Sophos Complete Security Suite

Hi,

To answer you questions:
 

You can certianly install Enterprise Console (SEC) in a VM.  That is supported.

It's very easy to deploy to endpoints and can be done in a variety of ways.  The push from the console with SEC 5.1 is much more likley to succeed than with previous versions.  It's also easy to script the install, as you can just run setup.exe with the required switches. http://www.sophos.com/en-us/support/knowledgebase/12570.aspx.  Incorporate install commands into AD startup scripts for example.

A good tip to obtain an install string is to deploy to a template command whilst monitoring the scheduled tasks, once the install task is created you can look at the properties.  This will give you the full command line and save having to obfuscate the usrname and password switches yourself.  You can also add on additional switches such as -g to add the machines to a group in SEC at install.

Performance wise, it should be fine out of the box, but you can always customise the scanning options and add exclusions where neccessary.  I've not had any problems.

The layered approach is always going to be your best bet, defense in depth really is the key.  If you can put the web appliance infront of users that's a powerful tool to control what is likely to get as far as the client from the web as a route in.  The web has to be the main entrypoint.

App Control, Device Control, Data Control, patch, Web control (client based), tamper protection, Firewall are all helpful to reduce risk also so using them in comination where required is the way to do it.  Encryption is also vital for laptops leaving the site.

As for installing SEC, the main thing I would recommend is to create two service accounts before you start, e.g:

1. SophosManagement
2. SophosUpdate

They can be regular users, just untick, user must change password at next logon as password never expires.  The SophosManagement account needs to be able to logon to the management server machine, so that is worth testing.  this way when you run the installer you're ready.

Any questions, ask away.

Hope that helps,

Regards

Jak

Hi,

To answer you questions:
 

You can certianly install Enterprise Console (SEC) in a VM.  That is supported.

It's very easy to deploy to endpoints and can be done in a variety of ways.  The push from the console with SEC 5.1 is much more likley to succeed than with previous versions.  It's also easy to script the install, as you can just run setup.exe with the required switches. http://www.sophos.com/en-us/support/knowledgebase/12570.aspx.  Incorporate install commands into AD startup scripts for example.

A good tip to obtain an install string is to deploy to a template command whilst monitoring the scheduled tasks, once the install task is created you can look at the properties.  This will give you the full command line and save having to obfuscate the usrname and password switches yourself.  You can also add on additional switches such as -g to add the machines to a group in SEC at install.

Performance wise, it should be fine out of the box, but you can always customise the scanning options and add exclusions where neccessary.  I've not had any problems.

The layered approach is always going to be your best bet, defense in depth really is the key.  If you can put the web appliance infront of users that's a powerful tool to control what is likely to get as far as the client from the web as a route in.  The web has to be the main entrypoint.

App Control, Device Control, Data Control, patch, Web control (client based), tamper protection, Firewall are all helpful to reduce risk also so using them in comination where required is the way to do it.  Encryption is also vital for laptops leaving the site.

As for installing SEC, the main thing I would recommend is to create two service accounts before you start, e.g:

1. SophosManagement
2. SophosUpdate

They can be regular users, just untick, user must change password at next logon as password never expires.  The SophosManagement account needs to be able to logon to the management server machine, so that is worth testing.  this way when you run the installer you're ready.

Any questions, ask away.

Hope that helps,

Regards

Jak