Ensure Email protection is configured with appropriate protection policies

Como é verificado

Método de auditoria: Revisão manual

Esta recomendação não pode ser verificada automaticamente. Uma varredura a lista com estas instruções quando você passa --include-manual.

Navigate to 'Protect > Email > General settings'. Verify that appropriate 'SMTP deployment mode' is used. Note that 'legacy mode' is not compatible with Zero-day protection for Email. Navigate to 'SMTP settings'. Verify that 'Reject based on IP reputation'. Sophos Firewall checks the sender's IP reputation before the spam checks specified in the SMTP policy. Verify that 'SMTP DoS settings' is Enable. Sophos Firewall protects the network from SMTP denial-of-service attacks. Navigate to 'SMTP TLS configuration'. Verify that 'Disable legacy TLS protocols' is Enable. (Full steps: CIS 5.6.)

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Navigate to 'Protect > Email > General settings'. Set the appropriate 'SMTP deployment mode' to 'MTA mode' when possible. 'legacy mode' is not compatible with Zero-day protection for Email and reduce the security effectiveness. Navigate to 'SMTP settings'. Set 'Reject based on IP reputation' to Enable. Sophos Firewall checks the sender's IP reputation before the spam checks specified in the SMTP policy. Set 'SMTP DoS settings' to Enable. Sophos Firewall protects the network from SMTP denial-of-service attacks. Navigate to 'SMTP TLS configuration'. Set 'Disable legacy TLS protocols' to Enable. To overcome TLS vulnerabilities, it is recommended to turn off legacy TLS protocols. Navigate to 'POP and IMAP TLS configuration'. Set 'Disable legacy TLS protocols' to Enable. Navigate to 'Malware protection'. Set 'Primary antivirus engine' to 'Sophos'. If 'Avira' is selected Sophos Firewall will turn off Zero-day protection in SMTP policies with single antivirus scan. Navigate to 'DKIM verification'. Set 'DKIM verification' to 'ON' and 'DKIM verification failed', 'Invalid DKIM signature', 'No DKIM signature found' are set to 'Quarantine' or 'Reject'. With DKIM the firewall validates the source domain name and message integrity through cryptographic authentication, preventing email spoofing. DKIM verification is applied to inbound emails. Note that Sophos Firewall quarantines DKIM-signed emails that use RSA SHA-1 or have key length less than 1024 or more than 2048 bits. Navigate to 'Protect > Email > Relay settings > Host based relay'. Remove 'ANY' from the 'allow relay from hosts/networks'. Adding 'ANY' will result in an open relay, allowing anyone on the internet to send emails through Sophos Firewall. Set only the specified host or enable authenticated relay. (see the CIS PDF for the remaining steps)