Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 7 replies
  • Subscribers 2 subscribers
  • Views 14177 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Best Practices for Sophos AV

notesguru99

Dear All

Thought I might be able to get a thread going here whereby we post our Sophos AV setup and configurations.   This way we might be able to see why others have implemented Sophos in a certain way and maybe understand better which policies need tweaking etc.    I am about to harmonise our 4 offices installations of Sophos so before I do that hopefully someone will notice something possibly wrong with my setup or offer advice on why it should be changed etc.

So here goes...

  • Sophos 9 running on a complete Windows environment synchronised with Active Directory.
  • Each Sophos server controls its own policies.  If I could configure one server for policies and push these policies out to the other sites that would be ideal, but I don't know if its possible and whether my branch office pc's would update correctly?
  • Workstations check for updates every 60 minutes
  • On Access scanning enabled on all workstations, behaviour = On Read
  • Remote scanning of files disabled
  • Auto cleanup of infected files, move to default location
  • Web scanning is 'As on access'
  • All Servers On Access scanning disabled, scheduled scans run each night at 9PM
  • HIPS enabled for notifications only.  Too many false positives for software updates IMO

We also use the Application Control and Device Control which (when working) helps us to nail down rogue apps!

If anyone has any recommendations for me to change I am all ears!

Cheers

:850


This thread was automatically locked due to age.
Parents
  • 0

    I'd suggest that you run one central management server and only SUMs on the other sites (you can have them update from you central server or/and from Sophos - if the latter you have to make sure you have the correct mrinit.conf and cac.pem in the CID) . The SUM-servers could also be configured as message relays (in this case each site has to have it's own mrinit.conf).

    5 year old P4s? Must've been a sell-out :smileyhappy:

    100 users would be scanning the same files on the network? - as you said it's a trade off. You can exclude remote drives (assuming a fixed letter is used) but (for the time being) not UNC paths. If your users can only connect to the servers and you know the servers to be "safe" then turning off remote scanning would not increase the risk. Otherwise is still one more possible path. 

    Samples and how to obtain/send them have recently been . 

    Christian

    :929
Reply
  • 0

    I'd suggest that you run one central management server and only SUMs on the other sites (you can have them update from you central server or/and from Sophos - if the latter you have to make sure you have the correct mrinit.conf and cac.pem in the CID) . The SUM-servers could also be configured as message relays (in this case each site has to have it's own mrinit.conf).

    5 year old P4s? Must've been a sell-out :smileyhappy:

    100 users would be scanning the same files on the network? - as you said it's a trade off. You can exclude remote drives (assuming a fixed letter is used) but (for the time being) not UNC paths. If your users can only connect to the servers and you know the servers to be "safe" then turning off remote scanning would not increase the risk. Otherwise is still one more possible path. 

    Samples and how to obtain/send them have recently been . 

    Christian

    :929
Children
No Data