At Sophos, your safety is our prime precedence. We now have invested in making Sophos Firewall probably the most safe firewall in the marketplace – and we constantly work to make it probably the most tough goal for hackers.
To reinforce your safety posture, we strongly encourage you to often overview and implement these finest practices throughout all of your community infrastructure, whether or not from Sophos or every other vendor.
Learn on for full directions or obtain the Sophos Firewall hardening finest practices.
Hold firmware updated
Each Sophos Firewall OS replace consists of vital safety enhancements – together with our newest launch, Sophos Firewall v21.
Make sure you preserve your firmware updated underneath Backup & Firmware > Firmware. Verify not less than as soon as a month for firmware updates in Sophos Central or the on-box console. You may simply schedule updates in Sophos Central to be utilized throughout a interval of minimal disruption.
On-line guides:
Restrict gadget service entry
It’s critically vital that you simply disable non-essential companies on the WAN interface. Specifically, HTTPS and SSH admin companies.
To handle your firewall remotely, Sophos Central affords a way more safe resolution than enabling WAN admin entry. Alternatively, use ZTNA for distant administration of your community units.
Verify your native companies entry management underneath Administration > Gadget Entry and guarantee no objects are checked for the WAN Zone until completely essential:
On-line guides:
Use robust passwords, multi-factor authentication, and role-based entry
Allow multi-factor authentication or one-time password (OTP) and implement robust passwords, which is able to shield your firewall from unauthorized entry – both from stolen credentials or brute pressure hacking makes an attempt.
Guarantee your sign-in safety settings are set to dam repeated unsuccessful makes an attempt and implement robust passwords and CAPTCHA. Additionally use role-based entry controls to restrict publicity.
On-line guides:
Decrease entry to inner programs
Any gadget uncovered to the WAN by way of a NAT rule is a possible danger. Ideally, no gadget needs to be uncovered to the web by way of NAT or inbound connections, together with IoT units.
Audit and overview all of your NAT and firewall guidelines often to make sure there aren’t any WAN to LAN or distant entry enabled. Use ZTNA (and even VPN) for distant administration and entry to inner programs – DO NOT expose these programs, particularly Distant Desktop entry to the Web.
For IoT units, shut down any units that don’t supply a cloud proxy service and require direct entry by way of NAT – these units are supreme targets for attackers.
On-line guides:
Allow acceptable safety
Shield your community from exploits by making use of TLS and IPS inspection to incoming untrusted visitors by way of related firewall guidelines. Tune your TLS and IPS inspection and make the most of trusted utility FastPath offloading to get the very best safety and efficiency to your specific surroundings. Make sure you don’t have any broad firewall guidelines that permit ANY to ANY connections.
Additionally shield your community from each DoS and DDoS assaults by setting and enabling safety underneath Intrusion Prevention > DoS & spoof safety. Allow spoof prevention and apply flags for all DoS assault varieties.
Block visitors from areas you don’t do enterprise with by establishing a firewall rule to dam visitors originating from undesirable international locations or areas.
Guarantee Sophos X-Ops risk feeds are enabled to log and drop underneath Lively Menace Safety.
On-line guides:
Allow alerts and notifications
Sophos Firewall could be configured to alert directors of system-generated occasions. Directors ought to overview the record of occasions and examine that system and safety occasions are monitored to make sure that points and occasions could be acted upon promptly.
Notifications are despatched by way of both an e mail and/or to SNMP traps. To configure Notifications, navigate to Configure > System companies and choose the Notifications record tab.
On-line guides:
Extra information
You should definitely take a look at how Sophos Firewall is Safe By Design and seek the advice of the in depth on-line documentation and how-to movies to take advantage of your Sophos Firewall.
