{"id":22345,"date":"2016-03-18T12:00:00","date_gmt":"2016-03-18T11:00:00","guid":{"rendered":"https:\/\/www.avanet.com\/blog\/sophos-utm-elevated-9-4-sandbox-user-group-rules-and-waf-cookies\/"},"modified":"2023-11-02T11:03:53","modified_gmt":"2023-11-02T10:03:53","slug":"sophos-utm-elevated-9-4-sandbox-user-group-rules-and-waf-cookies","status":"publish","type":"post","link":"https:\/\/www.avanet.com\/en\/blog\/sophos-utm-elevated-9-4-sandbox-user-group-rules-and-waf-cookies\/","title":{"rendered":"Sophos UTM Elevated 9.4 – sandbox, user\/group rules and WAF cookies"},"content":{"rendered":"\n

The new firmware version 9.4<\/strong> for the UTM is in the starting blocks. The final has already been released. Even though the new Sophos Firewall OS<\/strong> (SFOS) operating system was introduced with the XG series, the UTM is far from dead. We can now definitely confirm this to you first hand. We were at the Sophos Roadshow in Zurich last week. Both operating systems are being further developed in parallel, and the UTM roadmap continues at least until 2017. So it doesn’t look like a quick changing of the guard. Especially since it has to be said that we still recommend the SG-Series and would not consider switching until the Sophos Firewall OS<\/strong> update coming in summer 2016.<\/p>\n\n

\n

But let’s take a look at what’s new in the new Sophos UTM Elevated 9.4<\/strong> firmware.<\/p>\n<\/blockquote>\n\n

Sophos UTM Elevated 9.4 innovations<\/h2>\n\n

1. sophos sandstorm<\/h3>\n\n

The main innovation comes with the sandboxing solution Sandstorm<\/strong>, which we already announced in a previous post<\/a>. With 9.4, Sandstorm is now integrated into the system and can be activated after purchasing a license. Corresponding licenses can be ordered immediately in our Sophos store for SG Firewall<\/a> or XG Firewall<\/a>. Just click on your hardware model and select the new Sandstorm license.<\/p>\n\n

\n

Sophos Sandstorm is currently only available for UTM 9.4. Owners of an XG firewall, with the Sophos Firewall OS<\/strong>, will have to wait a little longer. Sophos Sandstorm is also not included in the FullGuard bundle and must be purchased separately.<\/p>\n<\/blockquote>\n\n

Update<\/strong>: Sophos Sandstorm is now available for UTM and SFOS and can be purchased either individually or in a bundle<\/em>.<\/p>\n\n

What exactly does Sophos Sandstorm do?<\/h4>\n\n

Sophos Sandstorm complements Sophos’s existing security products and provides additional protection against advanced persistent threats (APT) and zero-day malware. All files that are downloaded, whether on the web or via Mail Protection are handled as follows.<\/p>\n\n

    \n
  1. The firewall generates a hash value of the file and checks whether it has already been examined. If the file has already been checked, it is already determined whether it should be allowed or blocked.<\/li>\n\n\n\n
  2. If the file is unknown, it is transferred to Sophos Labs and analyzed. After the analysis, a report is created for this file, showing exactly what the file tried to do. Finally, the file is deleted from the Sophos servers again.<\/li>\n<\/ol>\n\n
    \"Sophos<\/figure>\n\n

    What do I have to imagine by a “sandbox”?<\/h4>\n\n
      \n
    • Secluded, isolated environment in which (unknown) files are executed. Of course, known malware is blocked right away, so it does not need to be scanned first. But, for example, a new randsomware that downloads and executes code in the background is detected using this technique.<\/em><\/li>\n\n\n\n
    • Site for behavior-based dynamic maleware analysis. Each file is executed and analyzed, what this does. After that, a report is created and an evaluation is sent.<\/em><\/li>\n\n\n\n
    • Emulated analysis environment for Windows, Mac and Android<\/li>\n\n\n\n
    • Executable files such as (32 or 64-bit), DLLs, Office documents and other file extensions (DF, HWP, XPF, CHM, JAR, APK Archives (ZIP, BZIP, GZIP, RAR, TAR, LHA \/ LZH, XZ)<\/li>\n<\/ul>\n\n

      2. user\/group based ruleset<\/h3>\n\n

      There are now also new configuration options to define user or group based rules<\/strong>. Until now, it was only possible to assign a fixed IP address to a device via DHCP or directly in the system and then create firewall rules with this object. However, this had the disadvantage that computers that were not assigned to a fixed employee always had the same rule. The Sophos Transparent Authentication Suite (STAS)<\/strong>, which is familiar from the XG, is now also available for the UTM. This makes it possible to create transparent authentication for firewall and application rules with Microsoft Active Directory.<\/p>\n\n

      3. WAF Persistent Session Cookies<\/h3>\n\n

      Improves collaboration with web applications and web server farms.<\/p>\n\n

      4. IPv6 SSL VPN Support<\/h3>\n\n

      Adds the often requested support for IPv6 VPN.<\/p>\n\n

      All innovations in the video<\/h2>\n\n
      \n