Hi I'm Doug from the product team here at Sophos and today we're going to
take a look at setting up base policies for endpoint protection. So we'll click
into endpoint protection from the main dashboard here and choose policies under
the configure section. Endpoint protection starts with a base policy for
each of the policies you see here. Now these base policies automatically apply
to every user or computer until you create exemption policies that cater to
particular users machines and groups. You have a few options for getting users
into the system. You can add users manually, or import them via CSV files by
clicking the people link here. You can also sync with Active Directory by using
our tool found in the settings section here. And finally, when deploying the
endpoint agent found in the protect devices section, more on that in a bit.
It'll simply create users automatically each time it's installed on a machine. So
let's visit each of these based policies, starting with threat protection. Let's
click into this policy and head to the settings tab. Now you notice the settings
are grayed out, and the 'use recommended settings' box is ticked. This is what we
at Sophos believe to be the optimal best practice settings for just about
any organization. We're also constantly adding new features to Sophos Central,
and for many of them we'll roll them out in phases. So from time to time you'll
notice that right now for instance, at the time of this recording, we're rolling
out our active adversary mitigations. At some point this feature will be switched
on automatically and added as a recommended setting, but for now this
account can turn one or more of these mitigations on manually, by clicking the
drop-down, choosing 'custom,' and ticking the various boxes here. So let's take a
closer look at some of the settings in this policy by unchecking the 'use
recommended settings,' box temporarily. Let's first talk about our approach to
file-based malware. You'll notice here that we have Sophos deep learning
enabled. Now this is different from everyone else's machine learning,
in that the combination of deep learning with our tried-and-true endpoint
protection means greater accuracy and far fewer false positives than competing
products, and it's enabled by default which is great. There's no training
period for our deep learning system - it just works right out of the gate for
your environment. We have a state of the art labs team that constantly trains and
tunes our deep learning engines. You don't have to so paired with this
real-time scanning setting that leverages our 30-plus years of industry
experience deep learning, is made that much more powerful and accurate. We then
get into our behavior based detections, starting with real-time scanning
features this block access to malicious website setting, for instance checks
against a database of known bad websites that grows by about 6 million URLs each
week. This setting alone is responsible for stopping about 80% of attacks, and
again it's on by default. And then taking a look at our runtime protection section,
this is really where the power of Intercept X begins to shine. Our exploit
protection technology for instance, is the most comprehensive and powerful
exploit protection of any product on the market today, so it's great for dealing
with fileless malware and other nasty advanced attacks. Cryptoguard is another
one of our extremely popular features. This protects against ransomware that
maliciously encrypts user files and demands payment to unlock them. So that's
a quick look at the threat protection based policy, let's head back up top and
recheck the 'use recommended settings box.' Click Save and we'll be on our way.
Moving right along to peripheral control, we'll again click the Settings tab, and
we'll see that this is disabled by default.
Now aside from disabling peripheral control, we've got two main modes in
monitor mode, will allow all peripherals to be used, but we'll just audit them to
get a good idea of what's going on in our environment. In control mode we'll
actually control whether peripherals can be allowed read-only or blocked. Wireless
is a slightly different setting. We can allow, block, or block bridging, say to a
nearby wireless coffee shop network, or a cellphone hotspot.
While a machine is connected to the wired office network, we can also create
exemptions here based on the history of log devices. This is a new account so we
have nothing of note here yet, but if we check back in a week or so there should
be full of devices that we can exempt from the base peripheral control policy
if we like. Next up is application control. Again, click the Settings tab, and
again this is off by default. With app control we're looking to blacklist apps
we believe to be malicious or inappropriate, and as with peripheral
control, we've got a sort of monitoring mode that we can use to either let
controlled apps run in a detection only mode, or outright block them. We can also
choose whether we want scheduled or full system scans to also detect controlled
applications. So let's set that to yes and then get to work building our blacklist
Now blacklists can be cumbersome to manage so we've got a few tricks up
our sleeve here. Taking a look at document viewers for example we've got
all these versions of Adobe Reader to worry about keeping updated. Well, Adobe
is a big target for exploit based attacks, so what we can do is just block
all older versions of reader to ensure that only the latest version is being
used across the company. And then let's say we don't want people using any file
sharing apps. They're just too risky. Well obviously we'll just select all of
them by using the master check box here, but we can also check this bottom box. By
doing that, every time our labs team here at cellphones discovers new file sharing
software, it'll get added to our blocked apps list
automatically. Okay let's move on now to data loss prevention, or DLP. This is
actually a pretty advanced policy. What we're doing here is we're looking at the
contents of files as they leave the endpoint. So let's enable these rules and
let's take a look at some of the controls that we have. Now for starters,
we have some built-in, region based templates, so choosing the US region here
for example, this will let us get started quickly with general health care and
finance rules. We can also create a custom policy on the right hand side
here. I like to first decide if I want to message my end users when a file that's
being transferred needs to be confirmed, or is blocked. We can then choose to add
either an existing rule we've already created, a rule that controls content
found inside files, or a rule that controls the transfer of specific file
types, or names. So, let's choose new content rule to track specific content
inside files. We'll call this 'financial data,' and we can choose to create
exclusions based on file type. Well let's skip those. And then we need to decide
what happens, do we want to allow the content to transfer transparently
without messaging the user, do we want to gently nudge the user to think twice
about the transfer, or do we want to block it entirely. For now, let's choose
to allow it, we'll simply create this as an auditing rule. Next we'll choose the
type of content. We can and weill want to leverage our filters here. First to
choose financial data, and then to choose the u.s. region. And let's check these
first two rules here. Now by default here this rule will look for 10 routing
numbers for instance before springing into action. We can change this to 1 to
ensure we're logging as much as possible though. And finally let's choose our
destinations. We want this rule to apply to content detected in the following
types of applications, or media. Click finish, and we've got our custom DLP rule
all set up. Since this is in our base policy, this will start reporting on all
connected Windows machines. Now on to Web Control. In this first section, additional
security options for instance. What we're doing is kind of extending the features
found in our threat protection policy, or blocking certain risky downloads by
default. We're letting ads and uncategorized sites through while
blocking, allowing, or warning about various items based on how prevalent
they are to attack. So to change settings here, we switch to
let me specify whenever we want to override the default settings of a
certain section. So we normally just warn people that Windows executables can be
risky, but if we're looking for greater control we can just block them entirely.
So those are the security options but we've also got other protections, such as
acceptable web usage. We've got some presets here, and again we can override
individual settings by choosing 'let me specify.' The 'keep it clean' setting is on
by default, which either warns or allows most categories with the exception of
adult, and potentially inappropriate content. And then we've got some data
loss options when it comes to potential data sharing. We can allow, block, or
warn our users when they visit web-based email sites and download sites.
So that's web control, let's head back out to the policies list, and check out
update management. Now with this we can choose an update window for our machines.
If we don't set this, our machines will check for product updates every hour.
This option is good for highly controlled environments where we only
want devices to perform updates during set hours. And last but not least let's
take a look at the Windows Firewall management policy. What we're doing here
is detecting and reporting the state of the Windows Firewall. Now by default
we'll 'monitor only,' but let's go ahead and choose 'monitor and configure.' From
here we can choose a connection type for each of the profiles seen here. So let's
say we want to block public networks. We want to block private networks with
exceptions. These are the exceptions set by Microsoft's Group Policy Orchestrator.
And for domain networks we'll leave those as 'allowed.' So those are our base
policies, pretty straightforward and a great foundation for your endpoint
protection.