Sophos Firewall
TMA-SOPHOS-4.3
Ensure Zero-day protection is enabled for Email Protection and set to MTA mode
Description
By enabling ‘Use zero-day protection' at the SMTP policy increases the possibility of identifying unknown viruses delivered through email gateway. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).
Méthode de vérification
Méthode d'audit: Revue manuelle
This configuration option is only applicable when the device is configured with 'MTA mode' and set 'Sophos' as primary malware scanning engine. Navigate to 'Protect > Email'. Verify the existing SMTP policy 'Malware protection > Scanning > Single anti-virus (this set the scan engine to Sophos ) is set and Selected antivirus action' to 'Drop'. Email attachment successfully verified by antivirus engine as malicious should be set to 'Drop'. (Full steps: CIS 4.3.)
Méthode de correction
Méthode de correction: Recommandation ou correctif d'infrastructure
This configuration option is only applicable when the device is configured with 'MTA mode' and set 'Sophos' as primary malware scanning engine. Navigate to 'Protect > Email'. Verify the existing SMTP policy and set 'Malware protection > Scanning > Single anti-virus( this set the scan engine to Sophos) is set and Selected antivirus action' to 'Drop'. Email attachment successfully verified by antivirus engine as malicious should be set to 'Drop'. 'Quarantine unscannable content' is checked to prevent files with multiple layers of compression and password protected archives files that cannot be scanned by antivirus engine should be 'quarantined'. Set 'Use zero-day protection' is checked
Propriétés
- Systèmes d'exploitation
- Tous
- Étiquettes
- sophosthreat-prevention
- Référence
- CIS Sophos Firewall v22 Benchmark v1.0.0 - 4.3 Ensure Zero-day protection is enabled for Email Protection and set to MTA mode