Sophos Enterprise Console policy setup Setup Guide

Sophos Enterprise Console policy setup guide

Product version: 5.5

2

Contents

1 About this guide........................................................................................................................4

2 General policy recommendations.............................................................................................5

3 Setting up an updating policy...................................................................................................6

4 Setting up anti-virus and HIPS policies....................................................................................8

4.1 Recommended settings..............................................................................................8

4.2 How to roll out an anti-virus and HIPS policy..............................................................8

5 Setting up firewall policies......................................................................................................11

5.1 About the firewall policy............................................................................................11

5.2 Planning firewall policies...........................................................................................11

5.3 Recommended settings............................................................................................12

5.4 Configure the firewall for dual location......................................................................13

5.5 How to roll out a firewall policy..................................................................................14

6 Setting up application control policies....................................................................................16

6.1 Recommended settings............................................................................................16

6.2 How to roll out an application control policy..............................................................16

7 Setting up data control policies...............................................................................................18

7.1 Defining a data control policy....................................................................................18

7.2 Recommended settings............................................................................................18

7.3 How to roll out a data control policy..........................................................................20

7.4 Understanding data control scanning within applications.........................................21

8 Setting up device control policies...........................................................................................23

8.1 Recommended settings............................................................................................23

8.2 How to roll out a device control policy......................................................................24

9 Setting up tamper protection policies.....................................................................................25

9.1 About the tamper protection policy...........................................................................25

9.2 How to roll out a tamper protection policy.................................................................25

10 Setting up patch policies.......................................................................................................26

10.1 About the patch policy............................................................................................26

10.2 How to roll out a patch policy..................................................................................26

11 Setting up web control policies.............................................................................................28

11.1 Recommended settings..........................................................................................28

11.2 How to roll out a web control policy........................................................................29

12 Setting up exploit prevention policies...................................................................................31

12.1 Recommended settings..........................................................................................31

12.2 How to roll out an exploit prevention policy.............................................................31

13 Scanning recommendations.................................................................................................33

14 Using on-access scans.........................................................................................................34

15 Using scheduled scans.........................................................................................................35

16 Using on-demand scans ......................................................................................................36

17 Excluding items from scanning.............................................................................................37

18 Technical support..................................................................................................................38

19 Legal notices........................................................................................................................39

3

4

Sophos Enterprise Console

1 About this guide

This guide describes the policy setup guidelines for Sophos Enterprise Console and Sophos

Endpoint Security and Control software.

Note: Some features will be unavailable if your license does not include them.

In particular, it provides advice to help you:

■

■

■

■

Understand policy recommendations.

Set up and roll out each policy by type.

Use scanning options to discover items.

Determine what items to exclude from scanning.

This guide is for you if:

■ You are using Enterprise Console.

■ You want advice on the best options for policy setup and rollout.

See the Sophos Enterprise Console quick startup guide prior to reviewing this guide.

All Enterprise Console documents are available at http://www.sophos.com/en-us/support/documentation/enterprise-console.aspx

.

policy setup guide

2 General policy recommendations

When you install Enterprise Console, default policies are created for you. These policies are applied to any groups you create. The default policies are designed to provide effective levels of protection. If you want to use features like network access control, patch, application control, data control, device control, or tamper protection, you need to create new policies or change the default policies. When setting up policies, consider the following:

■

■

Use default settings within a policy when possible.

Consider the role of the computer when changing default policy settings or creating new policies

(e.g. desktop or server).

■

■

■

Use Enterprise Console for all central policy settings, and set options in Enterprise Console instead of on the computer itself when possible.

Set options on the computer itself only when requiring temporary configuration for that computer or for items that cannot be configured centrally, such as advanced scanning options.

Create a separate group and policy for computers that require long-term special configuration.

5

Sophos Enterprise Console

6

3 Setting up an updating policy

The updating policy specifies how computers receive new threat definitions and updates to Sophos software. A software subscription specifies which versions of endpoint software are downloaded from Sophos for each platform. The default updating policy enables you to install and update the software specified in the "Recommended" subscription. When setting up your updating policy, consider the following:

■ You should normally subscribe to the "Recommended" versions of the software to ensure that it is kept up to date automatically. However, if you want to evaluate new versions of the software before placing them on your main network, you may want to consider using fixed versions of the software on the main network while evaluating the new versions. Fixed versions are updated with new threat detection data, but not with the latest software version each month.

■ Ensure that the number of groups using the same updating policy is manageable. You should normally have no more than 1,000 computers updating from the same location. The optimum number updating from the same location is 600-700.

Note: The number of computers that can update from the same directory depends on the server holding that directory and on the network connectivity.

■ By default, computers update from a single primary location. However, we recommend that you also always set up an alternative secondary location for updates. If endpoint computers cannot contact their primary location, they will attempt to update from their secondary location if set. For more information, see the Sophos Enterprise Console help, Updating computers >

Configuring the updating policy section.

■ You should allow location roaming on an updating policy for laptop users who roam extensively or internationally within an organization. When this option is enabled, roaming laptops will attempt to locate and update from the nearest location by querying fixed endpoints on the same local network they are connected to, which minimizes update delays and bandwidth costs. If multiple locations are returned, the laptop determines which is nearest and uses that location. If none work, the laptop uses the primary (then secondary) location defined in its updating policy.

Location roaming will only work if both roaming laptops and fixed endpoints are managed by the same Enterprise Console instance and use the same software subscription. Any third-party firewalls must be configured to allow update location queries and responses. The port used by default is 51235, but it can be changed.

For more information, see the Sophos Enterprise Console help, Updating computers >

Configuring the updating policy > Configuring update server locations section. For frequently asked questions about location roaming, see Sophos support knowledgebase article 112830

( http://www.sophos.com/en-us/support/knowledgebase/112830.aspx

).

■ If you are concerned about performance on low specification computers, you can subscribe to a fixed version of the software and manually change the software subscription when you are ready to update the software for those computers. This option will ensure that those computers are updated with new threat detection data. Alternatively, you can perform updates for low specification computers less often (such as two or three times daily) or consider updating at select times outside of typical user hours (such as during evenings or on weekends).

Caution: Be aware that minimizing updates increases security risk.

policy setup guide

7

8

Sophos Enterprise Console

4 Setting up anti-virus and HIPS policies

4.1 Recommended settings

The anti-virus and HIPS policy specifies how the security software scans computers for viruses,

Trojans, worms, spyware, adware, potentially unwanted applications (PUAs), suspicious behavior, and suspicious files, and how it cleans them up. When setting up your anti-virus and HIPS policy, consider the following:

■

■

The default anti-virus and HIPS policy will protect computers against viruses and other malware.

However, you may want to create new policies, or change the default policy, to enable detection of other unwanted applications or behavior.

To take full advantage of Sophos Live Protection, which is enabled by default, we recommend also selecting the Automatically send sample files to Sophos option.

■ Enable Malicious Traffic Detection, which detects communications between endpoint computers and command and control servers involved in botnet or other malware attacks. The Detect

malicious traffic option is enabled by default for new installations of Enterprise Console 5.3

or later. If have upgraded from an earlier version of Enterprise Console, you need to enable this option to benefit from the feature.

Note: Malicious traffic detection is currently supported only on Windows 7 and later non-server operating systems. It requires Sophos Live Protection.

■ Use the Alert only option to only detect suspicious behavior. Initially defining a report only policy enables you to gain a better view of suspicious behavior across your network. This option is enabled by default and should be deselected once policy rollout is complete to block programs and files.

For more information, see Sophos support knowledgebase article 114345

( http://www.sophos.com/en-us/support/knowledgebase/114345.aspx

).

4.2 How to roll out an anti-virus and HIPS policy

We recommend that you roll out anti-virus and HIPS policy as follows:

1. Create different policies for different groups.

2. Set Sophos Live Protection options. This feature delivers the most up-to-date threat protection by using the Sophos online lookup service to instantly decide whether a suspicious file is a

policy setup guide threat and to update your Sophos software in real time. Sophos Live Protection is required by the Malicious Traffic Detection and Download Reputation features.

■ Make sure that the Enable Live Protection for on-access scanning and Enable Live

Protection for on-demand scanning options are selected. If the anti-virus scan on an endpoint computer has identified a file as suspicious, but cannot further identify it as either clean or malicious based on the threat identity (IDE) files stored on the computer, certain file's characteristics (such as its checksum and other attributes) are sent to Sophos to assist with further analysis. The Sophos online lookup service performs an instant lookup of a suspicious file in the SophosLabs database. If the file is identified as clean or malicious, the decision is sent back to the computer and the status of the file is automatically updated.

■ Select the Automatically send sample files to Sophos option. If a file is deemed potentially malicious but cannot be positively identified as malicious based on the file characteristics alone, Sophos Live Protection allows Sophos to request a sample of the file. When Live

Protection is enabled, if the Automatically send sample files to Sophos option is enabled and Sophos does not already hold a sample of the file, the file will be submitted automatically. Submission of such file samples helps Sophos to continuously enhance detection of malware without the risk of false positives.

Important: You must ensure that the Sophos domain to which the file data is sent is trusted in your web filtering solution. For details, see Sophos support knowledgebase article 62637

( http://www.sophos.com/en-us/support/knowledgebase/62637.aspx

). If you use a Sophos web filtering solution, such as the WS1000 Web Appliance, you do not need to do anything. Sophos domains are already trusted.

3. Detect viruses and spyware.

a) Ensure that on-access scanning is enabled or schedule a full system scan to detect viruses

and spyware. On-access scanning is enabled by default. For more information, see Using on-access scans (page 34) or

Using scheduled scans

(page 35).

b) Select cleanup options for viruses/spyware.

4. Detect suspicious files.

Suspicious files contain certain characteristics that are common to malware but not sufficient for the file to be identified as a new piece of malware.

a) Enable on-access scanning or schedule a full system scan to detect suspicious files.

b) Select the Suspicious files option in the scanning settings.

c) Select cleanup options for suspicious files.

d) As appropriate, authorize any files that are allowed to run.

5. Detect malicious and suspicious behavior, buffer overflows, and malicious traffic (behavior monitoring).

9

Sophos Enterprise Console

These options monitor running processes continuously to determine if a program exhibits malicious or suspicious behavior. They are useful for stopping security flaws.

a) Ensure that behavior monitoring for on-access scanning is enabled. It is enabled by default.

b) Ensure that the Detect malicious traffic option is selected.

c) Use the Alert only option to only detect suspicious behavior and buffer overflows. This option is enabled by default.

d) Authorize any programs or files you want to continue to run in the future.

e) Configure your policy to block programs and files that are detected by clearing the Alert

only option.

This approach avoids blocking programs and files that your users may need. For more information, see Sophos support knowledgebase article 50160

( http://www.sophos.com/en-us/support/knowledgebase/50160.aspx

).

6. Detect adware and PUAs.

When you first scan for adware and PUAs, the scan may generate large numbers of alerts for applications that are already running on your network. By initially running a scheduled scan, you can deal safely with applications that are already running on your network.

a) Schedule a full system scan to detect all adware and PUAs.

b) Authorize or uninstall any applications that are detected by the scan.

c) Select the Adware and PUAs on-access scanning option to detect future adware and

PUAs.

For more information, see Sophos support knowledgebase article 13815

( http://www.sophos.com/en-us/support/knowledgebase/13815.aspx

).

7. Detect threats in web pages.

This option blocks sites that are known to host malicious content and scans downloads for malicious content.

a) Ensure that the Block access to malicious websites option is set to On to ensure that malicious websites are blocked. This option is turned on by default.

b) Set the Content scanning option to On or As on access to scan and block malicious downloaded data. As on access, which is the default setting, enables download scanning only when on-access scanning is enabled.

c) As appropriate, authorize any websites that are allowed.

d) Ensure that file reputation checking is enabled.

Note: In addition, you can use the web control policy to control user web surfing by filtering the websites in the top 14 most inappropriate site categories. For information on how to set

up a web control policy, see Setting up web control policies (page 28).

For more information about setting up anti-virus and HIPS policies, see the Sophos Enterprise

Console help.

10

policy setup guide

5 Setting up firewall policies

5.1 About the firewall policy

The firewall policy specifies how the firewall protects computers. Only named applications, or classes of applications are allowed to access the company network or internet.

Note: Sophos Client Firewall is not supported on server operating systems. For hardware and operating system requirements, see the system requirements page of the Sophos website

( http://www.sophos.com/en-us/products/all-system-requirements ).

Caution: You must configure the firewall policy before use. Deploying an unmodified default policy to a group via Enterprise Console will cause problems with network communications.

The default firewall policy is not intended to be deployed "as is" and is not adequate for normal use. This is a base for you to build up your own policy.

By default, the firewall is enabled and blocks all non-essential network traffic. Anything more than basic networking, for example, your email software, web browser and any network database access, will probably not function correctly with the default policy which blocks all non-essential connections. Therefore, you should configure it to allow the traffic, applications, and processes you want to use, and test it prior to installing and running the firewall on all computers.

5.2 Planning firewall policies

Plan your firewall policies and what you want them to do before creating or editing firewall rules

(global, application, or other).

When planning your firewall policies, you should take into account:

■ Which computers should have Sophos Client Firewall.

■

■

■

■

Whether a computer is a desktop or a laptop. You may want to set up dual location for laptops.

Which location detection method you want to use, that is, DNS lookup or gateway MAC address detection.

Network-wide systems and protocols.

Remote connections.

Based on applications and network access rights required by different groups of users, decide how many firewall policies you will need to create. The policies would cover different applications, and vary in restrictiveness. Remember that multiple policies require multiple groups in Enterprise

Console.

■ You should not use just one Sophos Client Firewall policy. You would be forced to add rules for only one or two computers (for example, the administrator's workstation), but these rules would be present over the whole network. This is a security risk.

11

Sophos Enterprise Console

■ Conversely, using large numbers of configurations will mean extra time spent on monitoring and maintenance.

Network-wide systems and protocols

Take into account the services that your network relies upon. For example:

■ DHCP

■

■

DNS

RIP

■

■

NTP

GRE

Rules exist in the default firewall configuration to govern most of these services. However, be aware of those that you should allow, and those that you don't need.

Remote access to computers

If you use remote access software to monitor and fix computers, you must build rules into your configuration to enable you to work this way.

Identify the technologies that you use to access the computers on your network. For example:

■ RDP

■

■

■

■

VPN client/server

SSH/SCP

Terminal services

Citrix

Check what sort of access is needed, and create your rules accordingly.

5.3 Recommended settings

When setting up your firewall policy, consider the following:

■

■

When Sophos Client Firewall is installed, Windows Firewall is turned off. Therefore, if you were using the Windows Firewall, make a note of existing configurations and move them to Sophos

Client Firewall.

Use the Allow by default mode to detect but not block traffic, applications, and processes.

Initially defining a report-only policy enables you to gain a better view of network activity.

■

■

Use the firewall Event Viewer to view which traffic, applications, and processes are being used.

The Event Viewer also allows you to easily create rules that allow or block reported traffic, applications, and processes. You can access the Event Viewer by clicking Events > Firewall

Events.

Review the rules created via the Event Viewer. An application may trigger multiple firewall events—different events for different actions performed by the application—but an application

12

policy setup guide

■

■

■

■

■ rule must cover all application actions. For example, an email client may trigger two different events when sending email and receiving email, but an application rule for that client must deal with both these actions.

Allow the use of a web browser, email, file and printer sharing.

We recommend that you do not change the default ICMP settings, global rules, and application rules unless you are knowledgeable about networking.

We recommend that you create application rules rather than global rules whenever possible.

Do not use the Interactive mode in a policy in which dual location is set up.

Do not use the Interactive mode on large or medium-sized networks and in domain environments.The Interactive mode may be used to create firewall rules on very small networks

(for example, up to 10 computers) in workgroup environments and on standalone computers.

5.4 Configure the firewall for dual location

The single location option is intended for computers that are always on a single network, such as desktops. The dual location option is available if you want the firewall to use different settings according to the location where computers are used, such as in the office and out of the office.

You may want to set up dual location for laptops.

If you select dual location, we recommend you set up primary and secondary location configuration options as follows:

■ Set up your primary location to be the network you control (e.g. office network) and your secondary location to be locations outside of your control.

■

■

Set up your primary location to have more open access and your secondary location to have more restricted access.

When configuring your primary location detection options, we generally recommend DNS detection for larger, more complicated networks and gateway detection for smaller, simpler ones. DNS detection requires a DNS server, but is typically easier to maintain than gateway detection. If hardware used for gateway detection fails, reconfiguration of MAC addresses is necessary and computers may incorrectly receive the secondary location configuration until the hardware configuration issues are resolved.

■

■

If you use DNS detection, we recommend that you add a specific DNS entry to your DNS server that has an unusual name and returns a localhost IP address, also called a loopback address (i.e. 127.x.x.x). These options make it highly unlikely that some other network you connect to is incorrectly detected as your primary network.

In the advanced firewall policy configuration, on the General tab, under Applied location, select the firewall configuration you want to apply to the computer. If you want the configuration applied to be dependent upon the computer's location, select the Apply the configuration

for the detected location option. If you want to manually apply either the primary or secondary configuration, select the appropriate option.

Caution: We strongly advise caution when using local subnet rules as part of secondary configurations. If the computer is a laptop, and it is used out of the office, it may connect to an unknown subnet. If this happens, firewall rules in the secondary configuration that use the local subnet as an address may inadvertently allow unknown traffic.

13

Sophos Enterprise Console

5.5 How to roll out a firewall policy

Roll out a policy which allows you to monitor all traffic that is passing throughout your network.

You will receive traffic reports in the Firewall Event Viewer. Use this information to set up a basic policy.

You should run a phased rollout of the Sophos Client Firewall across your network, that is, roll out Sophos Client Firewall to one group at a time. This will avoid flooding your network with traffic in the initial stages.

Caution: Do not deploy across your entire network until the configuration has been thoroughly checked and tested.

1. Deploy Sophos Client Firewall to a test group of computers, which is representative of the various roles in your network.

2. Configure a firewall policy to use the Allow by default mode to detect but not block common traffic, applications and processes, and assign the policy to the test group.

a) Create a new firewall policy. In Enterprise Console, in the Policies pane, right-click Firewall and select Create Policy. Give this policy a name, and then double-click it.

The Firewall Policy wizard appears.

b) Choose either to use the wizard, by clicking Next, or to configure the policy manually, by clicking Advanced firewall policy.

■ Using the wizard: Click Next. Select Single location and click Next. Select Monitor, click Next, and then Next again, and then Finish.

■ Using the Advanced firewall policy option: In the Firewall Policy dialog box, next to

Primary location, click Configure. On the General tab, set the working mode to Allow

by default. Click OK, and then OK again.

c) Assign the new firewall policy to the test group.

3. Use the Firewall Event Viewer to view which traffic, applications, and processes are being used. The Event Viewer also allows you to easily create rules that allow or block reported traffic, applications, and processes. You can access the Event Viewer by clicking Events >

Firewall Events.

4. Monitor firewall events and build up your policy for some time, for example, over a couple of weeks.

a) Create rules from the Event Viewer. Right-click on an event to create a rule for it. For more information about creating firewall rules, see the Sophos Enterprise Console help,

Configuring policies > Firewall policy section.

b) Check for any weaknesses in the policy (for example, giving too much access to some users).

c) Where needs differ, subdivide the group and create extra policies and rules as needed.

14

policy setup guide

5. Review the rules created via the Event Viewer. An application may trigger multiple firewall events—different events for different actions performed by the application—but an application rule must cover all application actions. For example, an email client may trigger two different events when sending email and receiving email, but an application rule for that client must deal with both these actions.

6. Split the rest of your network into manageable groups, representative of the various roles in your network, for example, sales workstations, IT administrator workstations, and so on.

7. Once you are satisfied that you have covered everything, for example, when you are no longer getting many new firewall events for which there are no rules, create policies from your rules and assign them as required. If you have a significant number of computers on your network, we recommend that you deploy Sophos Client Firewall to one group at a time.

8. Once you've tested the rules, change the policy mode to Block by default; otherwise, computers will remain insecure.

For more information on setting up firewall policy, see the Sophos Enterprise Console help,

Configuring policies > Firewall policy section.

Note: As an alternative to monitoring network traffic and creating rules using the Firewall Event

Viewer, on a very small network or on single standalone computers running Windows 7 or earlier, you can install Sophos Client Firewall on a test computer and configure it in Interactive mode.

Run as many applications used on your network as possible, including web browsers. Then import and edit the firewall configuration containing rules established by that process. For more information, see the Sophos Endpoint Security and Control help.

15

Sophos Enterprise Console

6 Setting up application control policies

6.1 Recommended settings

The application control policy specifies which applications are blocked and which are allowed on your computers. When setting up your application control policy, consider the following:

■ Use the Detect but allow to run option to detect but not block controlled applications. Initially defining a report only policy enables you to gain a better view of application use across your network.

■

■

■

Use the application control Event Viewer to audit application use within your company. You can access the Event Viewer by clicking Events > Application Control Events.

Use the Report Manager to create trend reports on application control events by computer or user.

Consider using the "All added by Sophos in the future" option to block all new applications of a specific type that Sophos adds so that you do not have to constantly update your policy. For example, if you currently block all instant messaging applications, you may consider blocking all new instant messaging applications.

6.2 How to roll out an application control policy

By default, all applications and application types are allowed. We recommend that you introduce application control as follows:

1. Consider which applications you want to control.

2. Enable on-access scanning, and select the Detect but allow to run option to detect but not block controlled applications.

At this time, you have one application control policy for your entire network.

3. Use the application control Event Viewer to view which applications are being used, and determine the applications or application types that you want to block. You can access the

Event Viewer by clicking Events > Application Control Events.

4. To grant access to applications differently for various computer groups, create different policies for different groups. For example, you may not want to allow VoIP for office-based desktop computers, but you may want to authorize its use for remote computers.

5. Determine which applications or application types you want to block and move them to the

Blocked list.

6. Configure your policy to block controlled applications that are detected by clearing the Detect

but allow to run option.

By taking this approach, you avoid generating large numbers of alerts and blocking applications that your users may need. For more information on setting up application control policy, see the

Sophos Enterprise Console help.

16

policy setup guide

Note: Application Control can be configured to block CScript.exe that is used by Patch. If you use both Application Control and Patch, ensure that you do not block Microsoft WSH CScript in the Programming/Scripting tool category. By default, programming and scripting tools are allowed.

17

Sophos Enterprise Console

7 Setting up data control policies

7.1 Defining a data control policy

The data control policy enables you to manage the risks associated with the accidental transfer of sensitive data from computers.

Each company will have its own definition of sensitive data. Common examples include:

■ Customer records containing personally identifiable information.

■

■

Financial data such as credit card numbers.

Confidential documents.

When the data control policy is enabled, Sophos monitors user actions at common data exit points:

■ Transfer of files onto storage devices (removable storage, optical media, and disk-based media).

■ Upload of files into applications (corporate web browsers, email clients, and IM clients).

A data control rule is made up of three elements:

■

■

Items to match: Options include file content, file types, and file names.

Points to monitor: Monitoring points include storage types and applications.

■ Actions to take: Available actions include "Allow file transfer and log event" (monitor mode),

"Allow transfer on acceptance by user and log event" (training mode), and "Block transfer and log event" (restricted mode).

For example, data control rules can be defined to log the uploading of any spreadsheet using

Internet Explorer or to allow for the transfer of customer addresses onto a DVD once the transfer is confirmed by the user.

Defining sensitive data based on content can be complex. Sophos has simplified this task by providing a pre-built library of sensitive data definitions, known as Content Control Lists. The library covers a wide range of personally identifiable and financial data formats and is kept up-to-date by Sophos. As necessary, you can also define custom Content Control Lists.

As with all Sophos policies, the data control policy continues to be enforced on computers even when they are disconnected from your company's network.

7.2 Recommended settings

When setting up your data control policy, consider the following:

■ Use the Allow file transfer and log event action to detect but not block controlled data. Initially defining a report only policy enables you to gain a better view of data use across your network.

18

policy setup guide

■

■

Use the Allow transfer on acceptance by user and log event action to alert users about the risks of transferring documents that potentially contain sensitive data. This approach can reduce the risk of data loss without a significant impact on IT operations.

Use the "quantity" setting within content rules to configure the volume of sensitive data you want to find before a rule is triggered. For example, a rule that is configured to look for one postal address within a document will generate more data control events than a rule looking for 50 or more addresses.

Note: Sophos provides default quantity settings for each Content Control List.

■

■

■

■

Use the data control Event Viewer to quickly filter events for investigation. All data control events and actions are logged centrally in Enterprise Console. You can access the Event

Viewer by clicking Events > Data Control Events.

Use the Report Manager to create trend reports on data control events by rules, computers, or users.

Use the custom desktop messaging options to provide users with additional guidance when an action is triggered. For example, you could provide a link to your company's data security policy.

Use the verbose logging mode to gather additional detail on the accuracy of data control rules.

Once the evaluation of these rules is complete, disable verbose logging.

Note: Verbose logging must be activated on each computer. All data generated is stored in the computer's local data control log. When the verbose logging mode is active, all strings contained in each file that match the data specified in a rule are logged. The additional detail within the log can be used to identify phrases or strings within a document that triggered a data control event.

19

Sophos Enterprise Console

20

7.3 How to roll out a data control policy

By default, data control is turned off and no rules are specified to monitor or restrict the transfer of files onto storage devices or into applications. We recommend that you introduce data control as follows:

1. Understand how data control works on your computers:

■ Storage devices: Data control intercepts all files copied onto monitored storage devices using Windows Explorer (this includes the Windows desktop). However, direct saves from within applications, such as Microsoft Word, or transfers made using the command prompt are not intercepted.

It is possible to force all transfers onto monitored storage devices to be made using Windows

Explorer by using either the "Allow transfer on acceptance by user and log event" action or the "Block transfer and log event" action. In either case, any attempt to save directly from within an application or transfer files using the command prompt are blocked by data control, and a desktop alert is displayed to the user requesting that they use Windows

Explorer to complete the transfer.

When a data control policy only contains rules with the "Allow file transfer and log event" action, direct saves from within applications and transfers using the command prompt are not intercepted. This behavior enables users to use storage devices without any restrictions.

However, data control events are still only logged for transfers made using Windows

Explorer.

Note: This restriction does not apply to application monitoring.

■ Applications: Data control intercepts files and documents uploaded into monitored applications. To ensure only file uploads by users are monitored, some system file locations are excluded from data control monitoring. For more information on the content or actions within applications that are scanned or not scanned, see

Understanding data control scanning within applications

(page 21).

Note: If you are monitoring e-mail clients, data control scans all file attachments but does not scan e-mail content. The Sophos Email Security and Data Protection solution can be used if scanning email content is required.

2. Consider what types of information you want to identify and create rules for. Sophos provides a set of sample rules that you can use to help build your data control policy.

Important: Content scanning can be an intensive process and this should be taken into consideration when creating content rules. It is important to test the impact of a content rule prior to rolling it out across a large number of computers.

Note: When creating your first policy, we recommend focusing on the detection of large collections of personally identifiable information within documents. Sophos provides sample rules to meet this requirement.

3. Enable data control scanning, and select the Allow file transfer and log event action in your rules to detect but not block controlled data.

Important: We recommend that you configure all rules to use this action for the initial deployment. This will enable you to assess the effectiveness of the rules without impacting user productivity.

policy setup guide

4. Deploy your data control policy to a small number of computers to make it easier to analyze data control events triggered by the policy.

5. Use the data control Event Viewer to view data being used, check for any weaknesses in the test configuration (e.g. a rule being too sensitive and generating a higher than anticipated volume of events). You can access the Event Viewer by clicking Events > Data Control

Events.

6. Once the policy has been tested, you can make any required adjustments and roll it out to a larger set of computers within your company. At this stage, you may decide to:

■

■

Change the actions for some rules as necessary to Allow transfer on acceptance by

user and log event or Block transfer and log event.

Create different policies for different groups. For example, you may want to allow computers within the human resources department to transfer personally identifiable information, but prevent all other groups from doing so.

For more information on setting up data control policy, see the Sophos Enterprise Console help.

7.4 Understanding data control scanning within applications

The following is a list of the content or actions that are scanned or not scanned within supported applications.

For a complete list of known limitations with data control, see Sophos support knowledgebase article 63016 ( http://www.sophos.com/en-us/support/knowledgebase/63016.aspx

).

Applications

Web browsers

Email clients

Data Control Scanning Actions

Scanned:

File uploads

Webmail attachments

Microsoft SharePoint uploads

Not scanned

Webmail message content

Blog entries

File downloads

Note: In a small number of cases, files may be scanned when downloaded.

Scanned

Email attachments

Not scanned

Email message content

Forwarded attachments

21

Sophos Enterprise Console

Applications Data Control Scanning Actions

Attachments made using the "Send" email option within applications

(e.g. Windows Explorer and Microsoft Office)

Attachments using the "E-mail this file" option within Windows

Explorer

Attachments copied from one email to another email

Saved attachments

Note: In a small number of cases, files may be scanned when saved.

Instant messaging (IM) clients

Scanned

File transfers

Note: A file may be scanned twice: once upon upload to the IM client and again upon acceptance by the recipient. Both scans occur on the sender's computer.

Not scanned

IM message content

Sent files

22

policy setup guide

8 Setting up device control policies

8.1 Recommended settings

The device control policy specifies which storage and networking devices are authorized for use on computers. When setting up your device control policy, consider the following:

■ Use the Detect but do not block devices option to detect but not block controlled devices.

To do this, you must first set the status to Blocked for each device type you want to detect.

The software will not scan for any device types you have not specified. Initially defining a report only policy enables you to gain a better view of device use across your network.

■

■

■

■

Use the device control Event Viewer to quickly filter block events for investigation. You can access the Event Viewer by clicking Events > Device Control Events.

Use the Report Manager to create trend reports on device control events by computer or user.

Consider providing tighter access control for computers of users with access to sensitive information.

Plan a list of device exemptions prior to rolling out a policy that blocks devices. For example, you may want to allow the use of optical drives within the art team.

■

■

■

■

The "Secure Removable Storage" category can be used to automatically authorize hardware-encrypted USB storage devices from various supported vendors. A full list of supported vendors is available on the Sophos website. For a list of supported secure removable storage devices, see Sophos support knowledgebase article 63102

( http://www.sophos.com/en-us/support/knowledgebase/63102.aspx

).

When adding device exemptions to the device control policy, identify the reason for a device exemption or who requested it in the Comment field.

Use the custom desktop messaging options to provide users with additional guidance when a controlled device is discovered. For example, you could provide a link to your company's device use policy.

If you want a network device to become enabled (i.e. Wi-Fi adapters) when the computer is physically disconnected from the network, select the Block bridged option when setting access levels for network devices.

Note: The Block bridged mode significantly reduces the risk of network bridging between a corporate network and a non-corporate network. The mode is available for both wireless and modem types of devices. The mode works by disabling either wireless or modem network adapters when an endpoint is connected to a physical network (typically through an Ethernet connection). Once the endpoint is disconnected from the physical network, the wireless or modem network adapters are seamlessly re-enabled.

■ Ensure you are certain about blocking a device prior to rolling out your policy. Be aware of all users scenarios, especially in relation to WiFi and network devices.

23

Sophos Enterprise Console

Caution: Policy changes are made from the Enterprise Console server to the computer through the network; therefore, once the network is blocked, it cannot be unblocked from

Enterprise Console since the computer cannot accept additional configuration from the server.

8.2 How to roll out a device control policy

By default, device control is turned off and all devices are allowed. We recommend that you introduce device control as follows:

1. Consider which devices you want to control.

2. Enable device control scanning, and select the Detect but do not block devices option to detect but not block controlled devices. To do this, you must first set the status to Blocked for each device type you want to detect. The software will not scan for any device types you have not specified.

At this time, you have one device control policy for your entire network.

3. Use the device control Event Viewer to view which devices are being used, and determine the device types that you want to block. You can access the Event Viewer by clicking Events >

Device Control Events.

4. To grant access to devices differently for various computer groups, create different policies for different groups. For example, you may not want to allow removable storage devices for human resources and finance departments, but allowing them for IT and sales departments is acceptable.

5. Exempt the instances or model types that you do not want to block. For example, you can exempt a specific USB key (instance) or all Vodafone 3G modems (model type).

6. Determine which devices you want to block and change their status to Blocked. You can also allow read-only access to certain storage devices.

7. Configure your policy to block controlled devices that are detected by clearing the Detect but

do not block devices option.

By taking this approach, you avoid generating large numbers of alerts and blocking devices that your users may need. For more information on setting up device control policy, see the Sophos

Enterprise Console help.

24

policy setup guide

9 Setting up tamper protection policies

9.1 About the tamper protection policy

Tamper protection enables you to prevent users (local administrators with limited technical knowledge) from reconfiguring, disabling, or uninstalling Sophos security software. Users who do not know the tamper protection password cannot perform these operations.

Note: Tamper protection is not designed to protect against users with extensive technical knowledge. It will not protect against malware which has been specifically designed to subvert the operation of the operating system to avoid detection. This type of malware will only be detected

by scanning for threats and suspicious behavior. For more information, see Setting up anti-virus and HIPS policies (page 8).

After you enable tamper protection and create a tamper protection password, a user who does not know the password will not be able to reconfigure on-access scanning or suspicious behavior detections in Sophos Endpoint Security and Control, disable tamper protection, or uninstall Sophos

Endpoint Security and Control components (such as Sophos Anti-Virus, Sophos Client Firewall,

Sophos AutoUpdate, or Sophos Remote Management System) from Control Panel.

When setting up your tamper protection policy, consider the following:

■ Use the tamper protection Event Viewer to audit tamper protection password use and to monitor the rate of tamper attempts in your company. You can view both successful tamper protection authentication events (authorized users overriding tamper protection) and failed attempts to tamper with Sophos security software. You can access the Event Viewer by clicking Events

> Tamper Protection Events.

9.2 How to roll out a tamper protection policy

By default, tamper protection is disabled. We recommend that you introduce tamper protection as follows:

1. Enable tamper protection and create a secure tamper protection password.

The password allows only authorized endpoint users to re-configure, disable, or uninstall

Sophos security software.

Note: Tamper protection does not affect members of the SophosUser and SophosPowerUser groups. When tamper protection is enabled, these users can still perform all tasks that they are usually authorized to perform, without the need to enter the tamper protection password.

2. If you require the ability to enable or disable tamper protection or create different passwords for various groups, create different policies for different groups.

For more information on setting up tamper protection policy, see the Sophos Enterprise Console help.

25

Sophos Enterprise Console

26

10 Setting up patch policies

Note: This feature is not included with all licenses. If you want to use it, you might need to customize your license. For more information, see https://www.sophos.com/en-us/products/endpoint-antivirus/how-to-buy.aspx

.

10.1 About the patch policy

The patch policy allows you to check that your computers have the most up-to-date security patches installed.

SophosLabs provides ratings that help you determine the most critical security patch issues so that you can resolve them quickly. SophosLabs ratings take the latest exploits into account and therefore may differ from a vendor's severity level.

When setting up your patch policy, consider using the patch assessment Event Viewer to audit missing patches on your company's computers. It contains information about security patches and results of patch assessments. You can view patch status by computer, group, or threat after you have enabled patch assessment in the patch policy. You can access the Event Viewer by clicking Events > Patch Assessment Events.

Note: Patch uses CScript.exe which can be blocked using Application Control. If you use both

Application Control and Patch, ensure that you do not block Microsoft WSH CScript in the

Programming/Scripting tool category in the Application control policy. By default, programming and scripting tools are allowed by Application control.

10.2 How to roll out a patch policy

Initially, the "Default" patch policy is applied to all computers. Patch assessment is disabled in the default policy.

Once patch assessment is enabled, computers begin an assessment. This can take several minutes. Subsequent assessments occur at the interval set in policy, which is daily by default.

Note: If computers run an assessment before Enterprise Console has downloaded patch data from Sophos for the first time, the Patch Event viewer displays no results. The download can take several hours. To check if this has completed, see the Patch updates field in the Patch

Assessment - Event Viewer.

We recommend that you introduce patch policy as follows:

1. Deploy the patch agent to computers using the Protect Computers Wizard. (On the Select

features page of the wizard, select Patch.)

Note: You must reprotect computers by running the Protect Computers Wizard if they are already running Endpoint Security and Control but do not have the patch agent installed.

2. Enable patch assessments in your default patch policy.

At this time, you have one patch policy for your entire network.

policy setup guide

3. Use the patch assessment Event Viewer to view which computers are missing patches and which are up-to-date. You can access the Event Viewer by clicking Events > Patch

Assessment Events.

Note: You must install missing patches on computers manually.

4. If you require the ability to enable or disable patch policy or assign different patch assessment intervals for various groups, create different policies for different groups.

For more information on setting up patch policy, see the Sophos Enterprise Console help.

27

Sophos Enterprise Console

11 Setting up web control policies

Note: This feature is not included with all licenses. If you want to use it, you might need to customize your license. For more information, see https://www.sophos.com/en-us/products/endpoint-antivirus/how-to-buy.aspx

.

The web control policy specifies the websites that users can access through their web browsers.

By default, web control is turned off and users can browse to any site that is not restricted as part of Enterprise Console's Web protection. You can use the Inappropriate Website Control policy or the Full Web Control policy. Both are covered in the sections that follow.

11.1 Recommended settings

There are two polices to choose from when configuring web control: Inappropriate Website Control and Full Web Control. The recommendations differ, depending on which policy you select. When setting up your web control policy, consider the following:

Inappropriate Website Control

■

■

■

Review the action for each website category, and make adjustments to suit your organization or group. To grant web access differently for various computer groups, create different policies for different groups. For example, there may be websites, such as Facebook, that you want to make available only to the human resources department.

Plan a list of website exemptions prior to rolling out a policy. You can manually enter websites that you want to exclude from the policy using the Website Exceptions tab. For example, you may have a series of local web addresses that do not require filtering, or you may want to block websites within a category that is otherwise allowed.

Use the web control Event Viewer to quickly filter events for investigation. You can access the

Event Viewer by clicking Events > Web Events. You may want to adjust the website category settings, based on the actions displayed.

Full Web Control

Important: You must have a Sophos Web Appliance or Security Management Appliance to use the Full Web Control policy.

■ The Sophos Web Appliance Configuration Guide and the Security Management Appliance

Configuration Guide contain general guidelines for setting up your appliance. The appliance provides a setup wizard to assist you in choosing the settings that are best for your organization.

■ You may want to configure different policies for different types of users. See the Web Appliance online product documentation for details.

The Sophos Web Appliance documentation is available at http://wsa.sophos.com/docs/wsa/ .

28

policy setup guide

■

■

Prior to rolling out a policy, plan for any exceptions to the web control policy. For example, you can use the "Special Hours" feature to grant some or all access to certain websites outside of regular working hours, such as during the lunch hour. You can also create "Additional

Polices" that only apply to certain users, and are exceptions to the Default Policy and the

Special Hours policy.

Consider what action (if any) that you want the Web Appliance to take if information for a website cannot be categorized. The check box Block browsing if the website category

cannot be determined is not selected by default. This means that users are allowed to continue browsing if the categorization service fails. When the check box is selected, URLs that cannot be categorized are blocked until the service is restored.

For more information, see the Sophos Enterprise Console and Sophos Web Appliance documentation.

11.2 How to roll out a web control policy

First, decide which mode of web filtering to use: Inappropriate Website Control or Full Web Control.

You must have a Sophos Web Appliance or Security Management Appliance to deploy the Full

Web Control policy.

For more information on setting up a web control policy, see the Sophos Enterprise Console help.

11.2.1 How to roll out an inappropriate website control policy

This basic web control option includes 14 essential website categories. It is designed to protect users from visiting inappropriate websites. Consider the following when implementing a web control policy. See the Enterprise Console documentation for specific instructions.

1. Ensure that the web control policy is enabled.

2. If your organization has an acceptable use policy, you should tailor the settings accordingly, thus preventing users from visiting any sites that could be deemed inappropriate.

3. To grant access to websites differently for various computer groups, create a different policy for each group.

4. Think about which computer groups will be subject to web control, and what type of policy is suitable for each group of machines.

5. View the default action for each website category. If you prefer to apply a different action, select it from the drop-down list. Consider which categories you want to block users from visiting, which categories will be accessible, and which categories you want to warn users about visiting.

6. Determine which websites you want to exempt from filtering, and add them to the Websites

to Allow list or Websites to Block list.

Note: If there are conflicting or overlapping entries in the 'Block' and 'Allow' lists, the entries in the Block list will always take precedence. For example, if the same IP address is included in the Block list and the Allow list, the website is blocked. Furthermore, if a domain is included in the Block list, but a subdomain of that same domain is included in the Allow list, the Allow entry is ignored, and the domain and all of its subdomains are blocked.

29

Sophos Enterprise Console

7. Use the web control Event Viewer to examine filtering results. You can access the Event

Viewer by clicking Events > Web Events. Use the Event Viewer to see web events. You may want to make adjustments, based on these results.

For more information, see the Enterprise Console documentation.

11.2.2 How to roll out a Full Web Control policy

This mode uses a complete web policy. It enforces a comprehensive, full-featured web control policy, and provides complete reporting on web traffic. A Sophos Web Appliance or Security

Management Appliance is required for this option.

1. Configure your Sophos Web Appliance or Security Management Appliance as described in the appliance documentation, ensuring that Endpoint Web Control is turned on.

2. Ensure that web control is enabled on the Enterprise Console.

3. If your organization has an acceptable use policy, you should tailor the settings accordingly, thus preventing users from visiting any sites that could be deemed inappropriate.

4. To grant access to websites differently for various groups of users, create a different policy for each set of users.

5. Consider which websites you want to control. Which categories do you want to prevent users from visiting? Which categories will be accessible? Which categories you want to warn users about visiting?

6. Determine which websites you want to exempt, and add them to the appliance's Local Site

List.

7. With Full Web Control, you have the option of using Sophos LiveConnect. You can configure the appliance to use LiveConnect so that policy updates are distributed to users, and reporting data from user machines is uploaded, even when users are not connected from within the network.

For more information, see the Sophos Enterprise Console and Sophos Web Appliance documentation.

30

policy setup guide

12 Setting up exploit prevention policies

Note: This feature is not included with all licenses. If you want to use it, you might need to customize your license. For more information, see https://www.sophos.com/en-us/products/endpoint-antivirus/how-to-buy.aspx

.

The exploit prevention policy specifies the level of protection against ransomware and other forms of exploitation by malware.

■

■

■

Protect document files from ransomware (CryptoGuard).

Protect critical functions in web browsers (Safe Browsing).

Mitigate exploits. This protects the applications most vulnerable to exploitation by malware, such as Java applications.

■

■

■

Protect against process hollowing attacks.

Protect against loading .DLL files from untrusted folders.

Protect against processor branch tracing.

12.1 Recommended settings

The exploit prevention policy specifies how the security software protects against ransomware and other forms of malware exploitation.

Note: By default all exploit prevention options are turned on.

We recommend that you use the default settings.

12.2 How to roll out an exploit prevention policy

We recommend that you roll out an exploit prevention policy as follows:

1. All exploit prevention options are turned on by default. We recommend that you use the default settings. You should monitor any exploit prevention events for a period of time before altering the settings.

2. Use the Exploit Prevention Event Viewer to monitor any exploit prevention events. You can access the Event Viewer by clicking Events > Exploit Prevention Events.

3. Amend the exploit prevention policy based on your monitoring. For example you may want to exclude some applications from exploit mitigation. For more information see the Sophos

Enterprise Console help, Configuring policies > Exploit prevention policy section.

31

Sophos Enterprise Console

Important: Vulnerable applications are protected by default. You should be careful when excluding applications from exploit prevention. They will still be protected by CryptoGuard and

Safe Browsing.

a) Create a new policy or amend the default policy.

b) Check for any weaknesses in the policy.

c) Where needs differ, subdivide the group and create extra policies as needed.

4. Assign your policies as required.

For more information about setting up exploit prevention policies, see the Sophos Enterprise

Console help.

32

policy setup guide

13 Scanning recommendations

The scanning options in the following sections are set within the anti-virus and HIPS policy. When setting scanning options, consider the following:

■

■

■

Use default settings when possible.

Set scanning in Enterprise Console versus on the computer itself when possible.

Consider the role of the computer (e.g. desktop or server).

Extensions

To access the extension options for on-access scanning, in the Anti-Virus and HIPS Policy dialog box, click Configure next to Enable on-access scanning and then go to the Extensions tab.

For scheduled scans, in the Anti-Virus and HIPS Policy dialog box, under Scheduled scanning, click Extensions and Exclusions.

■ The Scan all files option is generally not needed nor recommended. Instead, select the Scan

only executable and other vulnerable files option to scan for threats found by SophosLabs.

Only scan all files on the advice of technical support.

Other scanning options

To access other scanning options for on-access scanning, in the Anti-Virus and HIPS Policy dialog box, click Configure next to Enable on-access scanning.

For scheduled scans, in the Anti-Virus and HIPS Policy dialog box, under Scheduled scanning, select a scan and click Edit. In the Scheduled scan settings dialog box, click Configure.

■

■

The Scan inside archive files option makes scanning slower and is generally not required.

When you attempt to access the contents of an archive file, the file is scanned automatically.

Therefore, we do not recommend also selecting this option unless you use archive files extensively.

We recommend scanning a computer's system memory for threats. System memory is used by the operating system. You can scan system memory periodically in the background while on-access scanning is enabled. You can also include system memory scanning as part of a scheduled scan. The Scan system memory option is enabled by default.

33

Sophos Enterprise Console

14 Using on-access scans

When using on-access scans, consider the following:

■ Use default settings when possible.

■

■

On-access scanning for Read, Write and Rename options are enabled by default for new software installations only. For software upgrades, you must enable them.

On-access scanning may not detect viruses if certain encryption software is installed. Change the startup processes to ensure that files are decrypted when on-access scanning begins. For more information on how to use anti-virus and HIPS policy with encryption software, see

Sophos support knowledgebase article 12790

( http://www.sophos.com/en-us/support/knowledgebase/12790.aspx

).

■ When you do not select on-access scanning, ensure that computers use scheduled scans.

For more information, see Using scheduled scans

(page 35).

Caution: Be aware that disabling on-access scanning increases security risk.

34

policy setup guide

15 Using scheduled scans

When using scheduled scans, consider the following:

■ Use default settings when possible.

■

■

■

Use scheduled scans as a way of assessing threats or estimating the prevalence of unwanted or controlled applications.

When you do not select on-access scanning, ensure that computers use scheduled scans.

Put these computers in a group and define a scheduled scan.

Be aware of performance issues when scheduling scans. For example, if you are scanning a server that reads and writes constantly to databases, consider when its performance will be the least affected.

■

■

■

For servers, consider the tasks that are running. If there is a backup task, do not run a scheduled scan at the same time the backup task is running.

Scan at set times. Ensure that a scheduled scan is performed daily on each computer, such as at 9 PM. At a minimum, scheduled scans should be performed weekly on all computers.

The Run scan at lower priority option allows a scheduled scan on Windows Vista and later operating systems to run at a lower priority so that it has minimal impact on user applications.

This option is recommended; however, the scan will take longer to run than scans without this option.

35

Sophos Enterprise Console

16 Using on-demand scans

When using on-demand scans, consider the following:

■ Use on-demand scans when manual assessment or cleanup is required.

36

policy setup guide

17 Excluding items from scanning

Exclude items from scanning as follows:

■ Use extensions to exclude specific file types from scanning.

■

■

Use exclusions to exclude specific items, such as files or drives, from scanning.You can create drive-level exclusions (X:), directory-level exclusions (X:\Program Files\Exchsrvr\), or file-level exclusions (X:\Program Files\SomeApp\SomeApp.exe).

Consider excluding media drives from on-access scanning for specific users who use them a considerable amount of time. Media drives read and write temporary files, and each file is intercepted and scanned each time it is used, making scanning slower.

■ Use the Exclude remote files option when you do not want remotely located files (on network resources) to be scanned. We recommend that all computers scan remote files when accessing them; however, you may want to select this option on file servers or in specific cases where large or constantly changing files are accessed remotely.

Caution: Be aware that excluding items from scanning increases security risk.

37

Sophos Enterprise Console

18 Technical support

You can find technical support for Sophos products in any of these ways:

■ Visit the Sophos Community at community.sophos.com/ and search for other users who are experiencing the same problem.

■

■

■

Visit the Sophos support knowledgebase at www.sophos.com/en-us/support.aspx

.

Download the product documentation at www.sophos.com/en-us/support/documentation.aspx

.

Open a ticket with our support team at https://secure2.sophos.com/support/contact-support/support-query.aspx

.

38

policy setup guide

19 Legal notices

Copyright © 2009–2017 Sophos Limited. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the license terms or you otherwise have the prior permission in writing of the copyright owner.

Sophos, Sophos Anti-Virus and SafeGuard are registered trademarks of Sophos Limited, Sophos

Group and Utimaco Safeware AG, as applicable. All other product and company names mentioned are trademarks or registered trademarks of their respective owners.

ACE

™

, TAO

™

, CIAO

™

, DAnCE

™

, and CoSMIC

™

ACE

™

, TAO

™

, CIAO

™

, DAnCE

™

, and CoSMIC

™

(henceforth referred to as "DOC software") are copyrighted by Douglas C. Schmidt and his research group at Washington University , University of California, Irvine , and Vanderbilt University , Copyright (c) 1993-2014, all rights reserved. Since

DOC software is open-source, freely available software, you are free to use, modify, copy, and distribute—perpetually and irrevocably—the DOC software source code and object code produced from the source, as well as copy and distribute modified versions of this software. You must, however, include this copyright statement along with any code built using DOC software that you release. No copyright statement needs to be provided if you just ship binary executables of your software products.

You can use DOC software in commercial and/or binary software releases and are under no obligation to redistribute any of your source code that is built using DOC software. Note, however, that you may not misappropriate the DOC software code, such as copyrighting it yourself or claiming authorship of the DOC software code, in a way that will prevent DOC software from being distributed freely using an open-source development model. You needn't inform anyone that you're using DOC software in your software, though we encourage you to let us know so we can promote your project in the DOC software success stories .

The ACE , TAO , CIAO , DAnCE , and CoSMIC web sites are maintained by the DOC Group at the

Institute for Software Integrated Systems (ISIS) and the Center for Distributed Object Computing of Washington University, St. Louis for the development of open-source software as part of the open-source software community. Submissions are provided by the submitter "as is" with no warranties whatsoever, including any warranty of merchantability, noninfringement of third party intellectual property, or fitness for any particular purpose. In no event shall the submitter be liable for any direct, indirect, special, exemplary, punitive, or consequential damages, including without limitation, lost profits, even if advised of the possibility of such damages. Likewise, DOC software is provided as is with no warranties of any kind, including the warranties of design, merchantability, and fitness for a particular purpose, noninfringement, or arising from a course of dealing, usage or trade practice. Washington University, UC Irvine, Vanderbilt University, their employees, and students shall have no liability with respect to the infringement of copyrights, trade secrets or any patents by DOC software or any part thereof. Moreover, in no event will Washington University,

UC Irvine, or Vanderbilt University, their employees, or students be liable for any lost revenue or profits or other special, indirect and consequential damages.

39

Sophos Enterprise Console

DOC software is provided with no support and without any obligation on the part of Washington

University, UC Irvine, Vanderbilt University, their employees, or students to assist in its use, correction, modification, or enhancement. A number of companies around the world provide commercial support for DOC software, however. DOC software is Y2K-compliant, as long as the underlying OS platform is Y2K-compliant. Likewise, DOC software is compliant with the new US daylight savings rule passed by Congress as "The Energy Policy Act of 2005," which established new daylight savings times (DST) rules for the United States that expand DST as of March 2007.

Since DOC software obtains time/date and calendaring information from operating systems users will not be affected by the new DST rules as long as they upgrade their operating systems accordingly.

The names ACE

™

, TAO

™

, CIAO

™

, DAnCE

™

, CoSMIC

™

, Washington University, UC Irvine, and

Vanderbilt University, may not be used to endorse or promote products or services derived from this source without express written permission from Washington University, UC Irvine, or Vanderbilt

University. This license grants no permission to call products or services derived from this source

ACE

™

, TAO

™

, CIAO

™

, DAnCE

™

, or CoSMIC

™

, nor does it grant permission for the name

Washington University, UC Irvine, or Vanderbilt University to appear in their names.

If you have any suggestions, additions, comments, or questions, please let me know.

Douglas C. Schmidt

Apache

The Sophos software that is described in this document may include some software programs that are licensed (or sublicensed) to the user under the Apache License. A copy of the license agreement for any such included software can be found at http://www.apache.org/licenses/LICENSE-2.0

Boost Software License

Permission is hereby granted, free of charge, to any person or organization obtaining a copy of the software and accompanying documentation covered by this license (the "Software") to use, reproduce, display, distribute, execute, and transmit the Software, and to prepare derivative works of the Software, and to permit third-parties to whom the Software is furnished to do so, all subject to the following:

The copyright notices in the Software and this entire statement, including the above license grant, this restriction and the following disclaimer, must be included in all copies of the Software, in whole or in part, and all derivative works of the Software, unless such copies or derivative works are solely in the form of machine-executable object code generated by a source language processor.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS

OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT

SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE

FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR

OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR

THE USE OR OTHER DEALINGS IN THE SOFTWARE.

40

policy setup guide

Common Public License

The Sophos software that is referenced in this document includes or may include some software programs that are licensed (or sublicensed) to the user under the Common Public License (CPL), which, among other rights, permits the user to have access to the source code. The CPL requires for any software licensed under the terms of the CPL, which is distributed in object code form, that the source code for such software also be made available to the users of the object code form. For any such software covered under the CPL, the source code is available via mail order by submitting a request to Sophos; via email to [email protected]

or via the web at https://www.sophos.com/en-us/support/contact-support.aspx

. A copy of the license agreement for any such included software can be found at http://opensource.org/licenses/cpl1.0.php

ConvertUTF

Copyright 2001–2004 Unicode, Inc.

This source code is provided as is by Unicode, Inc. No claims are made as to fitness for any particular purpose. No warranties of any kind are expressed or implied. The recipient agrees to determine applicability of information provided. If this file has been purchased on magnetic or optical media from Unicode, Inc., the sole remedy for any claim will be exchange of defective media within 90 days of receipt.

Unicode, Inc. hereby grants the right to freely use the information supplied in this file in the creation of products supporting the Unicode Standard, and to make copies of this file in any form for internal or external distribution as long as this notice remains attached.

Loki

The MIT License (MIT)

Copyright © 2001 by Andrei Alexandrescu

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS

OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL

THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR

OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,

ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR

OTHER DEALINGS IN THE SOFTWARE.

41

Sophos Enterprise Console

Microsoft Public License (MS-PL)

This license governs use of the accompanying software. If you use the software, you accept this license. If you do not accept the license, do not use the software.

1. Definitions

The terms "reproduce," "reproduction," "derivative works," and "distribution" have the same meaning here as under U.S. copyright law.

A "contribution" is the original software, or any additions or changes to the software.

A "contributor" is any person that distributes its contribution under this license.

"Licensed patents" are a contributor's patent claims that read directly on its contribution.

2. Grant of Rights

(A) Copyright Grant- Subject to the terms of this license, including the license conditions and limitations in section 3, each contributor grants you a non-exclusive, worldwide, royalty-free copyright license to reproduce its contribution, prepare derivative works of its contribution, and distribute its contribution or any derivative works that you create.

(B) Patent Grant- Subject to the terms of this license, including the license conditions and limitations in section 3, each contributor grants you a non-exclusive, worldwide, royalty-free license under its licensed patents to make, have made, use, sell, offer for sale, import, and/or otherwise dispose of its contribution in the software or derivative works of the contribution in the software.

3. Conditions and Limitations

(A) No Trademark License- This license does not grant you rights to use any contributors' name, logo, or trademarks.

(B) If you bring a patent claim against any contributor over patents that you claim are infringed by the software, your patent license from such contributor to the software ends automatically.

(C) If you distribute any portion of the software, you must retain all copyright, patent, trademark, and attribution notices that are present in the software.

(D) If you distribute any portion of the software in source code form, you may do so only under this license by including a complete copy of this license with your distribution. If you distribute any portion of the software in compiled or object code form, you may only do so under a license that complies with this license.

(E) The software is licensed "as-is." You bear the risk of using it. The contributors give no express warranties, guarantees or conditions. You may have additional consumer rights under your local laws which this license cannot change. To the extent permitted under your local laws, the contributors exclude the implied warranties of merchantability, fitness for a particular purpose and non-infringement.

A copy of the MS-PL terms can be found at https://opensource.org/licenses/MS-PL .

OpenSSL Cryptography and SSL/TLS Toolkit

The OpenSSL toolkit stays under a dual license, i.e. both the conditions of the OpenSSL License and the original SSLeay license apply to the toolkit. See below for the actual license texts. Actually

42

policy setup guide both licenses are BSD-style Open Source licenses. In case of any license issues related to

OpenSSL please contact [email protected].

OpenSSL license

Copyright © 1998–2016 The OpenSSL Project. All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

3. All advertising materials mentioning features or use of this software must display the following acknowledgment:

“This product includes software developed by the OpenSSL Project for use in the OpenSSL

Toolkit. ( http://www.openssl.org/ )”

4. The names “OpenSSL Toolkit” and “OpenSSL Project” must not be used to endorse or promote products derived from this software without prior written permission. For written permission, please contact [email protected]

.

5. Products derived from this software may not be called “OpenSSL” nor may “OpenSSL” appear in their names without prior written permission of the OpenSSL Project.

6. Redistributions of any form whatsoever must retain the following acknowledgment:

“This product includes software developed by the OpenSSL Project for use in the OpenSSL

Toolkit ( http://www.openssl.org/ )”

THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT “AS IS” AND ANY EXPRESSED

OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES

OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.

IN NO EVENT SHALL THE OpenSSL PROJECT OR ITS CONTRIBUTORS BE LIABLE FOR

ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL

DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS

OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT

LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY

OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH

DAMAGE.

This product includes cryptographic software written by Eric Young ( [email protected]

). This product includes software written by Tim Hudson ( [email protected]

).

Original SSLeay license

Copyright © 1995–1998 Eric Young ( [email protected]

) All rights reserved.

This package is an SSL implementation written by Eric Young ( [email protected]

). The implementation was written so as to conform with Netscape’s SSL.

This library is free for commercial and non-commercial use as long as the following conditions are adhered to. The following conditions apply to all code found in this distribution, be it the RC4,

RSA, lhash, DES, etc., code; not just the SSL code. The SSL documentation included with this

43

Sophos Enterprise Console distribution is covered by the same copyright terms except that the holder is Tim Hudson

( [email protected]

).

Copyright remains Eric Young’s, and as such any Copyright notices in the code are not to be removed. If this package is used in a product, Eric Young should be given attribution as the author of the parts of the library used. This can be in the form of a textual message at program startup or in documentation (online or textual) provided with the package.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the copyright notice, this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

3. All advertising materials mentioning features or use of this software must display the following acknowledgement:

“This product includes cryptographic software written by Eric Young ( [email protected]

)”

The word “cryptographic” can be left out if the routines from the library being used are not cryptographic related :-).

4. If you include any Windows specific code (or a derivative thereof) from the apps directory

(application code) you must include an acknowledgement:

“This product includes software written by Tim Hudson ( [email protected]

)”

THIS SOFTWARE IS PROVIDED BY ERIC YOUNG “AS IS” AND ANY EXPRESS OR IMPLIED

WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF

MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN

NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,

INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES

(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR

SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER

CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,

OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE

USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

The license and distribution terms for any publically available version or derivative of this code cannot be changed. i.e. this code cannot simply be copied and put under another distribution license [including the GNU Public License.]

WilsonORMapper

Copyright © 2007, Paul Wilson

All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

■ Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

44

policy setup guide

■ Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS

IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,

THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR

CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF

LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE

OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF

ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Windows Template Library (WTL)

Copyright © Microsoft Corporation. All rights reserved.

The use and distribution terms for this software are covered by the Common Public License.

Source code for this component is available here: https://sourceforge.net/projects/wtl/files/

zlib data compression library

Copyright © 1995–2013 Jean-loup Gailly and Mark Adler

This software is provided 'as-is', without any express or implied warranty. In no event will the authors be held liable for any damages arising from the use of this software.

Permission is granted to anyone to use this software for any purpose, including commercial applications, and to alter it and redistribute it freely, subject to the following restrictions:

1. The origin of this software must not be misrepresented; you must not claim that you wrote the original software. If you use this software in a product, an acknowledgment in the product documentation would be appreciated but is not required.

2. Altered source versions must be plainly marked as such, and must not be misrepresented as being the original software.

3. This notice may not be removed or altered from any source distribution.

Jean-loup Gailly [email protected]

Mark Adler [email protected]

45