At Sophos, your safety is our high precedence. We’ve got invested in making Sophos Firewall essentially the most safe firewall available on the market – and we repeatedly work to make it essentially the most troublesome goal for hackers.
To reinforce your safety posture, we strongly encourage you to repeatedly evaluation and implement these greatest practices throughout all of your community infrastructure, whether or not from Sophos or every other vendor.
Learn on for full directions or obtain the Sophos Firewall hardening greatest practices.
Maintain firmware updated
Each Sophos Firewall OS replace consists of necessary safety enhancements – together with our newest launch, Sophos Firewall v21.
Make sure you preserve your firmware updated beneath Backup & Firmware > Firmware. Examine no less than as soon as a month for firmware updates in Sophos Central or the on-box console. You’ll be able to simply schedule updates in Sophos Central to be utilized throughout a interval of minimal disruption.
On-line guides:
Restrict machine service entry
It’s critically necessary that you just disable non-essential providers on the WAN interface. Specifically, HTTPS and SSH admin providers.
To handle your firewall remotely, Sophos Central gives a way more safe resolution than enabling WAN admin entry. Alternatively, use ZTNA for distant administration of your community units.
Examine your native providers entry management beneath Administration > Gadget Entry and guarantee no objects are checked for the WAN Zone except completely essential:
On-line guides:
Use sturdy passwords, multi-factor authentication, and role-based entry
Allow multi-factor authentication or one-time password (OTP) and implement sturdy passwords, which can shield your firewall from unauthorized entry – both from stolen credentials or brute pressure hacking makes an attempt.
Guarantee your sign-in safety settings are set to dam repeated unsuccessful makes an attempt and implement sturdy passwords and CAPTCHA. Additionally use role-based entry controls to restrict publicity.
On-line guides:
Reduce entry to inner programs
Any machine uncovered to the WAN through a NAT rule is a possible threat. Ideally, no machine needs to be uncovered to the web through NAT or inbound connections, together with IoT units.
Audit and evaluation all of your NAT and firewall guidelines repeatedly to make sure there aren’t any WAN to LAN or distant entry enabled. Use ZTNA (and even VPN) for distant administration and entry to inner programs – DO NOT expose these programs, particularly Distant Desktop entry to the Web.
For IoT units, shut down any units that don’t supply a cloud proxy service and require direct entry through NAT – these units are preferrred targets for attackers.
On-line guides:
Allow applicable safety
Defend your community from exploits by making use of TLS and IPS inspection to incoming untrusted visitors through related firewall guidelines. Tune your TLS and IPS inspection and benefit from trusted utility FastPath offloading to get the most effective safety and efficiency in your explicit atmosphere. Make sure you don’t have any broad firewall guidelines that permit ANY to ANY connections.
Additionally shield your community from each DoS and DDoS assaults by setting and enabling safety beneath Intrusion Prevention > DoS & spoof safety. Allow spoof prevention and apply flags for all DoS assault sorts.
Block visitors from areas you don’t do enterprise with by organising a firewall rule to dam visitors originating from undesirable international locations or areas.
Guarantee Sophos X-Ops menace feeds are enabled to log and drop beneath Lively Risk Safety.
On-line guides:
Allow alerts and notifications
Sophos Firewall could be configured to alert directors of system-generated occasions. Directors ought to evaluation the listing of occasions and verify that system and safety occasions are monitored to make sure that points and occasions could be acted upon promptly.
Notifications are despatched through both an e mail and/or to SNMP traps. To configure Notifications, navigate to Configure > System providers and choose the Notifications listing tab.
On-line guides:
Extra data
You’ll want to try how Sophos Firewall is Safe By Design and seek the advice of the intensive on-line documentation and how-to movies to take advantage of your Sophos Firewall.
