Ensure Synchronized Security Heartbeat is enforced on Firewall Rules

Como é verificado

Método de auditoria: Revisão manual

Esta recomendação não pode ser verificada automaticamente. Uma varredura a lista com estas instruções quando você passa --include-manual.

Navigate to 'System > Sophos Central '. Verify that 'Security Heartbeat' is turned 'ON'. Check that Sophos firewall is registered to Sophos Central, configured to receive Heartbeat from the Sophos Endpoints. Navigate to 'Protect > Rules and Policies > Firewall rules'. Filter 'Rule type >' 'Network' and 'User', filter 'source zone > LAN' and 'DMZ'. Verify on the configured firewall rule 'Configure Synchronized Security Heartbeat' and check that 'Minimum source HB permitted' is set to 'Green' or 'Yellow'. (Full steps: CIS 4.4.)

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Navigate to 'System > Sophos Central > Register . Register Sophos Firewall to Sophos Central, set 'Security Heartbeat' to 'ON'. Navigate to 'Protect > Rules and Policies'. Filter 'Rule type > Network' and 'User', filter 'source zone > LAN' and 'DMZ'. Navigate to configured firewall rule with 'Configure Synchronized Security Heartbeat'. Set 'Minimum source HB permitted' to 'Green' or 'Yellow'. If the rule is configured to allow Egress traffic with Sophos Endpoints are connecting resources on 'WAN' zone, set 'Minimum source HB permitted' to either 'Green' or 'Yellow' for tighter security control. If the rule is configured to allow traffic between 'LAN' to 'DMZ' zones with communication between Sophos protected Endpoints and Server, configure additional control with setting both 'Minimum source HB permitted' and 'Minimum destination HB permitted' to either 'Green' or 'Yellow'.