Did you know that even Microsoft Office 365 customers aren’t automatically protected against data loss? Businesses therefore need to take action themselves if they want to preserve their emails in the long term.

An email archiving solution can be a key component when it comes to protecting and retaining business-critical emails in the long term. But a decision as to which solution is best suited to the needs of a company is often not an easy one to take.

Do you know it? Do you ever use it? Have you ever hit it by accident when trying to delete an email? We’re talking about that mysterious Archive button in your Microsoft Outlook ribbon. Some find it useful; we reckon it can be misleading. Because you don’t need to be an expert in email archiving to know that the Archive button doesn’t meet the requirements of a professional archiving product when it comes to processing emails.

The Archive Button Moves Emails

So what does the button actually do? Basically, it enables you to move an email from your inbox to an archive folder, that’s still part of your personal inbox. While it may go under the name of archiving, all the option really does is shift emails from the inbox to a separate folder called “Archive” instead of deleting them; the emails aren’t actually transferred to a genuine archive. By definition, an archive is the final storage place of documents at the end of a chain of prior usages and, as such, must be capable of retaining this material permanently, e.g. by deploying special safeguards. The arrival of the EU GDPR and other such regulatory requirements mean that email archiving has become quite a complex matter in everyday corporate practice. At the same time, an archive’s job is to ensure that all its records – in this case, emails – remain preserved, available, and retrievable at all times.

Mailbox Volume not Reduced

Also, because this form of “archiving” doesn’t reduce the overall data volume in your mailbox (and on the email server), it doesn’t help solve issues relating to mailbox quotas. If you’re the sort of person who likes to create endless subfolders in your inbox and spend lots of time moving incoming emails to these folders, then the Archive button could help you save time. Because by doing so, you keep your inbox lean, ALL your emails are kept in the same Archive folder, and you can use Outlook’s search function to find emails in this folder. To what extent these sometimes lengthy searches eat into any time savings made is for you to judge.

What Does the Term Archive Mean at Microsoft?

The concept of email archiving isn’t always clear-cut and can be interpreted differently according to objectives, applications, and functions. Microsoft, for example, uses the word “archive” for other functions in its Outlook, Exchange Server, and Microsoft 365 products:

1. AutoArchive (Microsoft Outlook): AutoArchive is an outdated option embedded in Microsoft Outlook that allows you to move emails to a separate PST file stored on your computer’s hard drive. Although still available today (File / Info / Tools / Mailbox Cleanup / AutoArchive), it’s not to be recommended: it’s common knowledge that PST files are difficult to process, hard to back up, and prone to corruption – you should get rid of them altogether!
2. In-Place Archive (Exchange Server; Microsoft 365): Companies using Microsoft Exchange Server either on-premises or as part of their Microsoft 365 instance can use the available email archiving option by creating a “personal archive” or an “In-Place Archive” for every user mailbox, thus achieving the maximum possible integration of the archiving functionality in Exchange Server and Microsoft Outlook. This type of archiving can, however, place huge demands on the IT infrastructure. Especially in the case of small and mid-sized businesses, these additional requirements and the extra financial investment necessary can pose a challenge. Implementing MailStore Server can provide considerable relief in cases like this.
3. Exchange Online Archiving (Microsoft 365): Microsoft 365 provides an online archive for the long-term storage of emails, and especially for overflowing mailboxes. The online archive is displayed as a separate mailbox in the left pane of Outlook. Once set up, older messages are automatically transferred to the online archive so as to keep the size of the primary Outlook mailbox in check. Businesses should keep in mind, however, that Exchange Online Archiving (EOA) is included in specific Microsoft 365 plans only. With many other subscriptions, you will need to add EOA as an additional, paid service to your existing Microsoft 365 plan.

Whitepaper Sheds Light on Email Archiving With Microsoft 365

Email archiving in Microsoft 365, in particular, provides a company with endless options. A whitepaper drawn up by Marketing Research Institute Osterman Research on behalf of MailStore offers a profound insight into the benefits and limitations of the product’s native features.

The paper examines, among other aspects, those features your company really needs and whether your business would be better served by a third-party solution like MailStore Server or the native archiving options provided by Microsoft 365.

“In general, we believe that businesses stand to benefit from our email archiving software on six counts,” says Björn Meyn, Product Manager at MailStore. “Besides the opportunity to fulfill regulatory and compliance requirements, protection against data loss, and the elimination of mailbox quotas, companies can increase their productivity and efficiency, while saying “goodbye” to PST files once and for all. There’s also the advantage of independence from email service providers! And if the email system should ever fail or data be lost, authorized users within the company can simply access their emails via the archive.”

According to data from the “US Bureau of Labor Statistics” some 3 million Americans leave their jobs voluntarily, and according to another study by BambooHR, in a survey of 1000 workers, a third admitted to having spent less than 6 months in a job before changing.

These figures are for the United States, but in Europe the numbers of workers who leave are similar. According to this ADP study, one third of European workers plan to change jobs in the next three years. There is also talk of a war for talent in different sectors such as technology, health services and professional services, in this other Glassdoor report on employment trends for 2020.

Without going into the reasons, advantages or disadvantages of these turnover rates, companies are continually faced with the reality of workers moving to other companies that may or may not be competitors. During the time that workers have been in the company they have had access to private or confidential information to a greater or lesser extent depending on the type of position or company.

Ex-employees often take confidential data and information with them

According to a study conducted by Osterman Reasearch, 69% of the organizations surveyed have suffered a loss of data or knowledge as a result of employee departure: Whether intentional or by mistake, employees may take financial, confidential, customer information, product data, marketing, roadmaps as well as intellectual property to other companies.

There is concern about this type of situation in the management of companies of any size: Employees who go to other companies or to the competition and may carry know-how with them that may lead to loss of competitive advantage. We also find in the press continuously striking cases, but the reality is that it happens every day in different sectors and company sizes.

Sometimes, when a worker leaves the company, they usually see nothing wrong with taking with them data they have been working with during the time they have been in the company. This is true in any sector and any type of job.

For example, a salesperson may see it as normal to take all of the organization’s customer contact data with them, with email, positions, phone numbers, etc. Or if someone works in the engineering field, they may consider it fair to take information about projects, procedures, quality guides, support, designs, etc. that they have been working on. The same applies to software: source code of the applications they have been working on, documentation, projects, etc.

The most common thing is that the person who takes this information does not have any malicious intention. He simply goes to another position in another company, and to do his job well and meet expectations, he considers that at some point he can use this information from the previous position.

How to prevent ex-employees from carrying documents and sensitive information?

The problem is that a good part of companies face this kind of situation when it is already too late. When the employee has left, and it is difficult to know if the sensitive documentation has already been taken, or it is difficult to prove it.

Beyond ethical issues, this is a reality that many companies face on a daily basis. What can be done to prevent this type of situation? We can find different kinds of approaches:

• Notify employees of ownership of information: This is usually done when a person joins the workforce and is given company guidelines or policies or clauses in the contract. The reality is that this is not always read and over time it is forgotten

• Implementing device control tools: Which prevent copying to USBs, etc. These systems have already become obsolete with the boom of the cloud, access to mobile devices, etc. as the information can be anywhere

• With policies to prevent information leaks through DLP systems, CASB, etc: However, many times employees need to work with the information at home, pass it to unmanaged devices, etc. and it is not always possible to prevent sensitive information from being left out of the control of these types of tools.

• Monitoring user behavior (UEBA tools; User Entity Behaviour Analytics) that indicate if a user is having strange behavior patterns regarding the management of sensitive documentation. Perhaps it can be useful if we detect many downloads the week before leaving the company, but many times the information goes out of the control of the company months before, normally, simply because the workers must use it at home, etc.

These methods or systems are limited and often organizations try to use them when it’s too late and the damage has already been done. However, in extreme situations, there is no choice but to use the legal route with the very high costs that this can entail for the organization.

The most effective solution: Data-centric protection

Information can be anywhere, and if it is of value to the company, we must protect it wherever it is. We can protect this type of information through data-centric protection technologies such as SealPath. How so?

• Keep information secure and under control whether it is within the company or if an employee takes it home to work, to other devices etc.

• Limit what others can do with the documents: View only, view and edit only, but not print or copy and paste, etc.

• Have a complete accessibility control: Who accesses it, when, or if someone is trying to open it without permission

• Be able to block access to information in real time even if it is no longer in our hands and is on other computers or networks

[ Know More: DOWNLOAD SEALPATH DATASHEET ]

Protect your sensitive information now, and without waiting for someone to leave and take valuable company data with them. Contact SealPath and we will show you how we can help.

Structure… it is something we humans need in our life to function and survive. We rely on routines and structure to bring an element of predictability to our lives, which in turn makes us feel safe. I think it is fairly safe to say that the situations that have evolved quickly around us in the last few weeks due to the effects of Covid-19 has rocked a lot of the structure in people’s day-to-day lives. For most organisations, these changes in structure have seen the majority of their workforce shifting from office-based working to remote, home working.

For many users, this is a big change, and organisations have been working hard to prepare their users as best they can to provide as much structure as they can amidst these current changes. However, the one thing that organisations cannot afford to risk here is the structure when protecting their data.

Structure is ever more important when dealing with remote users, especially when it has been enforced rather than a choice made by the user. Moving to a home environment means we can lose a lot of the structure provided to us in an office. Away from the common working practices and thought processes of an office environment, remote working factors in more challenges, and it means we may lose sight of the things that are normal to us or are taken for granted in  in day-to-day work life. For example, users may face unfamiliar distractions, and be challenged by different focuses and mindsets. Working all these factors in, remote working is a different beast to the safety, and structure, of the office.

Therefore, we may find users are occasionally distracted from performing tasks as they usually would, and security may not be the top of their agenda. Organisations need to make sure they are providing users with the tools to ensure that guards are not being let down simply because of a location and focal change – in essence sticking to the same standards and associated structure that would be provided in the office environment.

Whether working at home or in the office, a structured data protection policy, using solutions such as data classification and DLP, reinforces the need to control how data is managed. Using these tools, employees are reminded and empowered to apply security policy through the hands on classification of all documents and emails as they are created. Documents and data are protected, security policy is embraced and corporate compliance standards are met.

Boldon James Classifier gives your employees structure to data protection. The process begins by setting a classification policy in line with the business requirements, and every new document created must be classified in line with that policy, a structure by which they can follow easily. It takes the pressure off decision making for the user, as they can follow the correct path using customised prompts in order to best classify the document as required. It may seem a trivial step to providing structure for your employees, but these routines allow users to feel safe that they are doing the right thing in protecting sensitive data, giving them one less thing to worry about.

With your users empowered in this way, they are less likely to make mistakes, and organisations know that no matter where their users are, they can continue to ensure sensitive data is being protected in line with regulatory compliance, meaning you can remain safe, compliant and in control.

A new ransomware variant dubbed “ColdLock” has emerged in Taiwan where it’s having a devastating effect on impacted organizations.

Fortunately, Sophos Intercept X gives the cold shoulder to ColdLock, blocking the attack before it can hold you hostage.

Stop ColdLock with Intercept X

ColdLock is a file-less attack. It runs from a PowerShell script where the ransomware code is directly loaded into memory and then executed, all without writing an executable file to the disk.

Intercept X is packed with technologies that protect your organization from ColdLock and other ransomware variants:

• Exploit protection stops the techniques used in file-less, malware-less, and exploit-based attacks.
• CryptoGuard technology stops the unauthorized encryption of files by ransomware, rolling any impacted files back to their original state.
• The deep learning engine uses cutting-edge machine learning to identify and block never-before-seen ransomware before it executes.
• Credential Theft stops privilege escalation, preventing hackers from moving round your system

Plus, the built-in EDR tools give you detailed insight into what happened, so you can see where the threat got in, what it touched, and when it was blocked.

See Intercept X in action

Try out the demo!

Log in to our fully populated demo environment to try Intercept X for yourself. No obligation, no waiting, no set up. Just a ready-to-go demo.

We are thrilled to announce that Intercept X received a 100% total accuracy rating in the enterprise, SMB, and consumer protection tests by SE Labs.

Whether you are protecting your employees at work, or them and their families at home, you will get outstanding protection with Intercept X technology.

The world’s best endpoint protection

Intercept X is the strongest endpoint security on the market, delivering more advanced protection in one solution than anything else out there.

Deep learning AI excels at detecting and neutralizing threats that have never been seen before. Anti-ransomware protection blocks malicious encryption processes and returns affected files to safe, unencrypted states. Advanced defenses against fileless, memory-based attacks keep your organization safe against the latest obfuscated, script-based threats.

Intercept X also includes options for Endpoint Detection and Response (EDR), so you can perform detailed threat hunting and IT security operations hygiene across your endpoints and servers, and a managed service (MTR) that gives you access to a team of Sophos cybersecurity specialists that will hunt threats and take appropriate action on your behalf.

Constant innovation

Our team of cybersecurity experts are constantly enhancing the powerful features in Intercept X. This year alone we’ve incorporated:

• AMSI protection – enhanced protection against fileless attacks, such as obfuscated PowerShell scripts
• Intrusion Prevention System – protects devices against network-based attacks (currently in early access)
• EFSGuard, CTFGuard, and more

Try Intercept X for free

Testing the powerful features in Intercept X couldn’t be more straightforward. Take a free 30 day trial, or if you’d like to learn more head over to Sophos.com.

For a limited time, Sophos customers can add Sophos Home edition at no addition cost.

To view the detailed results from SE Labs: Enterprise | SMB | Consumer

Αυτό το τριήμερο πρόγραμμα εκπαίδευσης σχεδιάστηκε και προορίζεται για έμπειρους τεχνικούς που θέλουν να εγκαθιστούν, αναπτύσσουν, διαμορφώνουν και να υποστηρίζουν το XG Firewall σε παραγωγικά περιβάλλοντα και είναι το αποτέλεσμα βαθιάς μελέτης πάνω στο τείχος προστασίας επόμενης γενιάς της Sophos.
Το πρόγραμμα αποτελείται από παρουσιάσεις και πρακτικές ασκήσεις εργαστηρίων για την ενίσχυση του διδακτικού περιεχομένου. Λόγω της φύσης της παράδοσης και της ποικίλης εμπειρίας των εκπαιδευομένων, ενθαρρύνεται η ανοικτή συζήτηση κατά τη διάρκεια της εκπαίδευσης/ κατάρτισης.

Sophos XG Architect Training (Τρίτη 16 Ιουνίου 2020– Πέμπτη 18 Ιουνίου 2020)

(3 days Training)

Προαπαιτούμενα

XG Firewall _ Certified Engineer course and delta modules up to version 18.0

Συνιστώμενες γνώσεις

• Knowledge of networking to a CompTIA N+ level
• Knowledge of IT security to a CompTIA S+ level
• Experience configuring network security devices
• Be able to troubleshoot and resolve issues in Windows networked environments
• Experience configuring and administering Linux/UNIX systems

Περιεχόμενο της εκπαίδευσης

• Module 1: Deployment
• Module 2: Base Firewall
• Module 3: Network Protection
• Module 4: Synchronized security
• Module 5: Web server Protection
• Module 6: Site to site connections
• Module 7: Authentications
• Module 8: Web Protection
• Module 9: Wireless
• Module 10: Remote Access
• Module 11: High Availability
• Module 12: Public Cloud

Certification

+ exam: Sophos XG Architect

Διάρκεια: 3 ημέρες

Πρόγραμμα

Εκπαιδευτής: Μιχάλης Ελευθέρογλου

Ημέρα 1η 16 Ιουνίου  2020

9:30-10:45 Module 1: Module 1: Deployment and Lab

• Recall important information from Engineer courses
• Deployment modes supported by the XG Firewall
• Understand a range of scenarios where each deployment mode would commonly be used
• Use built-in tools to troubleshoot issues
• Labs

10:45-11:00 Διάλειμμα
11:00-13:00 Module 2: Base Firewall

• Explain how the XG firewal can be accessed
• Understand the types fo interfaces that can be created
• Understand the benefits of Fast Path Technology
• Configure routing per firewall rule
• Understand best practice for ordering firewall rules
• Explain what Local NAT policy is and known how to configure it.

13:00-14:00 Διάλειμμα
14:00-16:00 Labs

• Activate the Sophos XG Firewalls
• Post installation Configuration
• Bridge interfaces
• Create a NAT rule to load balance access to servers
• Create a local NAT policy
• Configure routing using multiple WAN links
• Configure policy-based routing for an MPLS scenario
• Install Sophos Central

16:00-16:15 Διάλειμμα
16:15-17:15 Module 3: Network Protection and Lab

• Explain what IPS is and how traffic can be offloaded to Fastpath
• Demonstrate how to optimize workload y configuring IPS policies
• Examine advanced Intrusion Prevention and optimize policies
• Configure advanced DOS Protection rules
• Demonstrate how the strict policy can be used to protect networks
• Labs- Create Advanced DoS Rules

Ημέρα 2η Τετάρτη 17 Ιουνίου 2020

9:30-11:00: Module 4: Synchronized Security and Labs

• Explain how Security Heartbeat works
• Configure Synchronized Security
• Deploy Synchronized Security in discover and inline modes
• Understand the advantages and disadvantages of deploying
• Synchronizes Security in different scenarios
• Labs
• Configure source-Based Security
• Hearteat firewall rules
• Destination based Security Heartbeat
• Missing Security Heartbeat
• Lateral Movement Protection

11:00-11:15 Διάλειμμα
11:15-13:45 Module 5 Webserver Protection and Labs

• Explain how Websever Protection works
• Describe protection features for a web application
• Configure Web Server authentication
• Publish a web service using the Web Application Firewall
• Use the preconfigured templates to configure Web Server Protection for common purposes
• Configure SlowHTTP protection
• Labs (Web Application Firewall)
• Labs (Load balancing with Web Server Protection)
• Labs (Web Server Authentication and path-specific routing)

13:45-14:45 Διάλειμμα και Γεύμα
14:45-17:45 Module 6: Site to site connections and Labs

• Configure and deploy site to site VPNs in a wide range of environment
• Implement IPsec NATing and failover
• Check and modify route precedence
• Create RED tunnels between XG firewalls
• Understand when to use RED
• Labs ( Create an IPsec site to site VPN
• Labs ( Configure VPN network NATing )
• Labs (Configure VPN failover)
• Labs (Enable RED on the XG firewall)
• Labs (Create a RED tunnel between two XG Firewalls
• Labs (Configure routing for the RED tunnel)
• Labs (Configure route-based VPN)

Ημέρα 3η Πέμπτη 18 Ιουνίου 2020

9:00-10:00 Module 7: Authentications and Labs

• Demonstrate how to configure and use RADIUS accounting
• Deploy STAS in large and complex environment
• Configure SATC and STAS together
• Configure Secure LDAP and identify the different secure connections available
• Labs (configure an Active Directory Authentication server)
• Labs (configure single sing-on using STAS
• Labs (Authenticate users over a site to site VPN)

10:00-11:15 Module 8: Web Protection

• Choose the most appropriate type for web protection in different deployment scenarios
• Enable web filtering using the DPI engine or legacy web proxy
• Configure TLS inspection using the DLP engine or legacy web proxy
• Labs (Install the SSL CA certificate)
• Labs (Configure TLS inspection rules)
• Labs (Create a custom web policy for users)

11:15-11:30 Διάλειμμα
11:30-12:15 Module 9: Wireless

• Explain how Sophos Access Points are deployed and identify some common issues
• Configure RADIUS authentication
• Configure a mesh network

12:15-13:05 Module 10: Remote Access

• Configure Sophos Connect and manage the configuration using Sophos Connect Admin
• Configure an IPsec remote access VPN
• Configure an L2TP remote access VPN for mobile devices
• Labs (Sophos Connect)

13:05-14:25 Module 11: High Availability 

• Explain what HA is and how it operates
• Demonstrate how to configure HA and explain the difference between quick and manual configuration
• List the prerequisites for high availability
• Perform troubleshooting steps andc heck the logs to ensure that HA is set up correctly.
• Explain the packet flow in high availability
• Demonstrate how to disable HA
• Labs (Create an Active-Passive cluster)
• Labs (Disable High Availability)

14:25-15:05 Διάλειμμα και Γεύμα

15:05-16-15 Public Cloud and Labs

• Deploy XG firewall in complex network enviroments
• Explain how XG firewall process traffic and use this information to inform the configuration
• Configure advanced networking and protection features
• Deploy XG firewall on public cloud infrastructure
• Labs (Put a service in debug mode to gather logs)
• Labs (Retrieving log files)
• Labs (Troubleshoot an issue from an imported configuration file)
• Labs (Deploy an XG Firewall on Azure (simulation)

16:15 (Εξετάσεις)

This three-day training program was designed and intended for experienced technical professionals who want to install, configure and support the XG Firewall in production environments and is the result of an in-depth study on the next generation firewall of Sophos. The program consists of presentations and practical workshops for the enhancement of teaching content. Due to the nature of the traditions and the varied experience of the trainees, open discussion is encouraged during the training.

Sophos XG Architect Training (Tuesday 16 June 2020– Thursday 18 June 2020)

(3 days Training)

Requirement

XG Firewall _ Certified Engineer course and delta modules up to version 18.0

Recommended Knowledge

1. Knowledge of networking to a CompTIA N+ level
2. Knowledge of IT security to a CompTIA S+ level
3. Experience configuring network security devices
4. Be able to troubleshoot and resolve issues in Windows networked environments
5. Experience configuring and administering Linux/UNIX systems

Content

• Module 1: Deployment
• Module 2: Base firewall
• Module 3: Network Protection
• Module 4: Synchronized security
• Module 5: Web server Protection
• Module 6: Site to site connections
• Module 7: Authentications
• Module 8: Web Protection
• Module 9: Wireless
• Module 10: Remote Access
• Module 11: High Availability
• Module 12: Pulic Cloud

Certification

+ exam: Sophos XG Architect

Duration 3 days 

Agenda

Trainer: Micheal Eleftheroglou

Day 1 Tuesday 16 June  2020

9:30-10:45 Module 1: Deployment and Lab

• Recall important information from Engineer courses
• Deployment modes supported by the XG Firewall
• Understand a range of scenarios where each deployment mode would commonly be used
• Use built-in tools to troubleshoot issues
• Labs

10:45-11:00 break

11:00-13:00 Module 2: Base Firewall

• Explain how the XG firewal can be accessed
• Understand the types fo interfaces that can be created
• Understand the benefits of Fast Path Technology
• Configure routing per firewall rule
• Understand best practice for ordering firewall rules
• Explain what Local NAT policy is and known how to configure it.

13:00-14:00 Lunch

14:00-16:00  Labs

• Activate the Sophos XG Firewalls
• Post installation Configuration
• Bridge interfaces
• Create a NAT rule to load balance access to servers
• Create a local NAT policy
• Configure routing using multiple WAN links
• Configure policy-based routing for an MPLS scenario
• Install Sophos Central

16:00-16:15 Break

 16:15-17:15  Module 3:Network Protection and Lab

• Explain what IPS is and how traffic can be offloaded to Fastpath
• Demonstrate how to optimize workload y configuring IPS policies
• Examine advanced Intrusion Prevention and optimize policies
• Configure advanced DOS Protection rules
• Demonstrate how the strict policy can be used to protect networks
• Labs- Create Advanced DoS Rules

Day 2  Wednesday 17 June  2020

9:30-11:00 Module 4: Synchronized Security and Labs

• Explain how Security Heartbeat works
• Configure Synchronized Security
• Deploy Synchronized Security in discover and inline modes
• Understand the advantages and disadvantages of deploying
• Synchronizes Security in different scenarios
• Labs
• Configure source-Based Security
• Hearteat firewall rules
• Destination based Security Heartbeat
• Missing Security Heartbeat
• Lateral Movement Protection

11:00-11:15 Break

11:15-13:45 Module 5 Webserver Protection and Labs

• Explain how Websever Protection works
• Describe protection features for a web application
• Configure Web Server authentication
• Publish a web service using the Web Application Firewall
• Use the preconfigured templates to configure Web Server Protection for common purposes
• Configure SlowHTTP protection
• Labs (Web Application Firewall)
• Labs (Load balancing with Web Server Protection)
• Labs (Web Server Authentication and path-specific routing)

13:45-14:45 Break and Lunch

14:45-17:45 Module 6: Site to site connections and Labs

• Configure and deploy site to site VPNs in a wide range of environment
• Implement IPsec NATing and failover
• Check and modify route precedence
• Create RED tunnels between XG firewalls
• Understand when to use RED
• Labs ( Create an IPsec site to site VPN
• Labs ( Configure VPN network NATing )
• Labs (Configure VPN failover)
• Labs (Enable RED on the XG firewall)
• Labs (Create a RED tunnel between two XG Firewalls
• Labs (Configure routing for the RED tunnel)
• Labs (Configure route-based VPN)

Day 3 Thursday 18 June  2020

9:00-10:00 Module 7: Authentications and Labs

• Demonstrate how to configure and use RADIUS accounting
• Deploy STAS in large and complex environment
• Configure SATC and STAS together
• Configure Secure LDAP and identify the different secure connections available
• Labs (configure an Active Directory Authentication server)
• Labs (configure single sing-on using STAS
• Labs (Authenticate users over a site to site VPN)

10:00-11:15  Module 8: Web Protection

• Choose the most appropriate type for web protection in different deployment scenarios
• Enable web filtering using the DPI engine or legacy web proxy
• Configure TLS inspection using the DLP engine or legacy web proxy
• Labs (Install the SSL CA certificate)
• Labs (Configure TLS inspection rules)
• Labs (Create a custom web policy for users)

11:15-11:30 Break

11:30-12:15 Module 9: Wireless

• Explain how Sophos Access Points are deployed and identify some common issues
• Configure RADIUS authentication
• Configure a mesh network

12:15-13:05 Module 10:Remote Access

• Configure Sophos Connect and manage the configuration using Sophos Connect Admin
• Configure an IPsec remote access VPN
• Configure an L2TP remote access VPN for mobile devices
• Labs (Sophos Connect)

13:05-14:25 Module 11: High Availability

• Explain what HA is and how it operates
• Demonstrate how to configure HA and explain the difference between quick and manual configuration
• List the prerequisites for high availability
• Perform troubleshooting steps andc heck the logs to ensure that HA is set up correctly.
• Explain the packet flow in high availability
• Demonstrate how to disable HA
• Labs (Create an Active-Passive cluster)
• Labs (Disable High Availability)

14:25-15:05 Break – Lunch

15:05-16-15 Public Cloud and Labs

• Deploy XG firewall in complex network enviroments
• Explain how XG firewall process traffic and use this information to inform the configuration
• Configure advanced networking and protection features
• Deploy XG firewall on public cloud infrastructure
• Labs (Put a service in debug mode to gather logs)
• Labs (Retrieving log files)
• Labs (Troubleshoot an issue from an imported configuration file)
• Labs (Deploy an XG Firewall on Azure (simulation)

16:15  (Exams)

What strange times we are currently living in. With workers who are able to work from home (WFH) being told to do so, and essential key workers (emergency services, the military, essential supplies and utility industries) needing to brave the external environment. I have talked to many folks this week about their experience of WFH and hearing many of their woes. VPNs not able to sustain the volume of connections needed, applications which apparently are not set up for remote connections, through to security policies that are not able to determine which sensitive information should be allowed to be accessed from where.

What I have noticed is that WFH shows we are all human. Children in the background who need entertaining, dogs that need attention and cats that need stroking. All of a sudden we gain a more empathetic relationship with our clients and colleagues, and let’s face it most of us go to work because we need to support our family, whatever shape that may take. I am lucky that my daughter has a senior role in in the Emergency Room and that means with her now having to work full time to support Covid-19 patients, my wife and I get to spend more time with our grandson, and he has enlivened a few of my video conferences and help us all realise what is important in these times.

It is very easy for clients that I talk to, to take the option of do nothing, but once we get through the initial, and important, challenge of getting workers to be able to work remotely, they can start to look at how they can improve that experience. All organisations should consider the security of their data and information; more and more people are starting to understand that pure security based labelling is not sufficient. Restricted or sensitive actually mean nothing to a remote worker. If the system gives me access, then I will use it.  Personally I have already received in two days, three files which I am sure the originating organisations did not mean to send to me, because their security policies were one dimensional, and not a business taxonomy.

What do I mean by that?  Multiple labels that a business user can understand, Sensitive /HR/Salaries or Internal/ Support/Client Data or even Confidential/ Board Only/Project X/Aggressive Takeover.

So until you start to use day-to-day business language in your classification terms, do not be surprised if your staff get it wrong. Helpfully some of those labels can be automatically applied depending upon the departments, and roles they have, so even less user involvement is needed.

However, let me not finish without saying now is a great time to hold proof of concepts, once your immediate tasks of getting remote workers are all up and running. This will then help you to make decisions which can safeguard your organisation’s information and data in a controlled manner.

Governments are telling us not to panic buy, that there will be a plentiful supply of food and essentials. We need to continue the cycle of money for economies to survive, and support businesses within that ecosystem who need the flow of cash to pay staff. I appreciate not all projects can continue, but a blanket excuse of do nothing could halt the economic cycle. If we do that then nobody should be surprised when we come out of the end of the current crisis that their favoured contractors and suppliers are no longer trading. We owe it to ourselves, families and communities to do unto them which we would like them to do to us. Please keep safe and healthy.

Boldon James

Sophos is extremely pleased to announce the availability of XG Firewall on Amazon Web Services (AWS) public cloud infrastructure.

XG Firewall is now available in the AWS marketplace with two flexible licensing options:

• Pay-as-you-go (PAYG) license – ideal for short-term use
• Bring-your-own license (BYOL) – our conventional multi-year term licenses

AWS customers can take full advantage of the many innovations XG Firewall has to offer, like Synchronized Security with Intercept X for Server, the new Xstream Architecture with high-performance TLS 1.3 inspection, and the latest machine learning threat intelligence and sandboxing protection from ransomware and other advanced threats.

Crucially, it enables customers to manage a multi-cloud security strategy from a single cloud console in Sophos Central; including network security with XG Firewall; cloud workload protection with Intercept X for Server; and cloud security posture management with Cloud Optix.

XG Firewall brings full network security and control to AWS integrated into a single solution:

• Xstream Deep Packet Inspection (DPI)
• Intrusion Prevention System (IPS)
• Web filtering, protection and application control
• AV and AI machine-learning threat protection and sandboxing
• TLS inspection with native support for TLS 1.3
• A full-featured Web Application Firewall

In the coming months we will be extending XG Firewall’s integration into AWS with enhancements like auto-scaling, CloudFormation template support, CloudWatch integration and more.

With XG Firewall now available in AWS as well as Microsoft’s Azure public cloud platform, XG Firewall further extends its industry-leading deployment options with support for any combination of cloud, virtual, software, or XG Series hardware appliances. These options make XG Firewall able to fit any network, both now and in the future.

Learn More about XG Firewall protection for your cloud infrastructure.

Since we began writing last year about the consumer-hostile trend in mobile apps that we’re calling fleeceware, the number of apps we’ve discovered that engage in this practice have only increased. In the first two articles we wrote about fleeceware, we covered various Android apps in the official Play Store charging very high subscriptions for apps of questionable quality or utility.

In this latest round of research, we found more than 30 apps we consider fleeceware in Apple’s official App Store.

Many of these apps charge subscription rates like $30 per month or $9 per week after a 3- or 7-day trial period. If someone kept paying that subscription for a year, it would cost $360 or $468, respectively. For an app.

Like we have seen before, most of these fleeceware apps are image editors, horoscope/fortune telling/palm readers, QR code/barcode scanners, and face filter apps for adding silly tweaks to selfies.

Many of these apps lack any extraordinary features that aren’t already present in many other apps, including truly free apps. It’s debatable that the apps provide “ongoing value to the customer,” as required in Apple’s App Store Review Guidelines for app subscriptions, section 3.1.2(a).

When “free” isn’t really free

Many of the fleeceware apps we see are advertised within the App Store as “free” apps, which puts the apps at odds with  section 2.3.2 of the App Store Review Guidelines, which require developers to make sure their “app description, screenshots, and previews clearly indicate whether any featured items, levels, subscriptions, etc. require additional purchases.”

If you think one of these apps is free and install it, the app presents you with a “free trial” notification immediately upon launching the app for the first time. This notification prompts the user to provide payment card details. In some cases, most of the useful features of the app will only be usable if you sign up for the subscription. Some users may sign up to subscribe without reading the fine print, which includes the actual cost of the subscriptions.

Fleeceware in Top Grossing app charts

While the Apple App Store does not publish the number of downloads for any given app within the app’s listing in the store, the company does keep track of how much money apps make. Many of these fleeceware apps are listed among the top grossing apps, at the time of writing. It’s fair to say these apps are generating plenty of revenue for developers, of which Apple keeps a 30% cut during the first year.

Zodiac Master Plus, one of the apps on our list of fleeceware, is listed as the 11th highest revenue-generating app. Another app, named Lucky Life – Future Seer, is earning more revenue than even the extremely popular Britbox, one of the UK’s most popular subscription streaming TV services.

One third party source estimates App Store revenue, which includes all types of purchases, to be $13 billion dollars in 2018, just in the USA.

After one year, Apple gets 15% and the developer’s share increases to 85% of the subscription price.

Advertisements drive more people to fleeceware

If you find yourself wondering why users would even consider installing apps such as these, it’s probably thanks to advertising. These apps are advertised through various popular platforms, including in YouTube videos or on social media platforms like Instagram, TikTok, and even in ads that appear within other apps.

When users visit the app’s page in the App Store app, they’ll find a high number of five-star reviews. While we have no evidence that these are manipulated or artificially inflated reviews, that is another criteria by which the App Store may take action against developers. These advertisements offer a high return on investment, given the high subscription charges.

But not all the reviews are upbeat about these products. Here are a few examples of negative user reviews that illustrate how ads attract users to the apps.

Negative reviews and vulnerable users

These apps also have lots of negative, one-star reviews from users complaining about the challenge of canceling subscriptions and getting refunds, with many iPhone and iPad owners wondering aloud why apps that exhibit this type of behavior exist on Apple’s official App Store.

In one instance, one user posted a complaint about being charged £148 (about US$170) over a 5 month period, when his child accidentally subscribed to one of these apps, and he didn’t notice the subscription charges right away.

The negative reviews for some of these products are devastating.

Both iOS and Android face a fleeceware problem

Fleeceware is a problem on both the Android and iOS mobile platforms. The list below is representative of the fleeceware apps we’ve seen at the time of this writing. App publishers also have the ability to introduce new fleeceware apps by releasing new apps with the same subscription policies, or by converting a previously free app into fleeceware by changing the app’s profile in the App Store, though Apple developer policies prohibit this behavior.

Users should remain vigilant and carefully scrutinize the terms for purchasing or “subscribing” to apps promoted through in-app advertisements. If $30 a week seems like a lot to spend on astrology, a barcode reader, or an app that will show you what you’ll look like when you’re 80 years old, find another app.

How to cancel your subscriptions

If you have one of these fleeceware apps and want to change or cancel your subscription, please follow the instructions below

iOS

This is how you can do it on Iphone as described in Apple support page here.

Android

Instructions for cancelling Android app subscriptions from Google’s Play Store support page:

On your Android phone or tablet, open the Play Store.

1. Check if you’re signed in to the correct Google Account.
2. Tap the hamburger menu icon  Subscriptions.
3. Select the subscription you want to cancel.
4. Tap Cancel subscription.
5. Follow the instructions.

Hackers are busy exploiting coronavirus in their attacks. In recent weeks SophosLabs has seen a surge of COVID- and Corona-related domains registered – while some will be legitimate, it’s a fair bet that the majority are destined for criminal purposes.

Common attack techniques

Phishing attacks using COVID-19 as a lure are the most visible and immediate cybersecurity risk right now. Common tactics include:

Coronavirus news

Beware of emails, SMS, and WhatsApp messages from unknown sources with information on coronavirus. Often hackers impersonate legitimate organizations and people to make their messages more believable.

Home delivery scams

With many people waiting on home delivery of essential items, hackers are impersonating delivery services. Their goal: to trick you into clicking malicious links or con you into paying extra ‘delivery’ fees.

We’re also seeing coronavirus used in other ways, including:

Extortion attempts

Criminals threaten to infect people with coronavirus unless you pay them. Often these threats include a small piece of personal information to make it more believable.

Malicious apps

Purporting to give you useful information on coronavirus, these apps enable the crooks to access all the information on the device – and even hold you to ransom.

Malicious documents

These documents claim to contain coronavirus-related information. Upon opening them you’re asked to ‘enable editing’ and ‘enable content.’ Doing so installs malicious software onto your computer.

Practical steps to minimize risk

In the current situation, many people are lowering their guard to phishing attacks and scams. We’re more anxious, more eager for information, and therefore less likely to question something that could be suspect.

With that in mind, here are three practical steps you can take to minimize the risk from coronavirus-related attacks.

Enable Multi-Factor Authentication (MFA)

MFA is a great form of defense against attacks that use a fake login page to trick people into entering their credentials.

Raise awareness of these scams amongst your employees

A simple, but effective, step is to always looks at the actual email address used to send the email, not just the display name. (If you’re on a mobile device click on the display name to reveal the real email address.)

Sophos Phish Threat, our phishing simulation and training tool, is available to everyone for free for 30 days, and now includes a coronavirus phishing template to help train your teams.

Make sure your endpoint and email protection are well-configured

When properly set-up, good protection can catch a phishing attack in multiple ways. You can try our endpoint and email protection for free at any time.

This three-day training program was designed and intended for experienced technical professionals who want to install, configure and support the XG Firewall in production environments and is the result of an in-depth study on the next generation firewall of Sophos. The program consists of presentations and practical workshops for the enhancement of teaching content. Due to the nature of the traditions and the varied experience of the trainees, open discussion is encouraged during the training.

Sophos XG Architect Training (Tuesday 28 April 2020– Thursday 30 April 2020)

(3 days Training)

Requirement

XG Firewall _ Certified Engineer course and delta modules up to version 18.0

Recommended Knowledge

1. Knowledge of networking to a CompTIA N+ level
2. Knowledge of IT security to a CompTIA S+ level
3. Experience configuring network security devices
4. Be able to troubleshoot and resolve issues in Windows networked environments
5. Experience configuring and administering Linux/UNIX systems

Content

• Module 1: Deployment
• Module 2: Base firewall
• Module 3: Network Protection
• Module 4: Synchronized security
• Module 5: Web server Protection
• Module 6: Site to site connections
• Module 7: Authentications
• Module 8: Web Protection
• Module 9: Wireless
• Module 10: Remote Access
• Module 11: High Availability
• Module 12: Pulic Cloud

Certification

+ exam: Sophos XG Architect

Duration 3 days 

Agenda

Trainer: Micheal Eleftheroglou

Day 1 Tuesday 28 April  2020

9:30-10:45 Module 1: Deployment and Lab

• Recall important information from Engineer courses
• Deployment modes supported by the XG Firewall
• Understand a range of scenarios where each deployment mode would commonly be used
• Use built-in tools to troubleshoot issues
• Labs

10:45-11:00 break

11:00-13:00 Module 2: Base Firewall

• Explain how the XG firewal can be accessed
• Understand the types fo interfaces that can be created
• Understand the benefits of Fast Path Technology
• Configure routing per firewall rule
• Understand best practice for ordering firewall rules
• Explain what Local NAT policy is and known how to configure it.

13:00-14:00 Lunch

14:00-16:00  Labs

• Activate the Sophos XG Firewalls
• Post installation Configuration
• Bridge interfaces
• Create a NAT rule to load balance access to servers
• Create a local NAT policy
• Configure routing using multiple WAN links
• Configure policy-based routing for an MPLS scenario
• Install Sophos Central

16:00-16:15 Break

 16:15-17:15  Module 3:Network Protection and Lab

• Explain what IPS is and how traffic can be offloaded to Fastpath
• Demonstrate how to optimize workload y configuring IPS policies
• Examine advanced Intrusion Prevention and optimize policies
• Configure advanced DOS Protection rules
• Demonstrate how the strict policy can be used to protect networks
• Labs- Create Advanced DoS Rules

Day 2  Wednesday 29 April  2020

9:30-11:00 Module 4: Synchronized Security and Labs

• Explain how Security Heartbeat works
• Configure Synchronized Security
• Deploy Synchronized Security in discover and inline modes
• Understand the advantages and disadvantages of deploying
• Synchronizes Security in different scenarios
• Labs
• Configure source-Based Security
• Hearteat firewall rules
• Destination based Security Heartbeat
• Missing Security Heartbeat
• Lateral Movement Protection

11:00-11:15 Break

11:15-13:45 Module 5 Webserver Protection and Labs

• Explain how Websever Protection works
• Describe protection features for a web application
• Configure Web Server authentication
• Publish a web service using the Web Application Firewall
• Use the preconfigured templates to configure Web Server Protection for common purposes
• Configure SlowHTTP protection
• Labs (Web Application Firewall)
• Labs (Load balancing with Web Server Protection)
• Labs (Web Server Authentication and path-specific routing)

13:45-14:45 Break and Lunch

14:45-17:45 Module 6: Site to site connections and Labs

• Configure and deploy site to site VPNs in a wide range of environment
• Implement IPsec NATing and failover
• Check and modify route precedence
• Create RED tunnels between XG firewalls
• Understand when to use RED
• Labs ( Create an IPsec site to site VPN
• Labs ( Configure VPN network NATing )
• Labs (Configure VPN failover)
• Labs (Enable RED on the XG firewall)
• Labs (Create a RED tunnel between two XG Firewalls
• Labs (Configure routing for the RED tunnel)
• Labs (Configure route-based VPN)

Day 3 Thursday 30 April  2020

9:00-10:00 Module 7: Authentications and Labs

• Demonstrate how to configure and use RADIUS accounting
• Deploy STAS in large and complex environment
• Configure SATC and STAS together
• Configure Secure LDAP and identify the different secure connections available
• Labs (configure an Active Directory Authentication server)
• Labs (configure single sing-on using STAS
• Labs (Authenticate users over a site to site VPN)

10:00-11:15  Module 8: Web Protection

• Choose the most appropriate type for web protection in different deployment scenarios
• Enable web filtering using the DPI engine or legacy web proxy
• Configure TLS inspection using the DLP engine or legacy web proxy
• Labs (Install the SSL CA certificate)
• Labs (Configure TLS inspection rules)
• Labs (Create a custom web policy for users)

11:15-11:30 Break

11:30-12:15 Module 9: Wireless

• Explain how Sophos Access Points are deployed and identify some common issues
• Configure RADIUS authentication
• Configure a mesh network

12:15-13:05 Module 10:Remote Access

• Configure Sophos Connect and manage the configuration using Sophos Connect Admin
• Configure an IPsec remote access VPN
• Configure an L2TP remote access VPN for mobile devices
• Labs (Sophos Connect)

13:05-14:25 Module 11: High Availability

• Explain what HA is and how it operates
• Demonstrate how to configure HA and explain the difference between quick and manual configuration
• List the prerequisites for high availability
• Perform troubleshooting steps andc heck the logs to ensure that HA is set up correctly.
• Explain the packet flow in high availability
• Demonstrate how to disable HA
• Labs (Create an Active-Passive cluster)
• Labs (Disable High Availability)

14:25-15:05 Break – Lunch

15:05-16-15 Public Cloud and Labs

• Deploy XG firewall in complex network enviroments
• Explain how XG firewall process traffic and use this information to inform the configuration
• Configure advanced networking and protection features
• Deploy XG firewall on public cloud infrastructure
• Labs (Put a service in debug mode to gather logs)
• Labs (Retrieving log files)
• Labs (Troubleshoot an issue from an imported configuration file)
• Labs (Deploy an XG Firewall on Azure (simulation)

16:15  (Exams)

The increase in remote working is driving greater use of mobile devices for business purposes. In this article we explore how Sophos Mobile can help you keep your devices and data secure, and how to balance privacy, security and productivity.

Setting up remote employees

Not everyone has the option to use a corporate-owned device and you may need to enable people to start using personal devices for work. Sophos Mobile lets you to secure any combination of personal and corporate-owned devices with minimal effort.

Users can easily set up their personal macOS, Windows 10, or mobile devices via the flexible self-service portal; they can enroll their device, reset passwords, and get help, all without any involvement from IT.

Balancing privacy and security

In Bring Your Own Device (BYOD) scenarios, you need to protect and control business email and data without intruding on your users’ privacy. The container-only management capabilities in Sophos Mobile let you control corporate content in the Sophos Secure Email and Sophos Secure Workspace apps without requiring management of the mobile device itself. This way, your users’ personal information remains private, while company resources are protected.

Protecting against mobile threats

10% of threats are discovered on mobile devices according to our recent survey of 3,100 IT Managers. Sophos Mobile includes Intercept X for Mobile which leverages our Intercept X deep learning engine to protect your users, their devices and corporate data from known and never-before-seen mobile threats. Intercept X for Mobile also gives your users easy-to-use security tools right at their fingertips, such as the Authenticator, Password Safe, Secure QR Code Scanner and Privacy Advisor.

Set up is as simple as downloading the app from the relevant app store and then enrolling your device via the Corporate management tool.

Your users can also use Intercept X for Mobile for free to protect their personal devices – they can simply download and start using today.

Read our help guide for more information on using Intercept X for Mobile.

Keeping employees safe on the web

Intercept X for Mobile also helps you keep your users safe on the web, stopping risky file types being downloaded, and blocking access to inappropriate websites to maintain productivity and compliance. Read our step-by-step guidelines for creating a Web Filtering policy.

Monitoring and control

Compliance policies in Sophos Mobile help ensure mobile devices are used appropriately – both from a security and business policy perspective. For example, you can:

• Ensure that only reputable apps are downloaded from the relevant app stores
• Block the sideloading of a potentially dangerous app
• Restrict access to business resources
• Allow, forbid or enforce certain features of a device
• Define actions that are executed when a compliance rule is violated

You can create separate compliance policies and assign them to different device groups, allowing you to apply appropriate levels of security and access for your users and devices. See the full list of available compliance rules.

For more information and general configuration steps for both Sophos Mobile and Intercept X for Mobile, take a look at the comprehensive help guide.

Sophos