This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Option to prevent tampering with Sophos services and settings

Hello Folks -

We just recently implemented Sophos S&C 9.0 for our end-users. The product works great but we are looking for some sort of mechanism to prevent our limited number of users who are also local administrators on their laptops from stopping the Sophos services. I know with other vendors products that regardless of whether the user is an admin or not they still provided some sort of setting(s) that would prevent the users from doing so.

I do realize (and I saw this on other posts in this forum) that it doesn't go along with "safe computing practices" but in some companies (i.e. telecoms) it is often at times cumbersome to lock down certain departments (RF engineers, field crews, etc) especially when these departments are in direct contact with vendors, etc. I can restrict with a Group Policy the "Install with Elevated Privilges" settings but many applications are hard coded to require an administrator installing the software.

I saw that Sophos Professional Services can assist with this type of configuration but in my honest opinion this is something that should be included in an enterprise class endpoint solution. I also may be searching on the wrong keywords so if there is an article / suggestion on how to accomplish this please steer me in the correct direction.

Thanks!

This thread was automatically locked due to age.

Parents

0 QC over 9 years ago

Hello kesm0724,
Sophos moderators / power users
guess I should count myself among them :smileywink:. I'll make another attempt explaining a possible (again: I'm not Sophos so this is just guessing) rationale trying to avoid the don't-give-admin-rights mantra.
the Iron Fist mentality
As far as my posts are concerned I might have failed in clearly citing this as last resort. I think I've always emphasized - but maybe not enough - that education, raising awareness, and siding with the users are the preferred measures for dealing with the tampering problem.
other competitors have been able to figure out how to do
It's not that Sophos wouldn't be able to figure it out. It's not black and white though. While it is arguably MORE secure it can also complicate working with the product. Not only in case of issues when troubleshooting is required but likewise in those very situations for which the users have admin rights - if they have to make changes to the system for which they need administrative rights they might also have the need to temporarily reconfigure or disable the security software (and this at a time when the endpoint is out of reach for central management).
As you can see with other products tamper protection is apparently never finished. Situations arise when you have to legitimately disable or circumvent it, and the knowledge how to do it can only be kept "secret" for a limited time. Then you have to come up with an improved scheme (which again adds complexity to the product's architecture with all its consequences) and it starts all over again.
Assessing the security benefit, unwanted side-effects, the remaining shortcomings, customer demand, and the (ongoing) implementation effort you eventually arrive at a decision. You likely can't come up with hard numbers for all the aspects (and different vendors certainly arrive at different estimates depending on the customer base) and thus the decision is also influenced by "corporate philosophy".
I hope I could somewhat dispel the impression that I advocate shaking (and using) the Iron Fist. As far as Sophos is concerned the above is solely my own conjecture.
Christian
:55198
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 QC over 9 years ago

Hello kesm0724,
Sophos moderators / power users
guess I should count myself among them :smileywink:. I'll make another attempt explaining a possible (again: I'm not Sophos so this is just guessing) rationale trying to avoid the don't-give-admin-rights mantra.
the Iron Fist mentality
As far as my posts are concerned I might have failed in clearly citing this as last resort. I think I've always emphasized - but maybe not enough - that education, raising awareness, and siding with the users are the preferred measures for dealing with the tampering problem.
other competitors have been able to figure out how to do
It's not that Sophos wouldn't be able to figure it out. It's not black and white though. While it is arguably MORE secure it can also complicate working with the product. Not only in case of issues when troubleshooting is required but likewise in those very situations for which the users have admin rights - if they have to make changes to the system for which they need administrative rights they might also have the need to temporarily reconfigure or disable the security software (and this at a time when the endpoint is out of reach for central management).
As you can see with other products tamper protection is apparently never finished. Situations arise when you have to legitimately disable or circumvent it, and the knowledge how to do it can only be kept "secret" for a limited time. Then you have to come up with an improved scheme (which again adds complexity to the product's architecture with all its consequences) and it starts all over again.
Assessing the security benefit, unwanted side-effects, the remaining shortcomings, customer demand, and the (ongoing) implementation effort you eventually arrive at a decision. You likely can't come up with hard numbers for all the aspects (and different vendors certainly arrive at different estimates depending on the customer base) and thus the decision is also influenced by "corporate philosophy".
I hope I could somewhat dispel the impression that I advocate shaking (and using) the Iron Fist. As far as Sophos is concerned the above is solely my own conjecture.
Christian
:55198
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data