Ensure Zero-day protection is enabled at the firewall rule for web protection and does not exclude any file type from zero-day protection analysis

高等級 2人工審核sophos

說明

By enabling ‘Use Zero-day protection' at the firewall rule increases the possibility of identifying unknown viruses. And ensure administrator does not exclude file types from Zero-day protection analysis. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

For firewall rules that allowed outbound traffic to the internet should be enabled with ‘Use zero-day protection'. Navigate to 'Protect > Rules and policies > Firewall rules' existing firewall rule with allowed outbound traffic and verify 'Security features > Web filtering > Malware and content scanning > Scan HTTP and decrypted HTTPS', 'Use zero-day protection' and 'Scan FTP for malware' is checked. Navigate to 'Monitor & Analyze > Zero-day protection > Protection Settings' and verify 'Exclude file types' to ensure there are no file type is exempted from Sandbox analysis.

修補方式

修補方法: 操作指南或基礎設施修補檔

Navigate to 'Protect > Rules and policies > Firewall rules' existing firewall rule with allowed outbound traffic and configure 'Security features > Web filtering > Malware and content scanning > Scan HTTP and decrypted HTTPS', 'Use Zero-day protection' and 'Scan FTP for malware' is checked. Navigate to 'Monitor & Analyze > Zero-day protection > Protection Settings' and remove file type exceptions from 'Exclude file types'.

屬性

作業系統: 不限
標籤: sophosthreat-prevention
參考資料: CIS Sophos Firewall v22 Benchmark v1.0.0 - 4.2 Ensure Zero-day protection is enabled at the firewall rule for web protection and does not exclude any file type from zero-day protection analysis