Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 7 replies
  • Subscribers 2 subscribers
  • Views 14177 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Best Practices for Sophos AV

notesguru99

Dear All

Thought I might be able to get a thread going here whereby we post our Sophos AV setup and configurations.   This way we might be able to see why others have implemented Sophos in a certain way and maybe understand better which policies need tweaking etc.    I am about to harmonise our 4 offices installations of Sophos so before I do that hopefully someone will notice something possibly wrong with my setup or offer advice on why it should be changed etc.

So here goes...

  • Sophos 9 running on a complete Windows environment synchronised with Active Directory.
  • Each Sophos server controls its own policies.  If I could configure one server for policies and push these policies out to the other sites that would be ideal, but I don't know if its possible and whether my branch office pc's would update correctly?
  • Workstations check for updates every 60 minutes
  • On Access scanning enabled on all workstations, behaviour = On Read
  • Remote scanning of files disabled
  • Auto cleanup of infected files, move to default location
  • Web scanning is 'As on access'
  • All Servers On Access scanning disabled, scheduled scans run each night at 9PM
  • HIPS enabled for notifications only.  Too many false positives for software updates IMO

We also use the Application Control and Device Control which (when working) helps us to nail down rogue apps!

If anyone has any recommendations for me to change I am all ears!

Cheers

:850


This thread was automatically locked due to age.
Parents
  • 0

    Hello Warren,

    a file is scanned regardless of the user context (BTW: depending on the settings write and rename can also cause it to be scanned).

    If so am I wasting time

    In a strictly controlled environment (users can't change the settings on the workstation and all workstations are protected) you could exclude the shared locations from scanning by the server. Or if workstations can only access the server's share you could exclude remote files in their policy (this might even save some cycles in total as a file is not rescanned if it hasn't changed). If the share is not writable then a detection on a workstation can not clean it up. Thus there are several points to consider, not just wasted time. 

    Christian   

    :33665
Reply
  • 0

    Hello Warren,

    a file is scanned regardless of the user context (BTW: depending on the settings write and rename can also cause it to be scanned).

    If so am I wasting time

    In a strictly controlled environment (users can't change the settings on the workstation and all workstations are protected) you could exclude the shared locations from scanning by the server. Or if workstations can only access the server's share you could exclude remote files in their policy (this might even save some cycles in total as a file is not rescanned if it hasn't changed). If the share is not writable then a detection on a workstation can not clean it up. Thus there are several points to consider, not just wasted time. 

    Christian   

    :33665
Children
No Data