EIEIOTECHNOVATION
← Training programmes

EIEIO / AUTOMATION & EMERGING TECHNOLOGY

Sophos Certified Administrator -Enduser Protection

Course outline

2 days
Discuss this programme →

Duration

2 days

Overview

This course is designed for technical professionals who will be administering Sophos Enduser Protection and provides the skills necessary to manage endpoints that are standalone or part of a Microsoft Active Directory network.

The course is available either online or as an instructor-led classroom course.

It consists of presentations and practical lab exercises to reinforce the taught content, and electronic copies of the supporting documents for the course will be provided to each trainee through the online portal.

The course is expected to take 2 days to complete, of which approximately half will be spent on the practical exercises.

Objectives

On completion of this course, trainees will be able to:

  • Recognize the main technical capabilities of Enduser Protection and its benefits
  • Identify the solution components and understand how they interact
  • Use Sophos Enterprise Console to configure Enduser Protection
  • Deploy Enduser Protection to clients
  • Manage alerts using Enterprise Console and the endpoint client
  • Backup and restore the system
  • Gather information that will assist investigation by Sophos Support
  • Locate and use additional online resources

Prerequisites

There are no pre-requisite for this course, however it is recommended that students should:

  • Be able to setup a Windows server, with Windows workstations
  • Have knowledge of general Windows networking and Microsoft Active Directory

Certification

To complete the course, trainees must take and pass an online assessment. The assessment tests their knowledge of both the presented and practical content. The pass mark for the assessment is 80%, and trainees should note that to become a Sophos Certified Administrator for Enduser Protection.

Lab environment

Each student will be provided with a pre-configured Enduser Protection environment which includes Windows clients and a Microsoft Active Directory domain.

Agenda

Module 1 : Security threats and how we Sophos protects against them (1 ¼ hours)

  • Introduction to security threats
  • Malicious code
  • Examples – Exploit kits, Remote Access Trojan, Ransomware
  • Anti-virus and HIPS
  • Web Protection
  • Client firewall
  • Device Control
  • Botnets
  • Malicious Traffic Detection (MTD)
  • Software vulnerabilities
  • Application Control
  • Patch Assessment
  • Data Loss / Leakage
  • Data Protection
  • Device Control
  • Inappropriate browsing
  • Web Control
  • Social Engineering and Phishing
  • The importance of user education
  • Ransomware
  • The importance of backups
  • Sophos Endpoint Security and Control
  • Sophos Enterprise Console
  • Demonstration – Enterprise Console user interface
  • SophosLabs
  • On-premise versus Cloud
  • No hardware to manage
  • Combine with XG
  • Security Heartbeat

Lab 1 – Sophos Enduser Protection in action (¾ hour)

  • Use Sophos Enterprise Console
  • Test features of Sophos Anti-virus and HIPS
  • Test Application, Data and Web Control

Module 2 : Managing anti-virus and HIPS (1 hour)

  • Sophos Enterprise Console
  • Anti-virus and HIPS policy
  • Sophos engines
  • On-demand scanning
  • On-access scanning
  • Configuring extensions and exclusions
  • Live Protection
  • Malicious Traffic Detection (MTD)
  • Scheduled scanning
  • Why this is important
  • HIPS
  • Web Protection
  • Best practice for policy configuration
  • Sophos Policy Evaluation Tool
  • Tamper Protection

Lab 2 – Managing anti-virus and HIPS (¾ hour)

  • Configure anti-virus and HIPS policies
  • Discover best practice settings for Anti-virus and HIPS policies
  • Configure and test tamper protection

Module 3 : Management at the endpoint (¾ hour)

  • Enduser experience in Windows
  • Windows Services
  • Windows Groups
  • Dealing with threats
  • Quarantine Manager
  • Options for dealing with items in quarantine
  • Configuring and viewing logs
  • Authorization Manager
  • Update now
  • Running a full scan
  • Sophos Clean ??
  • Enduser experience on a Mac

Lab 3 – Management at the endpoint (½ hour)

  • Manage detections using Quarantine Manager and Enterprise Console
  • View endpoint logs

Module 4 : Managing application, data and device control (½ hour)

  • Application control
  • Data control
  • Device control
  • Event viewers and dashboard

Lab 4 – Managing and testing polices for application, data and device control (½ hour)

  • Configure and test application control policies
  • Configure and test data control policies
  • Configure device control policies

Module 5 - Managing policies for web control, patch and firewall (½ hour)

  • Managing web control
  • Patch assessment
  • Configuring firewall policies

Lab 5 – Managing and testing policies for web control and firewall (½ hour)

  • Configure web control
  • Configure firewall policies

Module 6 : Solution architecture (¾ hour)

  • Sophos Enterprise Console database
  • Installation scenarios
  • Component overview
  • Component communication
  • Central Installation Directories (CIDs)
  • Sophos Auto Update
  • Remote Management System
  • Message Routers - uses

Lab 6 – Solution components (½ hour)

  • View the Sophos Databases using SQL Server Management Studio
  • View Remote Management Communication settings using the Sophos Network Communications Report
  • Perform an installation of Sophos Enterprise Console on a client PC
  • Use RDP to connect to the Management Console on another host

Module 7 : Deploying Enduser Protection (1 ¼ hours)

  • Enduser Protection system requirements
  • Deployment pre-requisites
  • Enduser Protection installation methods
  • Enterprise Console Groups
  • Protect computers wizard
  • Synchronize with Active Directory
  • Deploy using Active Directory Startup scripts
  • Deploying on a disk image
  • Manual installation
  • Custom Installer packages
  • Competitor Removal Tool (CRT)
  • Mac deployment
  • Demonstration – Mac Enduser Protection Client
  • Supported policies by endpoint platform
  • Product upgrades

Lab 7 – Deploying Sophos Enduser Protection (1 hour)

  • Perform connection tests between the CLIENT2 and SEC
  • Perform a manual deployment of the enduser protection client
  • Discover and import computers on the network using Active Directory
  • Manage Enterprise Console groups and policies
  • Perform a deployment via Enterprise Console
  • Deploy Enduser Protection using Active Directory Group Policy
  • Create a deployment package for Windows
  • Review changes made by the installation

Module 8 : Managing updating (½ hour)

  • Update Managers in SEC
  • Software Subscriptions
  • Sophos Update Manager
  • HTTP Updating
  • Updating Policy

Lab 8 – Managing updating (1 hour)

  • Verify settings for updating
  • View the default updating policy
  • Create a web CID and web warehouse on an IIS server
  • Create new policies that use the web CID

Module 9 : Administration and reporting (½ hour)

  • The Dashboard
  • Alerts, smart views and right click actions
  • Reporting
  • Report Manager
  • Creating reports
  • Running and exporting reports
  • Sophos Reporting Interface
  • Auditing
  • Configuring role-based administration
  • PurgeDB
  • Database backup and restore

Lab 9 – Administration and reporting (¾ hour)

  • Use Sophos Enterprise Console to configure Dashboard settings and view reports
  • Configure email alerting from endpoints for Anti-virus and HIPS
  • Use the Sophos Reporting Interface
  • Backup configuration and the database
  • Create a scheduled task to run PurgeDB
  • Configure role-based administration

Module 10 : Obtaining support (¼ hour)

  • The Sophos support site
  • Log files for RMS, Sophos Agent, SAV, SUM etc…. are located and what type of information they store.
  • The Sophos Diagnostic Utility
  • Sample submission

Lab 10 – Obtaining Support (¼ hour)

  • Use the Sophos Diagnostic Utility

Programme scope, delivery arrangements and suitability are confirmed during enquiry.