TMA-SOPHOS-3.3
Ensure ‘Hotfix' is set to ‘Allow Automatic Installation of hotfixes'
MediumLevel 1Manual reviewsophos
Description
Set hotfixes to be applied automatically whenever there is an out-of-band security update is available for the device. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
Access Sophos CLI 'Select Option 4> system hotfix show'. Verify that 'system hotfix show output is Hotfix is enabled'.
How it is fixed
Fix method: Guidance or infrastructure patch
Access the Sophos CLI, select option 4 (Device Console) and run: system hotfix enable Confirm with: system hotfix show (output: Hotfix is enabled).
Properties
- Operating systems
- Any
- Tags
- sophosupdates
- Reference
- CIS Sophos Firewall v22 Benchmark v1.0.0 - 3.3 Ensure ‘Hotfix' is set to ‘Allow Automatic Installation of hotfixes'