[Sync Sec] Important announcement on Synchronized Security Features on XG v17.5 Early Access

Hello

Far from me the idea to influence Sophos' idea department (Ok.  That's B.S.) but here's some illuminating readings:

https://www.dell.com/support/article/ca/en/cabsdt1/sln311931/dell-emc-open-networking?lang=en

and

https://www.openswitch.net/

I know there are other manufacturers embarking the "no-OS network hardware" bandwagon.  To me, this is a heck of an opportunity.  Because there's a HUGE part of development Sophos would avoid meaning it would open doors to many markets.  And inter-connectivity with many SDN products.

Paul Jr 

Thanks for the post Paul. Coming for the Dell world myself OpenSwitch and the evolving adoption of SDN (via OpenFlow an/or OpenStack) are areas in which we think the firewall market will eventually converge into, however before we take on that particular initiative we are looking to streamline and optimize our underlying API so that we can better port our control/data plane into those stacks. We also need to improve the way in which we present some of our DPI capabilities (even Sync Security) as a VNF so that integrations into product like OpenSwitch can be selective and better contained. I'll PM you separately and would love to pick your brain on some of these use cases. 

Damn, one day everything in the rack will be blue!

I think being able to block untrusted (term meaning non-Central managed IPs) by default would be best case. Very few devices on a network that aren't going to be Central Managed would actually need to reach out and communicate with an Endpoint. Similar to how the Windows Firewall right now can be managed to block all incoming on Public/Private/Domain but instead set to "While on network with Sophos XG Firewall, block all access except to trusted IPs and configured IP lists".

On our network, I can only think of one device that would actually need to initiate traffic to an endpoint that is not managed by Central, everything else is Windows with Server protection. Anything else should not be reaching out to my endpoints or servers (i.e. ESXi does not need to communicate with my endpoints/servers).

Emile

We have looked at that Emile, the problem being things like Guest networks where you have no control over untrusted devices.

Your idea of "While on network with Sophos XG Firewall, block all access except to trusted IPs and configured IP lists" is interesting but I can see administrative overhead issues in maintaining those lists. Probably not too onerous in a small business but move up to multi-site, multi-thousand user environments and it becomes more difficult.

Will bear this in mind however for future planning around this feature.

Stuart

Unknown said:

We have looked at that Emile, the problem being things like Guest networks where you have no control over untrusted devices.

 

Your idea of "While on network with Sophos XG Firewall, block all access except to trusted IPs and configured IP lists" is interesting but I can see administrative overhead issues in maintaining those lists. Probably not too onerous in a small business but move up to multi-site, multi-thousand user environments and it becomes more difficult.

Will bear this in mind however for future planning around this feature.

 

Stuart

Hi Stuart,

I do agree that it can cause administrative overheads but they will still be a far cry smaller than a fully integrate NAC solution with say, Forescout, which quotes a month for installation. On my idea, we have to remember that managed devices will have heartbeat and will auto-magically be inherently trusted so that will cover 95% of devices on a network unless the Customer has opted for one solution on endpoints and another on servers which is not outside the realms of possibility. So the last 5% will be a mishmash of analysis and diagnostic software like SolarWinds or PRTG sensor sweep sources etc which will be a small manageable number for entry into a trusted IP list.

We also have to remember, this is just to stop unmanaged/untrusted/unhealthy devices initiating connections to healthy managed devices, not the other way around.

In regards to Guest networks, any managed corporate device on a guest network should be locked down to not accept external incoming connections so the Lateral Movement is not a system that would go in place in this area.

Food for thought, it's the difference of large sums of effort.

Emile

if you are using the lateral movement detection you must be already using the sophos central endpoint already, which arrives with "Device Self Isolation"(Part of Endpoint EAP) which also comes alongside the lateral movement prevention, its like the computer also self isolates its self from everything else in the event of a change in health status (Managed and Unmanaged), only allowing the DNS, BOOTP/DHCP and traffic generated by sophos processes to be allowed outside. This is again and endpoint feature can be enabled with a simple Check box and LMD is just in its initial release on the firewall side like Jan mentioned we will add more capabilities for the LMD. 

if you are using the lateral movement detection you must be already using the sophos central endpoint already, which arrives with "Device Self Isolation"(Part of Endpoint EAP) which also comes alongside the lateral movement prevention, its like the computer also self isolates its self from everything else in the event of a change in health status (Managed and Unmanaged), only allowing the DNS, BOOTP/DHCP and traffic generated by sophos processes to be allowed outside this is in addition to the XG updating the other endpoints not to communicate with the infected computer. This is again and endpoint feature can be enabled with a simple Check box and LMD is just in its initial release on the firewall side like Jan mentioned we will add more capabilities for the LMD. 

Hello Kranthi,

I believe you have misinterpreted what Stuart and I were discussing holistically.

What we were discussing is using the LMD technology to actively block connections from devices that don't have a health marker. I.e. my endpoint is healthy and can receive connections from other managed healthy devices, but that printer over there? Doesn't need to talk to me, block it.

What you have described is self lock down due to infection which is the opposite spectrum to what was discussed.

Emile