Sophos Firewall Web Protection

Web Protection supports safe, productive web browsing. Protect users on your business network against web-based threats. Integration with other Sophos products and straightforward management help you strengthen protection and control. The following sections explain the main Web Protection features and their value for IT administrators and security engineers.

Web threat protection: malware, PUAs, malicious JavaScript and pharming

Sophos Web Protection includes several controls to help defend businesses against web threats:

• Malware scanning: detects and blocks viruses, web malware, trojans and spyware in inspected HTTP/S and FTP traffic, including webmail.
• JavaScript emulation: adds a layer of analysis to detect and block malicious scripts.
• Dual malware scanning: an independent Avira engine complements Sophos detection.
• Scanning modes: choose streaming or full-file scanning where supported, according to the configuration and traffic type. Batch mode is available through the web proxy; the DPI engine always scans in real time.
• Pharming protection: helps block redirections to fraudulent websites.
• Potentially unwanted applications (PUAs): detects and blocks applications that may perform unwanted activities, even when they are not inherently malicious.

Web Control – allow or block web traffic

Web Control, web filtering and proxy functions provide granular control of users’ web access. Filter web content by user, group, category, URL or keyword. SophosLabs maintains the URL-filtering database; the available categories follow the current Sophos classification. Businesses can set browsing schedules by user or group and configure filters by MIME type, file extension and active content (e.g. ActiveX, applets and cookies). Policies can also enforce SafeSearch for supported search engines using DNS-based controls.

Traffic shaping for web and applications

Quality of Service (QoS) and traffic shaping help businesses control and prioritise network traffic. Set traffic-shaping policies by web category or application to limit or reserve bandwidth, assign priorities and manage upload, download or shared rates.

Xstream TLS Inspection – inspect and scan traffic

As more web traffic uses encryption such as HTTPS, firewalls need decryption capabilities to inspect its contents. SSL scanning and TLS inspection address this need. Web Protection includes Xstream TLS Inspection to check encrypted traffic for threats. It decrypts, analyses and re-encrypts SSL/TLS traffic according to your configuration; inspection policies and exclusions must reflect privacy requirements.

Application Control – flexible application management

Application Control identifies and controls thousands of applications using signatures, categories and risk levels. Application smart filters enable dynamic policies that update when new signatures are added. Businesses gain visibility into cloud applications and shadow IT.

Synchronized App Control

Synchronized App Control is part of Sophos Synchronized Security, which enables information sharing between Sophos products. It identifies, classifies and controls unknown Windows and Mac applications by sharing information between Sophos-managed endpoints and the firewall.

Web Protection offers flexible application-access controls by user, group, category and risk. Administrators can create policies tailored to their business’s requirements and security concerns. Granular controls help balance protection, productivity and access to important applications and services.

Reporting – insight into web and application activity

Web Protection reporting lets businesses log and monitor the activities covered by its controls. Reports and analysis show web access, application usage and detected threats to help improve business security.