Device isolation comes in a couple of flavors with Sophos Intercept X
Advanced with EDR. The first is admin led isolation. If you have the EDR license as
an administrator you have the ability to tell a device to break its network
connections, and to refuse connections from external devices.
This is an admin initiated event and once added to the isolation list the
device can still communicate with Sophos Central and Labs, so you can do file
submission and investigation from Sophos Central. It will also be able to
communicate with critical system infrastructure. So if the end-user panics
and reboots the device it can still receive an IP address, come back online,
and allow the administrator to continue their investigation, and remove it from
the isolation list. In addition with Sophos Intercept Advanced and the EDR
license, a device can be allowed to go into an automatic self-isolation state.
This is a policy option that when set allows the device to break network
connections when it sees it's under attack. When it completes a remediation,
removing malware, completing a scan and determines that it is now in a healthy
state, it'll automatically restore those network connection abilities. Auto
isolation can be turned on or off at a policy level, so this can be applied to
one group of users but not another. In addition we have a device isolation
technique that's available only with the XG firewall as part of synchronized
security. This allows the firewall to identify that an endpoint is in a
compromised health state. Perhaps the endpoint has had Sophos antivirus
terminated, or it's otherwise under attack. The firewall will notify other
devices with Sophos Intercept X deployed on them, and those devices will
now refuse connections from the compromised device. This type of device
shunning allows the endpoints to be protected from rogue devices inside the
network, both inside a subnet, and for other
devices that have Sophos Intercept X deployed. I want to show each of those
options and when they should be used. So from inside a threat case, here we're
looking at a ransomware generation attack where it appears that there are
multiple components involved. We can see that ransomware was detected and blocked,
but the PowerShell that launched the attack for ransomware also delivered
additional executables. Because I'm not complete- have not completed the
investigation, one of the suggested next steps is to isolate the computer. And we
can take some notes about why we're investigating.
So with this completed the device is now going to break network connections. That
request has been sent, the end user would see a notification saying that the
device has been isolated by their administrator, and their ability to surf
the internet or reach out to other components inside the network has now
been terminated. In addition to this capability, there's a basic threat
protection capability that allows a device to do this in an automated way
when it detects that it's under attack. So in the Sophos threat protection
policy you have an option to allow this type of auto-isolation. When this is
enabled, if the endpoint to text malware that requires a deeper forensic scan, or
requires the endpoint to terminate and clean up that malware, while it's
performing those activities, the endpoint will break its network connections. And
once those activities have completed and the malware has been removed from the
device and it's back in a healthy state, it'll automatically enable network
connections to come back. Lastly we have a capability that requires the Sophos XG
firewall. And this allows the devices to actually refer
connections from other devices that the firewall has determined are unhealthy. So
if the firewall detects that a device with Sophos Intercept X Advance deployed
on it is no longer running the Sophos protection capability, it will generate
the device as a red security health risk and notify other devices in the subnet
that that device should be shunned. No connections will be allowed and active
connections will be terminated. If you had critical infrastructure that you
needed this device to still be able to talk to, you can put those devices into
an exclusion list, and then devices will refuse to shun these devices. Thank you.