Sophos Firewall
TMA-SOPHOS-4.3
Ensure Zero-day protection is enabled for Email Protection and set to MTA mode
Описание
By enabling ‘Use zero-day protection' at the SMTP policy increases the possibility of identifying unknown viruses delivered through email gateway. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).
Как проверяется
Метод проверки: Ручная проверка
This configuration option is only applicable when the device is configured with 'MTA mode' and set 'Sophos' as primary malware scanning engine. Navigate to 'Protect > Email'. Verify the existing SMTP policy 'Malware protection > Scanning > Single anti-virus (this set the scan engine to Sophos ) is set and Selected antivirus action' to 'Drop'. Email attachment successfully verified by antivirus engine as malicious should be set to 'Drop'. (Full steps: CIS 4.3.)
Как исправляется
Метод исправления: Рекомендация или патч инфраструктуры
This configuration option is only applicable when the device is configured with 'MTA mode' and set 'Sophos' as primary malware scanning engine. Navigate to 'Protect > Email'. Verify the existing SMTP policy and set 'Malware protection > Scanning > Single anti-virus( this set the scan engine to Sophos) is set and Selected antivirus action' to 'Drop'. Email attachment successfully verified by antivirus engine as malicious should be set to 'Drop'. 'Quarantine unscannable content' is checked to prevent files with multiple layers of compression and password protected archives files that cannot be scanned by antivirus engine should be 'quarantined'. Set 'Use zero-day protection' is checked
Свойства
- Операционные системы
- Любая
- Теги
- sophosthreat-prevention
- Источник
- CIS Sophos Firewall v22 Benchmark v1.0.0 - 4.3 Ensure Zero-day protection is enabled for Email Protection and set to MTA mode