[Sync Sec] Important announcement on Synchronized Security Features on XG v17.5 Early Access

FAQ on Synchronized Security Features in v17.5 

Question: How is the new Lateral Movement Protection different from previous Security Heartbeat auto-isolation?

The easiest way to describe it is that Security Heartbeat is able to isolate infections at the firewall and now with Lateral Movement Protection isolate at the endpoint level as well.

Security Heartbeat conditions in firewall rules have been a Synchronized Security feature of XG Firewall since it was introduced, enabling the firewall to isolate compromised devices with a Red or Yellow Heartbeat from other parts of the network at the firewall.  For example, by adding Heartbeat conditions to firewall rules, administrators can automatically isolate an endpoint from the WAN (Internet), DMZ (Servers), or other zones and segments of the network connected through the firewall.

Lateral Movement Protection extends this feature by also informing all healthy endpoints to further isolate a compromised device at the endpoint.  This has the added benefit of working on the same network segment also known as a broadcast domain or subnet where endpoint computers are typically connected together through a switch.  Lateral Movement Protection can dramatically reduce the exposure to threats spreading within the network.  

Both features isolate endpoints automatically and restore connectivity when the health of the affected device returns to normal.

Question: How does Lateral Movement Protection Work?

When a device has a RED Security Heartbeat condition, the MAC addresses of all the device’s network interfaces are  shared by the Firewall to other endpoints which will utilize the Windows Firewall to block all traffic from those MAC addresses.

Question: How is Lateral Movement Protection Different from Self-Isolation with Intercept X Advanced with EDR?

Intercept X with EDR provides a self-isolation feature – the compromised device can use the local Windows Firewall on the client to isolate itself.    

Lateral Movement Protection enlists your trusted endpoints to isolate any untrustworthy endpoints, ignoring all traffic from the untrusted device to protect themselves from any attacks or hacks it might try to instigate.  Lateral Movement Protection is a an essential tool to prevent the spread of threats or attacks since you can absolutely trust the healthy endpoints to do their part. 

Question: What are the limitations of Lateral Movement Protection?

Lateral Movement Protection works on flat networks connected through a layer 2 switch or the firewall which is the vast majority of customer networks out there.  It does not support isolation across different subnets or VLANs routed through a managed layer 3 switch.  Support for this may be added in the future.

Question: How does Synchronized User ID work and what limitations does it have?

Synchronized User ID shares the domain user account information from the machine the user is logged into over Security Heartbeat with the Firewall.  The Firewall then checks this against the configured AD server and activates the user.  It only requires that the Active Directory server is configured as an authentication server in XG Firewall.  No agents are required on the server or clients.  It does not share or utilize any password information.  It does not work with other directory services, and it will not recognize “local” users.

Question: Do these new Synchronized Security Features in v17.5 work on both Windows and Macs?

Initially they work only on Sophos Central managed Windows endpoints.  Mac support will come in a future update to the Mac Sophos Endpoint client.

Question:  What Endpoint Release and License do I need to take advantage of these new Synchronized Security features?

To test these new features, you will require the latest EAP of Sophos Intercept X Advanced with EDR which is currently scheduled to be available starting November 12th.

All of our Central Endpoint Licenses (Endpoint Protection and all flavours of Intercept X) support Synchronized Security.

The latest Synchronized Security features in v17.5 will be supported in all of these products as of November 19th following the updated engine release as part of the Intercept X Advanced with EDR release.

In other words, Synchronized User ID requires Sophos Central Endpoint Protection.

Lateral movement management should be installed in switches, routers, WiFi access points, et.c.

It cannot be optimal anywhere else.  I presume that Sophos' approach is better than nothing at all.

Paul Jr

Big_Buck said:

Lateral movement management should be installed in switches, routers, WiFi access points, et.c.

It cannot be optimal anywhere else.  I presume that Sophos' approach is better than nothing at all.

Yes, it gives a facsimile of switch level NAC without requiring the Customer to commit to a 5 figure plus sum, long collective installation time and management overhead but still relatively perform similar functionality. NAC is rare in the 1000 and below marketplace due to the above reasons so Sophos are bringing this to the SMB markets.

Emile

I understand this ... But ... Xerox printers, for example, have been famous to be totally insecure.  These devices use a somewhat complete linux distro, and are not the only one on the market to be hackers' platforms.  To a point it is a running joke.  Polycom IP phones are another vulnerable platform.  HP printers have been found earlier this year to be even worse than Xerox.  You may have lateral movement (LMD) detection on some devices, but if, in the end, if only half of these devices have LMD installed, it's close to not having it at all.

Paul Jr

We are looking into options how we can handle lateral movement with unmanaged devices, as well as covering switches and routers. This is a first step into also covering all other devices.

Big_Buck said:

I understand this ... But ... Xerox printers, for example, have been famous to be totally insecure.  These devices use a somewhat complete linux distro, and are not the only on the market to be Hackers' platform.  To a point it is a running joke.  Polycom IP phones are another vulnerable platform.  HP printers have been found earlier this year to be even worse than Xerox.  You may have simili-lateral movement on some devices, but if, in the end, only half of these devices have LMD installed, it is close to not having it at all.

Absolutely 100% agree with you, what's the point in protection using LMD if it only works with other LMD devices. I believe one of the features either at the start or upcoming is to reject communications from untrusted sources and have exceptions for acceptable IPs which will help but not altogether fix. Any good network configuration should have their phones on an isolated segment and printers are another story but to me, that's a weak argument.

So what the LMD in Central is trying to do is prevent cross infection on all managed devices. This will not cover all types as per your examples above but it is a start. As per Verizon breach report, over 60% of infections start on a standard users computer. Of those 60%, cross infection is another majority percentage as the next step. If Central and LMD can prevent the majority of that 60% crossing the threshold then that is a boon. My biggest concern is a lateral movement from client to server where the juicy stuff is and LMD will help.

But you are correct, LMD can only work with managed devices but I think a business of 50-500 would be able to bite the bullet getting started with a NAC facsimile costing 500-5000 rather than 15000-50000.

Frankly I think Sophos should do Switches next after v18 and get into software defined networking with the XG being the master and sticking it to Ciscos Nexus switching.

Emile

Big_Buck said:

I understand this ... But ... Xerox printers, for example, have been famous to be totally insecure.  These devices use a somewhat complete linux distro, and are not the only on the market to be Hackers' platform.  To a point it is a running joke.  Polycom IP phones are another vulnerable platform.  HP printers have been found earlier this year to be even worse than Xerox.  You may have simili-lateral movement on some devices, but if, in the end, only half of these devices have LMD installed, it is close to not having it at all.

Absolutely 100% agree with you, what's the point in protection using LMD if it only works with other LMD devices. I believe one of the features either at the start or upcoming is to reject communications from untrusted sources and have exceptions for acceptable IPs which will help but not altogether fix. Any good network configuration should have their phones on an isolated segment and printers are another story but to me, that's a weak argument.

So what the LMD in Central is trying to do is prevent cross infection on all managed devices. This will not cover all types as per your examples above but it is a start. As per Verizon breach report, over 60% of infections start on a standard users computer. Of those 60%, cross infection is another majority percentage as the next step. If Central and LMD can prevent the majority of that 60% crossing the threshold then that is a boon. My biggest concern is a lateral movement from client to server where the juicy stuff is and LMD will help.

But you are correct, LMD can only work with managed devices but I think a business of 50-500 would be able to bite the bullet getting started with a NAC facsimile costing 500-5000 rather than 15000-50000.

Frankly I think Sophos should do Switches next after v18 and get into software defined networking with the XG being the master and sticking it to Ciscos Nexus switching.

Emile

if you are using the lateral movement detection you must be already using the sophos central endpoint already, which arrives with "Device Self Isolation"(Part of Endpoint EAP) which also comes alongside the lateral movement prevention, its like the computer also self isolates its self from everything else in the event of a change in health status (Managed and Unmanaged), only allowing the DNS, BOOTP/DHCP and traffic generated by sophos processes to be allowed outside. This is again and endpoint feature can be enabled with a simple Check box and LMD is just in its initial release on the firewall side like Jan mentioned we will add more capabilities for the LMD. 

Hello Kranthi,

I believe you have misinterpreted what Stuart and I were discussing holistically.

What we were discussing is using the LMD technology to actively block connections from devices that don't have a health marker. I.e. my endpoint is healthy and can receive connections from other managed healthy devices, but that printer over there? Doesn't need to talk to me, block it.

What you have described is self lock down due to infection which is the opposite spectrum to what was discussed.

Emile