Central Endpoint & Intercept X: Getting Started

Summary

Doug from Sophos introduces Endpoint and Intercept X protection within Sophos Central, assuming viewers have an active account and licensed products. The tutorial covers accessing the product, managing policies, and syncing with Active Directory. It details setting up threat protection, peripheral control, application control, data loss prevention, web control, and Windows Firewall management. The video also guides users on downloading installers and managing users, with help available for troubleshooting.

Takeaways

• 🔐 **Sophos Central Account Requirement**: To use Endpoint and Intercept X protection, you need an active Sophos Central account and at least one licensed product.
• 👤 **User Management**: Sophos Central allows adding users manually, importing via CSV, syncing with Active Directory, or automatically creating users during endpoint agent deployment.
• 🛡️ **Endpoint Protection Policies**: Base policies are automatically applied to all users or computers unless exemption policies are created for specific groups or machines.
• 💡 **Recommended Settings**: Sophos provides recommended settings for optimal protection, which include features like deep learning for malware detection and real-time scanning.
• 🔎 **Deep Learning Technology**: Sophos utilizes deep learning for file-based malware detection, offering greater accuracy and fewer false positives than traditional machine learning.
• 🚫 **Behavior-Based Detections**: The platform includes real-time scanning and behavior-based detections to block access to malicious websites, which can prevent about 80% of attacks.
• 🛡️ **Exploit Protection and CryptoGuard**: Intercept X features comprehensive exploit protection and CryptoGuard to defend against ransomware and other advanced threats.
• 🔄 **Peripheral Control**: Sophos Central allows monitoring or controlling peripheral devices, with options to allow, block, or restrict wireless connections.
• ⛔ **Application Control**: The platform enables blacklisting of malicious or inappropriate apps and offers monitoring modes to detect or block controlled applications.
• 🚫 **Data Loss Prevention (DLP)**: DLP policies can inspect file contents for sensitive data and enforce rules based on content type, user actions, and file transfer destinations.
• 🌐 **Web Control**: Additional security options extend threat protection by controlling web-based activities, including blocking risky downloads and managing acceptable web usage.
• 🔄 **Update Management**: Sophos Central provides update management policies to schedule updates during specific hours, ensuring minimal disruption in controlled environments.
• 🔒 **Windows Firewall Management**: The platform can monitor and configure the state of the Windows firewall, with options to block or allow connections based on network type.

Q & A

What is required to get started with Endpoint and Intercept X protection in Sophos Central?

You need an active Sophos Central account and at least one licensed product to get started with Endpoint and Intercept X protection.

Where can you check which products are licensed in Sophos Central?

You can check which products are licensed by clicking on your name in the upper right corner and selecting 'Licensing' from the drop-down menu.

What is the base policy in Sophos Central, and when is it applied?

The base policy is a default policy that applies automatically to every user or computer unless specific exemption policies are created for particular users, machines, or groups.

How can you add users to the Sophos Central system?

Users can be added manually, imported via CSV files, or synced with Active Directory using a tool found in the settings section. Additionally, users are created automatically when the endpoint agent is installed on a machine.

What makes Sophos' deep learning different from other machine learning systems?

Sophos' deep learning is pre-trained and works immediately in your environment without a training period, offering greater accuracy and fewer false positives compared to competitors.

How does the 'Block access to malicious websites' feature in real-time scanning contribute to security?

This feature checks against a constantly growing database of known malicious websites, stopping about 80% of attacks, and is enabled by default.

What is Cryptoguard, and how does it protect against ransomware?

Cryptoguard is a feature in Sophos Central that protects against ransomware by preventing malicious encryption of user files and blocking demands for payment to unlock them.

What are the different modes available for peripheral control in Sophos Central?

Peripheral control has three modes: disabled, monitor mode (which audits all peripherals), and control mode (which allows peripherals to be allowed, read-only, or blocked).

How does application control work in Sophos Central?

Application control allows you to blacklist apps that are deemed malicious or inappropriate. It has a monitoring mode for detection or blocking of apps and includes options like automatically blocking older versions of software such as Adobe Reader.

What does the Data Loss Prevention (DLP) feature do, and how can you configure it?

The DLP feature monitors the content of files as they leave the endpoint. You can use built-in templates for quick setup, create custom rules, and choose to block or audit file transfers based on content or file types.