help
13 Glossary
adware and PUAs application rule
Authorization manager automatic cleanup blocked
Adware displays advertising, for example, pop-up messages, which affects user productivity and system efficiency. A potentially unwanted application (PUA) is an application that is not inherently malicious but is generally considered unsuitable for the majority of business networks.
A rule that applies only to packets of data transferred over the network to or from a particular application.
The module that enables you to authorize adware and PUAs, suspicious files, and applications that exhibit suspicious behavior and buffer overflows.
Cleanup that is performed without any intervention or acceptance by you.
A status showing that applications (including hidden processes), connections, protocols, ICMP messages, and so on have been refused network access.
Detects buffer overflow attacks.
buffer overflow detection checksum
Each version of an application has a unique checksum. The firewall can use this checksum to decide whether an application is allowed or not.
cleanup
Content Control List
(CCL)
A set of conditions that specify file content, for example, credit or debit card numbers, or bank account details near to other forms of personally identifiable information. There are two types of Content Control List:
SophosLabs Content Control List and custom Content Control List.
content rule
Cleanup eliminates threats on your computer by removing a virus from a file or boot sector, moving or deleting a suspicious file, or deleting an item of adware or PUA. It is not available for threats that are detected by web page scanning because the threats are not downloaded to your computer. Therefore, there is no need to take any action.
A rule that contains one or more Content Control Lists and specifies the action that is taken if the user attempts to transfer data that matches all the Content Control Lists in the rule to the specified destination.
101
Sophos Endpoint Security and Control
controlled application
An application that is prevented from running on your computer by your organisation's security policy.
custom rule
A rule created by the user to specify the circumstances under which an application is allowed to run.
data control data view
A feature to reduce accidental data loss from workstations. It works by taking action when a workstation user tries to transfer a file that meets criteria defined in the data control policy and rules. For example, when a user attempts to copy a spreadsheet containing a list of customer data to a removable storage device or upload a document marked as confidential into a webmail account, data control will block the transfer, if configured to do so.
The view that displays different data depending on the item selected in the tree view.
description bar device control
A bar in the log viewer which appears above the data view and contains the name of the currently selected item in the tree view.
A feature to reduce accidental data loss from workstations and restrict introduction of software from outside of the network. It works by taking action when a workstation user tries to use an unauthorized storage device or networking device on their workstation.
download reputation
Reputation of a file downloaded from the internet. The reputation is calculated based on the file's age, source, prevalence, deep content analysis and other characteristics. It helps to establish whether the file is safe or is a potential risk and may harm a user's computer if downloaded.
Scans every part of every file.
extensive scanning firewall event firewall policy
A situation that occurs when an unknown application, or the operating system, on one computer tries to communicate with another computer over a network connection in a way that was not specifically requested by the applications running on the other computer.
The settings issued by the management console which the firewall uses to monitor the computer's connection to the internet and other networks.
global rules
Rules that are applied to all network connections and applications which do not already have a rule. They take lower priority than the rules set on the LAN page. They also take lower priority than application rules
(unless the user specifies otherwise).
102
help
hidden process
An application sometimes launches a hidden process to perform some network access for it. Malicious applications may use this technique to evade firewalls: they launch a trusted application to access the network rather than doing so themselves.
high-priority global rule
Host Intrusion
Prevention System
(HIPS)
ICMP
A rule that is applied before any other global or application rule.
Overall term for pre-execution behavior analysis and runtime behavior analysis.
Abbreviation for "Internet Control Message Protocol." A network-layer internet protocol that provides error correction and other information relevant to IP packet processing.
ICMP settings instant messaging interactive mode learning dialog
The settings that specify which types of network management communication are allowed.
A category of controlled applications that includes instant messaging client applications (e.g. MSN).
The mode in which the firewall displays one or more learning dialogs when it detects network traffic for which it has no rule. This feature applies only to Sophos Client Firewall for Windows 7 and earlier.
A dialog box that asks the user to choose whether to allow or block network activity when an unknown application requests network access.
This feature applies only to Sophos Client Firewall for Windows 7 and earlier.
log cleanup settings
The settings that control when records are deleted.
log viewer
A form where users can view details from the event database, such as connections that have been allowed or blocked, the system log and any alerts that have been raised.
Malicious Traffic
Detection manual cleanup match
A feature that detects communications between compromised computers and attackers' command and control servers.
Cleanup that is performed by using special disinfectors or utilities, or by deleting files manually.
Equal the content that is defined in a Content Control List.
103
Sophos Endpoint Security and Control
NetBIOS network protocol
Abbreviation for "Network Basic Input/Output System." Software that provides an interface between the operating system, the I/O bus, and the network. Nearly all Windows-based LANs are based on NetBIOS.
A set of rules or standards designed to enable computers to connect with one another over a network and to exchange information with as little error as possible.
non-interactive mode
The mode in which the firewall either blocks or allows all network traffic for which it has no rule.
normal scanning on-access scan
Scans only those parts of each file that are likely to be infected with a virus.
Your main method of protection against threats. Whenever you copy, move, or open a file, or start a program, Sophos Anti-Virus scans the file or program and grants access to it only if it does not pose a threat to your computer or has been authorized for use.
on-demand scan
A scan that you initiate. You can use an on-demand scan to scan anything from a single file to everything on your computer that you have permission to read.
primary configuration
The firewall configuration used for the corporate network that the user connects to for their day-to-day business.
process settings
The settings that specify whether modified or hidden processes should be allowed network access.
Quarantine manager
The module that enables you to view and deal with items that have been quarantined.
rawsocket
Rawsockets allow processes to control all aspects of the data they send over the network and can be used for malicious purposes.
right-click scan rootkit runtime behavior analysis
A scan of file(s) in Windows Explorer or on the desktop that you run using the shortcut menu.
A Trojan or technology that is used to hide the presence of a malicious object (process, file, registry key, or network port) from the computer user or administrator.
Dynamic analysis performed by suspicious behavior detection and buffer overflow detection.
104
help
scanning error scheduled scan secondary configuration spyware
Sophos Live
Protection stateful inspection
An error in scanning a file, e.g. access denied.
A scan of your computer, or parts of your computer, that runs at set times.
The firewall configuration used when users are not connected to the main corporate network, but to another network such as a hotel or airport wireless network or another corporate network.
A program that installs itself onto a user’s computer by stealth, subterfuge, or social engineering, and sends information from that computer to a third party without the user’s permission or knowledge.
A feature that uses in-the-cloud technology to instantly decide whether a suspicious file is a threat and take action specified in the Sophos anti-virus cleanup configuration.
Firewall technology that keeps a table of active TCP and UDP network connections. Only packets matching a known connection state will be allowed by the firewall; others will be rejected.
storage device suspicious behavior detection
Dynamic analysis of the behavior of all programs running on the system in order to detect and block activity which appears to be malicious.
suspicious file
Removable storage devices (for example, USB flash drives, PC Card readers, and external hard disk drives), CD/DVD drives, floppy disk drives, and secure removable storage devices (for example, SanDisk
Cruzer Enterprise, Kingston Data Traveller, IronKey Enterprise, and
IronKey Basic USB flash drives with hardware encryption).
system memory
A file that exhibits a combination of characteristics that are commonly, but not exclusively, found in viruses.
The memory that acts as a bridge between applications and the actual data processing done at the hardware level. It is used by the operating system.
system rule tamper protection threat event tree view
A rule that will be applied to all applications and will allow or block low-level system network activity.
A feature that prevents unauthorized users (local administrators and users with limited technical knowledge) and known malware from uninstalling Sophos security software or disabling it through the Sophos
Endpoint Security and Control interface.
Detection or disinfection of a threat.
The view that controls what data the log viewer displays in its data view.
105
Sophos Endpoint Security and Control
true file type trusted application unidentified virus unknown traffic
The file type that is ascertained by analyzing the structure of a file as opposed to the filename extension. This is a more reliable method.
An application that is allowed full and unconditional access to the network.
A virus for which there is no specific identity.
A form of network access by an application or service for which the firewall has no rule.
virus identity file (IDE)
A file that enables Sophos Anti-Virus to detect and disinfect a particular virus, Trojan, or worm.
Voice over IP
A category of controlled applications that includes Voice over IP client applications.
working mode
The setting that determines whether the firewall applies actions with input from the user (interactive mode) or automatically (the non-interactive modes). The interactive mode was removed in Sophos
Client Firewall for Windows 8 and later.
106
