How to configure Sophos for Securing IoT devices?

Deepak,

Fortinet is using ForeScout's CounterACT for IoT security through FortiGate.  CounterACT finds and identifies devices on a network/cloud, so policies can be created for them in FortiGate.  According to Fortinet, "ForeScout CounterACT identifies devices based on their IP addresses, including network infrastructure, BYOD systems, non-traditional IoT devices (handhelds, sensors and machines), and rogue endpoints (unauthorized switches, routers, and wireless access points)- no management agents or previous device awareness is required."  A few security companies like Fortinet use CounterACT in Firewall and VPN to see devices and control which devices can connect to the network.  Fortinet also uses CounterACT in its Meru Secure Wi-Fi to assist.

Sophos and most other security companies use CounterACT in End Point Protection.  Like in Fortinet, devices one your network and policies are created to control their interactions across the network.  If a device is identified as rogue, infected, or acting maliciously, the bad devices are blocked from communicating with your network, and all your good devices are told to stop talking to the bad devices.    Active and passive malware is stopped, any files encrypted by ransomware are unencrypted or rolled back to the most recent unencrypted copy, and any malicious communication or files that left your network is tracked and reported to you.   In most cases, the attack is stopped and any damage is undone.

End Point Protection and Intercept X coordinate with Sophos XG Firewall, Secure Wi-Fi, and other Sophos Central products to handle issues with IoT and other devices.  Sophos EPP uses CounterAct.  Intercept X also includes End Point Protection with CounterACT.  Intercept X uses Artificial Intelligence and Machine Learning in addition to CounterACT.  Both Intercept X and EPP coordinate with with XG Firewall through Synchronized Services in Sophos Central to automatically identify and mitigate issues as they happen or as they are discovered across all network devices.  You can also track, research, and manage issues and devices manually from anywhere in the world using Intercept X through Sophos Central.

1. If you're not using Intercept X or End Point Protection, you can purchase them.  When you purchase Intercept X, EPP comes with it.  You can also purchase End Point Protection without Intercept X.

2. In addition to Intercept X and EPP, you can also purchase Sophos Secure Wi-Fi.  Secure Wi-Fi integrates with your XG Firewall and coordinates with Intercept X and End Point Protection through Sophos Central.  This helps ensure that wireless IOT devices are seen and addressed.  Other vendor Wi-Fi will work on your network too (I use Ruckus).  You can use EPP and Intercept X and Sophos Central through the third-party Wi-Fi, but you can't control the third-party Wi-Fi from Sophos security.

3. Another option is Sophos Home.  Sophos Home is End Point Protection that includes many of the features of Intercept X.  Sophos Home is independent with it's own cloud controller.  Sophos home doesn't coordinate with XG Firewall, Sophos Central, or other Sophos products.  Sophos Home won't control IoT devices, but end points with Sophos Home will be protected from IoT devices. Sophos is a cheap alternative if you just want to protect computers from IoT, rogue devices, zombie devices, and other issues.

If you don't like any of these ideas, you can: 

A. You can configure per MAC address policies.  The problem is that you must account for each device having more than one MAC address depending on how that device connects to your network; i.e.: wired LAN, Wi-Fi, etc.

B. You can create multiple LAN and VLAN interfaces. Set Firewall Rules based on Zones and the Interfaces in them.  Use DHCP Relay, so you don't have to configure subnets.  You're limited to the amount of simultaneous leases you already have in DHCP, and you must alway ensure that devices are connected to the correct LAN/VLAN.

Regardless of which of these options you choose, you may not be able to see or manage devices that are connected to your network through another device; such as one or more devices tethered to a computer or a wired hotspot.