[Sync Sec] Important announcement on Synchronized Security Features on XG v17.5 Early Access

FAQ on Synchronized Security Features in v17.5 

Question: How is the new Lateral Movement Protection different from previous Security Heartbeat auto-isolation?

The easiest way to describe it is that Security Heartbeat is able to isolate infections at the firewall and now with Lateral Movement Protection isolate at the endpoint level as well.

Security Heartbeat conditions in firewall rules have been a Synchronized Security feature of XG Firewall since it was introduced, enabling the firewall to isolate compromised devices with a Red or Yellow Heartbeat from other parts of the network at the firewall.  For example, by adding Heartbeat conditions to firewall rules, administrators can automatically isolate an endpoint from the WAN (Internet), DMZ (Servers), or other zones and segments of the network connected through the firewall.

Lateral Movement Protection extends this feature by also informing all healthy endpoints to further isolate a compromised device at the endpoint.  This has the added benefit of working on the same network segment also known as a broadcast domain or subnet where endpoint computers are typically connected together through a switch.  Lateral Movement Protection can dramatically reduce the exposure to threats spreading within the network.  

Both features isolate endpoints automatically and restore connectivity when the health of the affected device returns to normal.

Question: How does Lateral Movement Protection Work?

When a device has a RED Security Heartbeat condition, the MAC addresses of all the device’s network interfaces are  shared by the Firewall to other endpoints which will utilize the Windows Firewall to block all traffic from those MAC addresses.

Question: How is Lateral Movement Protection Different from Self-Isolation with Intercept X Advanced with EDR?

Intercept X with EDR provides a self-isolation feature – the compromised device can use the local Windows Firewall on the client to isolate itself.    

Lateral Movement Protection enlists your trusted endpoints to isolate any untrustworthy endpoints, ignoring all traffic from the untrusted device to protect themselves from any attacks or hacks it might try to instigate.  Lateral Movement Protection is a an essential tool to prevent the spread of threats or attacks since you can absolutely trust the healthy endpoints to do their part. 

Question: What are the limitations of Lateral Movement Protection?

Lateral Movement Protection works on flat networks connected through a layer 2 switch or the firewall which is the vast majority of customer networks out there.  It does not support isolation across different subnets or VLANs routed through a managed layer 3 switch.  Support for this may be added in the future.

Question: How does Synchronized User ID work and what limitations does it have?

Synchronized User ID shares the domain user account information from the machine the user is logged into over Security Heartbeat with the Firewall.  The Firewall then checks this against the configured AD server and activates the user.  It only requires that the Active Directory server is configured as an authentication server in XG Firewall.  No agents are required on the server or clients.  It does not share or utilize any password information.  It does not work with other directory services, and it will not recognize “local” users.

Question: Do these new Synchronized Security Features in v17.5 work on both Windows and Macs?

Initially they work only on Sophos Central managed Windows endpoints.  Mac support will come in a future update to the Mac Sophos Endpoint client.

Question:  What Endpoint Release and License do I need to take advantage of these new Synchronized Security features?

To test these new features, you will require the latest EAP of Sophos Intercept X Advanced with EDR which is currently scheduled to be available starting November 12th.

All of our Central Endpoint Licenses (Endpoint Protection and all flavours of Intercept X) support Synchronized Security.

The latest Synchronized Security features in v17.5 will be supported in all of these products as of November 19th following the updated engine release as part of the Intercept X Advanced with EDR release.

In other words, Synchronized User ID requires Sophos Central Endpoint Protection.

Dell have been selling "bare bones" / open sources network equipment for few years now ... That would be a nice place to start with ...  In the style inject a Sophos firewall in there ...

Paul Jr

JanWeber said:

We are looking into options how we can handle lateral movement with unmanaged devices, as well as covering switches and routers. This is a first step into also covering all other devices.

Sophos Switches!

Weren't Astaro mulling over the idea just before acquisition?

Emile

I was not saying Sophos Switches, to be fully correct here ;-)

We are looking into options how we can cover more of the network environment and none Sophos protected devices, there are ideas that we are discussing and will be bringing in a future release that will expand on this capability. Specifically considering network printers, VoIP phones and other IoT devices that are becoming more widely used.

Hello

Far from me the idea to influence Sophos' idea department (Ok.  That's B.S.) but here's some illuminating readings:

https://www.dell.com/support/article/ca/en/cabsdt1/sln311931/dell-emc-open-networking?lang=en

and

https://www.openswitch.net/

I know there are other manufacturers embarking the "no-OS network hardware" bandwagon.  To me, this is a heck of an opportunity.  Because there's a HUGE part of development Sophos would avoid meaning it would open doors to many markets.  And inter-connectivity with many SDN products.

Paul Jr 

Thanks for the post Paul. Coming for the Dell world myself OpenSwitch and the evolving adoption of SDN (via OpenFlow an/or OpenStack) are areas in which we think the firewall market will eventually converge into, however before we take on that particular initiative we are looking to streamline and optimize our underlying API so that we can better port our control/data plane into those stacks. We also need to improve the way in which we present some of our DPI capabilities (even Sync Security) as a VNF so that integrations into product like OpenSwitch can be selective and better contained. I'll PM you separately and would love to pick your brain on some of these use cases. 

Damn, one day everything in the rack will be blue!

I think being able to block untrusted (term meaning non-Central managed IPs) by default would be best case. Very few devices on a network that aren't going to be Central Managed would actually need to reach out and communicate with an Endpoint. Similar to how the Windows Firewall right now can be managed to block all incoming on Public/Private/Domain but instead set to "While on network with Sophos XG Firewall, block all access except to trusted IPs and configured IP lists".

On our network, I can only think of one device that would actually need to initiate traffic to an endpoint that is not managed by Central, everything else is Windows with Server protection. Anything else should not be reaching out to my endpoints or servers (i.e. ESXi does not need to communicate with my endpoints/servers).

Emile

We have looked at that Emile, the problem being things like Guest networks where you have no control over untrusted devices.

Your idea of "While on network with Sophos XG Firewall, block all access except to trusted IPs and configured IP lists" is interesting but I can see administrative overhead issues in maintaining those lists. Probably not too onerous in a small business but move up to multi-site, multi-thousand user environments and it becomes more difficult.

Will bear this in mind however for future planning around this feature.

Stuart

Unknown said:

We have looked at that Emile, the problem being things like Guest networks where you have no control over untrusted devices.

 

Your idea of "While on network with Sophos XG Firewall, block all access except to trusted IPs and configured IP lists" is interesting but I can see administrative overhead issues in maintaining those lists. Probably not too onerous in a small business but move up to multi-site, multi-thousand user environments and it becomes more difficult.

Will bear this in mind however for future planning around this feature.

 

Stuart

Hi Stuart,

I do agree that it can cause administrative overheads but they will still be a far cry smaller than a fully integrate NAC solution with say, Forescout, which quotes a month for installation. On my idea, we have to remember that managed devices will have heartbeat and will auto-magically be inherently trusted so that will cover 95% of devices on a network unless the Customer has opted for one solution on endpoints and another on servers which is not outside the realms of possibility. So the last 5% will be a mishmash of analysis and diagnostic software like SolarWinds or PRTG sensor sweep sources etc which will be a small manageable number for entry into a trusted IP list.

We also have to remember, this is just to stop unmanaged/untrusted/unhealthy devices initiating connections to healthy managed devices, not the other way around.

In regards to Guest networks, any managed corporate device on a guest network should be locked down to not accept external incoming connections so the Lateral Movement is not a system that would go in place in this area.

Food for thought, it's the difference of large sums of effort.

Emile

if you are using the lateral movement detection you must be already using the sophos central endpoint already, which arrives with "Device Self Isolation"(Part of Endpoint EAP) which also comes alongside the lateral movement prevention, its like the computer also self isolates its self from everything else in the event of a change in health status (Managed and Unmanaged), only allowing the DNS, BOOTP/DHCP and traffic generated by sophos processes to be allowed outside. This is again and endpoint feature can be enabled with a simple Check box and LMD is just in its initial release on the firewall side like Jan mentioned we will add more capabilities for the LMD. 

Hello Kranthi,

I believe you have misinterpreted what Stuart and I were discussing holistically.

What we were discussing is using the LMD technology to actively block connections from devices that don't have a health marker. I.e. my endpoint is healthy and can receive connections from other managed healthy devices, but that printer over there? Doesn't need to talk to me, block it.

What you have described is self lock down due to infection which is the opposite spectrum to what was discussed.

Emile

Hello Kranthi,

I believe you have misinterpreted what Stuart and I were discussing holistically.

What we were discussing is using the LMD technology to actively block connections from devices that don't have a health marker. I.e. my endpoint is healthy and can receive connections from other managed healthy devices, but that printer over there? Doesn't need to talk to me, block it.

What you have described is self lock down due to infection which is the opposite spectrum to what was discussed.

Emile