mobile devices, offering additional robust protection for Androids to prevent access to data-stealing web pages.  Network access control: Organizations have reduced risk data breaches, since SMC can be programmed to block network access based on device compliance status. In 4.0, SMC integrates with Sophos UTM. SMC controls a user’s network access via Wi-Fi and VPN based on the compliance status of device: if you have a roach device, you can block VPN or Wi-Fi access. - SMC also integrates with Checkpoint & Cisco for network access control (however, only for controlled VPN/Wi-Fi access only)
• #41: Web Filtering: Sophos Mobile Control is the only vendor to offer Web Filtering for Android devices. Admins can define 14 categories that they allow/warn/block, filtering web access on Android devices. Sophos is the only EMM vendor to extend this endpoint functionality to mobile devices, offering additional robust protection for Androids to prevent access to data-stealing web pages.  Network access control: Organizations have reduced risk data breaches, since SMC can be programmed to block network access based on device compliance status. In 4.0, SMC integrates with Sophos UTM. SMC controls a user’s network access via Wi-Fi and VPN based on the compliance status of device: if you have a roach device, you can block VPN or Wi-Fi access. - SMC also integrates with Checkpoint & Cisco for network access control (however, only for controlled VPN/Wi-Fi access only)
• #42: Integrated AV (malware protection): With SMC, users get integrated anti-malware which provides full functionality to protect your Android device without reducing performance or battery life. Android devices encompass 70% of smartphone sales, yet Android devices are the most susceptible to malware; last year there were about 80,000 malware samples detected. With SMC, users get integrated anti-malware which provides full functionality to protect your Android device without reducing performance or battery life. -SMC (with built in SMSec) Helps users avoid undesirable software that may lead to data loss and unexpected costs.  -SMSec is integrated into the SMC console and centrally managed through SMC -Admins have full control over the app settings and can block infected or outdated devices. Other EMM vendors don’t offer built in Anti-malware, they have a 3rd party that provides that capability.  Web Filtering: Sophos Mobile Control is the only vendor to offer Web Filtering for Android devices. Admins can define 14 categories that they allow/warn/block, filtering web access on Android devices. Sophos is the only EMM vendor to extend this endpoint functionality to mobile devices, offering additional robust protection for Androids to prevent access to data-stealing web pages.  Network access control: Organizations have reduced risk data breaches, since SMC can be programmed to block network access based on device compliance status. In 4.0, SMC integrates with Sophos UTM. SMC controls a user’s network access via Wi-Fi and VPN based on the compliance status of device: if you have a roach device, you can block VPN or Wi-Fi access. - SMC also integrates with Checkpoint & Cisco for network access control (however, only for controlled VPN/Wi-Fi access only)
• #43: Integrated AV (malware protection): With SMC, users get integrated anti-malware which provides full functionality to protect your Android device without reducing performance or battery life. Android devices encompass 70% of smartphone sales, yet Android devices are the most susceptible to malware; last year there were about 80,000 malware samples detected. With SMC, users get integrated anti-malware which provides full functionality to protect your Android device without reducing performance or battery life. -SMC (with built in SMSec) Helps users avoid undesirable software that may lead to data loss and unexpected costs.  -SMSec is integrated into the SMC console and centrally managed through SMC -Admins have full control over the app settings and can block infected or outdated devices. Other EMM vendors don’t offer built in Anti-malware, they have a 3rd party that provides that capability.  Web Filtering: Sophos Mobile Control is the only vendor to offer Web Filtering for Android devices. Admins can define 14 categories that they allow/warn/block, filtering web access on Android devices. Sophos is the only EMM vendor to extend this endpoint functionality to mobile devices, offering additional robust protection for Androids to prevent access to data-stealing web pages.  Network access control: Organizations have reduced risk data breaches, since SMC can be programmed to block network access based on device compliance status. In 4.0, SMC integrates with Sophos UTM. SMC controls a user’s network access via Wi-Fi and VPN based on the compliance status of device: if you have a roach device, you can block VPN or Wi-Fi access. - SMC also integrates with Checkpoint & Cisco for network access control (however, only for controlled VPN/Wi-Fi access only)
• #44: Integrated AV (malware protection): With SMC, users get integrated anti-malware which provides full functionality to protect your Android device without reducing performance or battery life. Android devices encompass 70% of smartphone sales, yet Android devices are the most susceptible to malware; last year there were about 80,000 malware samples detected. With SMC, users get integrated anti-malware which provides full functionality to protect your Android device without reducing performance or battery life. -SMC (with built in SMSec) Helps users avoid undesirable software that may lead to data loss and unexpected costs.  -SMSec is integrated into the SMC console and centrally managed through SMC -Admins have full control over the app settings and can block infected or outdated devices. Other EMM vendors don’t offer built in Anti-malware, they have a 3rd party that provides that capability.  Web Filtering: Sophos Mobile Control is the only vendor to offer Web Filtering for Android devices. Admins can define 14 categories that they allow/warn/block, filtering web access on Android devices. Sophos is the only EMM vendor to extend this endpoint functionality to mobile devices, offering additional robust protection for Androids to prevent access to data-stealing web pages.  Network access control: Organizations have reduced risk data breaches, since SMC can be programmed to block network access based on device compliance status. In 4.0, SMC integrates with Sophos UTM. SMC controls a user’s network access via Wi-Fi and VPN based on the compliance status of device: if you have a roach device, you can block VPN or Wi-Fi access. - SMC also integrates with Checkpoint & Cisco for network access control (however, only for controlled VPN/Wi-Fi access only)
• #46: So we’ve covered how we’re extending our reporting with iView and addressing customers top complaints about their current firewall, but what about these other major complaints. Of course, the UTM does a great job in providing protection and controls, that are easy to manage, and with everything in a single box, customers get outstanding value, but let’s have a look at how we’re extending this advantage in UTM 9.3
• #47: What’s new in UTM 9.3? Well there are a bunch of new features that fall nicely into four areas… Stronger protection with new features for web, email, and WAF… in particular… one of our most requested features… time quotas for web surfing policies so you can limit users to say 1 hour per day for categories such as social media, shopping or sports. Site tagging and selective SSL scanning are also being introduced. We’re also making WiFi smarter with enhancements to the WiFi channel optimization to maximize performance, hotspot authentication via mobile devices and of course support for the new Access points. New deployment options extend the UTMs ability to work better in even more places… with Hyper-V 2012 R2 support (with HA options), support for HA on AWS, and a new option for one-click secure support access to SSH or Webadmin. And of course, the new iView reporting appliance extends and enhances our UTM reporting, so let’s look at that in more detail…
• #59: For those of you that may not know… Sophos iView is our first product collaboration with Cyberoam. This is a product that we’ve worked with them on bringing to the sophos UTM product line as an add-on that extends and enhances our on-box reporting. It works out of the box with Sophos UTMs and offers a number of great features that will appeal to many organizations such as… Added visibility, adding a bunch of additional reports and views, including reporting that meets compliance requirements for standards like HIPAA, PCI, and a few others. It also offers a lot of additional views and customization options that will appeal to the nerdy IT admin. Another key benefit it provides is consolidated reporting across multiple UTMs which will be huge for MSPs and larger organizations with more than one UTM. It also provides some good insights into traffic trends that may allow admins to identify problem users or attacks on their network And it provides great log management for backup and long-term storage so if a UTM needs to be replaced all the historical reporting is not lost and makes retrieval easy for audits or forensics It’s a great new addition to the UTM line up, particularly for customers wanting more breadth and depth of reporting, those who need to meet compliance requirements, or those managing networks with multiple UTMs. It’s coming at the end of Sept.
• #60: Since Sophos iView uses the same OS and installer as Sophos UTM, that part of deploying iView will be very familiar to SEs and partners.
• #61: After iView is installed, On the UTMs you’re monitoring, all you need to do is go into “Log Settings” and setup iView as a syslog server – iView will automatically recoginze the UTM and start accepting log data
• #62: iView offers a huge number of reports and dashboards that are easily customized with attractive animated 3D graphs. Here’s a snap shot of of the Web Usage Dashboard showing top domains, users, categories, and content in a single view with extensive drill down capability
• #63: A key feature of iView is the ability to help customers achieve compliance reporting requirements for standards such as PCI, HIPAA and others. The compliance reporting section offers all the reports customers needs… here’s an example of the admin audit trail report that’s required for PCI compliance.
• #64: Consolidated reporting is another key feature of iView as it can collect logs from multiple UTMs and provide both a consolidated view of the entire network as well as the ability to organize UTMs into groups or drill down into individual UTMs There’s an option to “Select Device” on the top of every report Which allows you to select the specific UTM or group of UTMs you want to report on.
• #65: iView also offers important trend reporting which can be helpful in identifying attacks, such as a sudden increase in ICMP traffic that might be indicating a Denial of Service type attack as you can see here on this chart. It also offers a ton of custom report options, scheduled reports, and literally any feature you might expect in a dedicated reporting appliance. We’re going to put together a screen shot library of many of the reports as soon as we can as a sales tool.