Thread Info
  • Locked Locked
  • Replies 16 replies
  • Subscribers 7 subscribers
  • Views 82298 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

UTM best practise guide for strict webfiltering

ChristianSteger

Note for any user users stumbeling upon this post and looking for advice (just a small list. Any moderator is welcome to edit or to make a better list here):

* Sophos Sales Team DACH published a best practise guide on 26th Feb 2016 by Mail.
Some people have published the newsletter, therefore I will link it here. It also includes some categories to block and general interactions and hints:
http://web.sophos.com/res/sophos/92aaef928aee3e5ff8216622c999157c.pdf
http://utm-shop.de/information/news-und-co/sofortmassnahmen-gegen-krypta-trojaner-wie-wie-cryptowall-teslacrypt-oder-locky(Note: I did not found a English version. In case you need, maybe Sophos has a translation ;) )

* Have a scroll down to 2nd post here and later posts for blocking/logging/categorizing of unkown sites

* Have a look for the ad-blocking over
-- DouglasFoster 2nd post
-- here: https://community.sophos.com/products/unified-threat-management/f/55/t/46207
-- and/or here: https://drashna.net/blog/2015/03/an-exercise-in-frustration-fine-tuning-the-web-filter-in-sophos-utm/#comments

* Keep in mind:
-- Sophos filtering of Flash, ActiveX and Java is not secure! (Malware gets tru!) => Therefore block the risiky ad networks!

Sophos support itself says that it does only gives an enhanced layer of security and not a security itself. Be sure not to trust Sophos UTM to protect you. It is just another layer, which may protect you.

Keep this in mind and the flash filtering, that Sophos seems not to mention that something does not work as you expect (compare like to this: https://community.sophos.com/products/unified-threat-management/f/55/t/74173)

 

=========== Original post ============

Hello together,

we are using here a fully licensed Sophos UTM 9.3. The computers (Win7) have running Sophos Endpoint Cloud, but no Web Control on.
The Win7 computer was fully patched, and the user surfed with MSIE 11 (latest version) with Adobe Flash (lastest version).

During surfing on a more or less popular German website, the user got infected with a perfect language specific ransomware software, probably by malifious ads.

We probably had some low security guideline for the computer. Specific errors are:
- using MSIE instead of Firefox,
- using no ad-blocker
- using Adobe Flash

In any case we had hoped that the Web filter gives us an additional layer, concreate:
- filtering all HTTP and HTTPS traffic
- using reputation limit with lowest limit (i.e. blacklist)
- Anti-Virus filter with Avira
- Blocking ActiveX/Flash/Java

So, now we are wondering, which are the probably right settings for the UTM
- Anti-Virus is not helpful as it does not detect new stuff
- Blocking ActiveX/Flash is not helpful as it does no automatic stripping of ActiveX and Flash - i.e. several sites with Flash work

Therefore, the only logical consequence is whitelisting.
- We have now set reputation limit to whitelist (i.e. neutral)

How does whitelisting work and is it safe enough?

Currently I have the feeling the Web Filtering is not enough...
- Anti-Virus is not 100% secure
- Blocking ActiveX/Flash is not 100% secure
- How secure is the whitelisting?

(Edit 14.30 UTC) We did now the following, too:
- Blocking suspicious category (In German you have to scroll down the list and I did not see it)
- Following the user guide over there to block the ads: https://drashna.net/blog/2015/03/an-exercise-in-frustration-fine-tuning-the-web-filter-in-sophos-utm/#comments
- Checking the boxes in Options for strict HTTP and blocking of unscannable downloads to get this one right: https://community.sophos.com/products/unified-threat-management/f/55/t/74173

Any best practise hints, for making a good tradeoff between surfing and safety?
With current whitelisting some pictures are blocked, even community.sophos.com is blocked...



This thread was automatically locked due to age.
Parents

  • Hello together,

    thanks for your ideas.

    @BAlfons:
    - we dropped whitelist again, after enforcing stricter computer rules.
    - for Suspicous category: we did not notice it at first. At beginning we blocked several categories and got false positives, removing everything, unfortunately also suspicious. We also included now the crimial stuff.

    @DouglasFoster
    They write it in some documents (but not in the admin book), that the filter is not safe. I find it very misleading as I've got uncoutinous after your location IT upgraded the PCs to Win7. Firefox, which does the blocking automatically, was not enforced.
    I have to allow Java sites, e.g. govermental sites, but Malware just gets thru.

    Also when setting up the url filter, we noticed that it was very slow at beginning. After some research, we noticed that we should active Endpoint Protection, to use the fast filter list - even if no computer is managed by the UTM.

    I miss a best practise book

    - the recommanded blocking categories: like suspicous to block ad-networks, which have no safe infrastructure and deliver ransomware, which current virus tools cannot detect (even Sophos itself!)
    - features that should be activiated, but it should be also told that they are not 100% safe. E.g. firewall is 100% blocking the ports, when setting to block, but Flash is not 100% blocked, when setting to block. That should be also told in the administrator handbook...

Reply

  • Hello together,

    thanks for your ideas.

    @BAlfons:
    - we dropped whitelist again, after enforcing stricter computer rules.
    - for Suspicous category: we did not notice it at first. At beginning we blocked several categories and got false positives, removing everything, unfortunately also suspicious. We also included now the crimial stuff.

    @DouglasFoster
    They write it in some documents (but not in the admin book), that the filter is not safe. I find it very misleading as I've got uncoutinous after your location IT upgraded the PCs to Win7. Firefox, which does the blocking automatically, was not enforced.
    I have to allow Java sites, e.g. govermental sites, but Malware just gets thru.

    Also when setting up the url filter, we noticed that it was very slow at beginning. After some research, we noticed that we should active Endpoint Protection, to use the fast filter list - even if no computer is managed by the UTM.

    I miss a best practise book

    - the recommanded blocking categories: like suspicous to block ad-networks, which have no safe infrastructure and deliver ransomware, which current virus tools cannot detect (even Sophos itself!)
    - features that should be activiated, but it should be also told that they are not 100% safe. E.g. firewall is 100% blocking the ports, when setting to block, but Flash is not 100% blocked, when setting to block. That should be also told in the administrator handbook...

Children
No Data
Unfiltered HTML