Advanced Network Security:

Sophos Firewalls Implemented by GS-IT

Deep Packet Inspection

It consists of Next-Gen Intrusion Prevention (IPS), which provides advanced AI analysis for detecting and mitigating unknown and zero-day advanced persistent threats. Zero-day threat protection and multiple-stage analysis help detect unknown threats that can cause data loss. It also provides perimeter defence. Other features include-

• TLS 1.3 inspection
• Proxy-based dual-engine AV scanning
• Country-based blocking policy

Encrypted Traffic

The data traffic encrypted with TLS 1.3 protocol helps in error handling and provides unmatched visibility in data communication. It is compatible with all modern cipher suites and covers all ports/protocols and uses

• Intelligent traffic selection
• Pre-packaged exception list
• Powerful policy engine

Zero-Day and ML Protection

Any software glitches left out in the network can be exploited by a hacker if not attended to and can become potential manifestations of most vulnerabilities, like zero-day attacks and ransomware. Sophos helps in mitigating these errors and constantly keeps an eye on them with the latest AI features like

• SophosLabs data scientists
• Multiple machine learning models
• Static file analysis
• Dynamic file analysis

Synchronized Security

Synchronized security with new technologies like Security Heartbeat allows endpoints and firewalls to communicate their health status with one another, send reports, and log them regularly. It also uses the following technologies

• Destination Heartbeat Protection
• Synchronized App Control
• Lateral Movement Protection
• Synchronized User ID

Cloud Sandbox

Sandboxing is a cybersecurity practice for running a code, observing, and analyzing. It prevents threats from entering the network and is extensively used to inspect untested or untrusted code. Sophos Sandbox can be easily integrated into any third-party product and streamlined to deliver next-gen threat detection systems with advanced tools and automated malware analysis like

• Dynamic sandboxing analysis
• Deep learning static file analysis

Advanced Threat Protection

Sophos Firewall protects your network from complex assaults by quickly identifying malware and other advanced persistent threats. It detects and block network traffic attempting to reach command and control servers using multi-layered DNS, AFC, and a firewall. Secure systems with

• Security Heartbeat
• Multi-layered, call-home protection
• Intelligent firewall policies
• Traffic light-style indicators

Link Selection and Routing

Sophos Firewall can choose the optimal link within a service level agreement (SLA) to route traffic based on real-time packet loss, jitter, and latency. Rerouting of application traffic when transitioning between links will have zero impact on performance.

• Performance Matters
  Even the best internet service providers (ISPs) experience occasional disruptions. When an outage occurs, SD-WAN technology can seamlessly transmit critical application traffic to healthy WAN connections, ensuring that VoIP and team meetings will not be interrupted.
• Real-Time Performance Monitoring
  The performances of ISP connections are constantly monitored and logged for packet loss, jitter, and latency metrics.
• Zero-Impact Rerouting
  When WAN link performance takes a hit, it is rerouted automatically to a better-performing link, including active sessions with zero impact so that there will not be any disruption to users and applications

SD-Branch Orchestration Made Easy

It is a win-win solution for anyone dealing with multiple sites. Sophos Central Orchestration makes interconnecting SD-WAN overlay networks-a quick and easy task. It makes this herculean task of setting up VPN tunnels between different sites a less tedious process.

Sophos Central Orchestration interconnects VPN tunnels between multiple Sophos Firewalls. Sophos Central will take care of all the necessary tunnel and firewall setup like full-mesh network, hub-and-spoke topology, or a combination, and implements it. You can select what gets connected, and Sophos Central takes care of all the heavy lifting on the backend to set up all the necessary tunnels and rules.

Accelerates performance

Xstream architecture enables FastPath acceleration for trusted traffic flows. It guarantees a powerful and consistent application routing with 5X improvement in performance for your SD-WAN networking. The updated hardware appliances with Xstream Flow processors promise hardware acceleration of trusted traffic flow. One of the great features of the programmable flow processor is that additional features and derivatives can be implemented to improve performance over time.

Sophos Firewall enables direct-to-the-cloud application-based routing for not less than 3,300 different applications, reducing the need to back up through your data center.

SD-WAN VPN Connectivity

Flexible connectivity options, including 3G/4G/LTE, copper, fibre, Wi-Fi, and PoE. Zero-touch auto provision helps the implementation of the device, even by a non-technical person. Sophos firewall provides secure VPN tunnel connectivity anywhere around the world. It offers enterprise-level encryption and flexible routing options for any likely combination of VPN and local WAN access.

The most significant challenge of firewalls is identifying and routing custom or obscure application traffic. With Sophos Synchronized Security, the endpoints will help classify and pinpoint these applications reliably to guarantee every application connected to the network is prioritized and routed efficiently.

Zero-Touch Deployment to Remote Locations

It requires zero technical skills at the remote site to deploy a new firewall. Just enter the SD-RED device ID into the Sophos Firewall and ship it. As soon as it’s plugged in and connected to the internet, the provisioning service automatically connects it to the firewall and establishes a secure, dedicated VPN tunnel.

SD-RED devices are affordable, and there’s no added licensing cost for SD-REDs as it is already a part of the Sophos Firewall Network Protection License. SD-RED series possess characteristics for establishing an SD-WAN overlay for SD-Branch-Remote and Branch Office Connectivity. Sophos Firewall and a suite of Secure Access products facilitate a flexible, affordable overlay network with SD-WAN.

Base Firewall

• Xstream Architecture
  It enables high-performance TLS 1.3 inspection, deep-packet inspection, and network flow FastPath to accelerate trusted SaaS, SD-WAN, and cloud application traffic. To get the full benefits of the Xstream Architecture, network, and web protection is required.
• VPN
  With IPsec and SSL support, it provides standards-based site-to-site and remote access VPN. The SD-Remote ethernet devices offer layered site-to-site tunnels as a lightweight and robust VPN alternative.
• Secure Wireless
  Sophos APX has wireless access points with a built-in wireless controller. Plug-and-play access point discovery makes the setup easier. It supports multiple SSIDs, hotspots, encryption, and security standards.

Network Protection

• Next-Gen IPS
  It provides advanced protection against all types of modern attacks. It implies protection not only for servers and networks as in conventional systems but also for users and apps on the network.
• Security Heartbeat
  It connects your Sophos Central-protected endpoints to your firewall to identify threats faster, simplify investigation, and minimize the impact of attacks. Integrating heartbeat status into firewall policies automatically isolates compromised systems.
• Advanced Threat Protection
  Security Heartbeat provides emergency responses to today's most sophisticated attacks. Instant identification of threats, multi-layered protection, and security heartbeat help in identifying and mitigating threats instantly.

Web Protection

• Traffic scanning
  Our Xstream SSL inspection provides ultra-low latency inspection and HTTPS scanning optimized for high-performance traffic scanning.
• Application Control
  Synchronized Application Control identifies network applications and gives visibility and control over them with granular policies, traffic-shaping options, and QoS settings based on application category and risk.
• User and group web policy
  Use Secure Web Gateway policy controls at the corporate level to administer advanced user and group web policies. Apply policies on uploaded web keywords indicating inappropriate use.

Zero-Day Protection

• Powered by SophosLabs
  SophosLabs' cloud-based threat intelligence and analysis technology powers Zero-Day Protection. It contains deep learning-based file analysis, analysis reports, and a threat meter to indicate the risk factor. It utilizes multiple layers of analytics to identify known and potential threats and provide reports based on them.
• Static File Analysis
  Harness the power of numerous machine learning models, global reputation, and deep file scanning in static file analysis to immediately identify dangers without executing files in real-time.
• Dynamic File Analysis
  Run a file in a safe cloud-based sandbox to closely view its behaviour. Screenshots help you impart more information on all important events during the analysis.

Central Orchestration

• Central Orchestration
  It seamlessly combines numerous WAN connections and SD-WAN features to improve routing and boost resilience with VPN management.
• Firewall Reporting
  It offers cloud-based reporting with pre-packaged reports for threats, compliance, and user activity. Users can utilize advanced features to create custom reports, schedule, and export them. It provides 30 days of data log retention along with additional data storage.
• MDR/XDR Connector
  Sophos MDR delivers 24/7 threat hunting, detection, and response. Sophos Firewall shares threat intelligence with the cloud and provides data on detected threats. You can manage it yourself or let Sophos do it.

Email Protection

• Live Anti-Spam
  It blocks the newest spam, phishing, and malware. When servers are down, it guarantees email business continuity by allowing the firewall to queue messages automatically.
• SPX Email Encryption
  Sophos-powered password-based encryption technology makes it easy to send encrypted emails, even to those without trust infrastructure.
• Data Loss Prevention
  Based on the presence of sensitive data in emails leaving the organization, policy-based DLP can automatically encrypt, block, or notify.

Stay Informed

Sophos Central gives you an easy-to-recognize dashboard view of all your firewalls, their status, and their uses. It alerts about any active threats and security issues. It helps to monitor VPN and SD-RED device status, as well as any compliance risks.

• View all your firewalls and their status.
• Track threats provide security alerts.
• Receive SD-WAN, VPN, and SD-RED status
• Obtain the status of all other Sophos products.

Take Control

Managing multiple firewalls for consistency, synchronization, and updating is a challenge. Sophos Central makes this simple. Firewall management options easily group firewalls together to keep their policies synchronized. Make a change to the group policy once, and it will be automatically applied to all firewalls in the group, ensuring network consistency and compliance.

• Assign your firewalls in groups and synchronize their policies.
• Store your firewall configuration backups in the cloud.
• Apply firmware updates with a few clicks.
• Zero-touch deployment for new firewalls

Analytics & Reports

Central Firewall Reporting (CFR) provides a set of tools to capture and analyzes network activity from the Sophos Firewall estate. Log data of multiple firewalls are sent to the Sophos Central cloud account. It imparts clarity to your network activity without individually accessing each device on the network.

• Identify security glitches, suspicious patterns, and other events.
• Stay up-to-date with all compliance requirements.
• Quick retrieval of stored log data for analytics.
• Gather network intelligence by tracing firewall log data.
• Report the topics that matter most to you.

Extend your network

Sophos Central deploys new firewall devices with zero contact. Perform the initial setup and configuration in Sophos Central, then export the configuration to the new site on a flash drive. Reconnect the firewall to Sophos Central and finish the remaining configuration remotely.

• Set up new Sophos firewalls at remote sites from Sophos Central without physical contact.
• Deploy zero-touch Sophos SD-RED in a branch office or home office with just a few clicks.
• Add plug-and-play APX wireless access points easily.
• Provide secure remote access to apps and data with ZTNA.

Extend your protection

It manages the firewall, endpoint, server, mobile, and other Sophos Products through a single console while taking advantage of Synchronized Security integration. Security Heartbeat shares the real time health status of endpoint with your firewall.

• Isolating compromised systems to restrain lateral movement of threats.
• Synchronized Application Control recognizes cent percent encrypted and evasive apps.
• Synchronized User ID provides easy integration with Active Directory.

SD-RED -Remote Ethernet Devices

Ethernet connects devices in a LAN or WAN to enable communication. Devices with an internal network interface card or an external USB are known as Ethernet devices. The RED or Remote Ethernet Device is a small box-like device deployed to remote sites to establish a VPN to the central Sophos UTM- Unified Threat Management. It helps in the notion that anything connected to the RED can be considered a part of the network.

Highlights

• Plug-and-protect deployment
• Flexible Wi-Fi and WAN connectivity
• Flexible configuration
• Synchronized SD-WAN
• Securely encrypted
• Centrally managed

ZTNA

ZTNA is Zero Trust Network Access. The concept of zero trust begins by assuming that any identity (whether human or machine) with access to your network can be compromised. Zero Trust Network Access states that anyone/anything that tries to connect to an organization’s network must be verified and authenticated before granting all sort-of access. Access should also be limited. ZTNA eliminates vulnerable VPN clients, incorporates device health, and removes the absolute trust and broad network access that a VPN provides.

Highlights

• Replace remote access VPN
• Prevents threats like ransomware
• Gate access to SaaS Applications
• Secure RDP access
• Synchronized security
• End-to-end protection

Sophos Switch

The Sophos Switch is a set of cloud-managed network access layer switches that let you connect and control access to your local area network at the LAN edge. Sophos Central gives you a single pane of glass to manage all your security solutions—including your switches. Sophos switches seamlessly integrate with the existing Sophos ecosystem and mitigate the risks of multi-vendor deployments.

Highlights

• Segmentation for security
• Less complexity, fewer risks
• Zero-touch deployment
• Multiple and easy management ways
• One vendor-One view
• Secure access portfolio

Wireless Access Points-WAP

It is a hardware device connected to a local area network allowing devices and wired networks to remain connected. WAPs has radio transmitters and antennae facility to connect devices and a network or the internet. Sophos WAP models are designed for a range of deployment scenarios and with 2x2, 3x3, and 4x4 models. They are available at different price points as they can suit even the stiffest budget.

Highlights

• Plug-and-play auto-discovery setup
• High performance
• Act as an on-premises wireless controller
• Enhanced Rogue AP Detection
• Wireless scalability

Xstream SD-WAN

SD-WAN is Software-defined Wide Area Network. It is a software-defined approach in managing the wide area network. It extends software-defined networking (SDN) into an application that businesses can use to create a smart hybrid WAN. Simplifying operations with automation and cloud-based management with Sophos Central, Sophos Firewall enables you to achieve flexible, resilient, and easy SD-WAN features.

Highlights

• Performance-based link selection
• routing with zero-impact fail-over
• Xstream FastPath Acceleration
• SD-WAN orchestration tools
• Cloud-based management
• Real-Time Performance Monitoring

Public and Private cloud Protection

Sophos Firewall puts forward competitive network visibility, protection, and response to secure your public, private, and hybrid cloud environments. Strengthen your cloud servers against hacking attempts alongside providing secure access to users with reverse proxy authentication.

Highlights

• All-in-One Protection
• Unmatched Visibility
• Synchronized Security
• Central Cloud Management
• Deploy in Minutes
• Cloud-based sandboxing