Sophos Firewall OS

Cyberoam and Sophos come together to introduce an all-new operating system

Our latest firmware, Sophos Firewall Operating System (SFOS) takes simplicity
and protection to a whole new level. Here are the key highlights of what’s new
and exciting in SFOS for Cyberoam users.

Highlights A Firewall That Makes Security Easier

ÌÌ Sandstorm protection ÌÌ The new SFOS offers a smarter, task-oriented user interface

ÌÌ Advanced threat protection ÌÌ Simplified policy configuration

for your network
 Business application rule — Allows internal or external
ÌÌ Web caching and users to access your secure servers and services
SNI-based protection
 User/network rules — Controls your traffic by source, service, destination,
ÌÌ Extends main office zone by using a network policy. User rules allow a user identity to be attached
security to remote offices to a network rule to manage access to web and application content.

ÌÌ Policy-based routing ÌÌ Support for country or continent-based filtering in firewall rules

ÌÌ New Control Center for ÌÌ Network security control center

instant insight and control
 Provides instant insight into system performance,
ÌÌ Security Heartbeat traffic patterns, alerts, and active policies
connects firewall and
endpoints for smarter Sandstorm Protection
security ÌÌ Effective affordable cloud-sandboxing protection

ÌÌ Stronger email protection ÌÌ Identifies suspicious files with active content for further sandboxing analysis
with SPX encryption, and
ÌÌ Can identify and block ransomware and other advanced
built-in DLP
threats before they enter the network

Advanced Threat Protection (ATP)

ÌÌ Protects your network from advanced threats and botnets by identifying
infected or compromised hosts inside the network and preventing
their communication with command-and-control servers

Policy Routes
ÌÌ Route select traffic to a custom gateway based on
source, destination, or layer-4 service

Per Domain Routing

ÌÌ Route incoming mail to the correct destination server, based on the target domain
Sophos Firewall OS

Firewall Hostname Heartbeat Links Your Firewall and Endpoint

ÌÌ Assign a custom hostname to your firewall ÌÌ Security Heartbeat combines the intelligence of
your firewall and endpoints into a single system,
Authentication profviding advanced threat protection
ÌÌ Improved access security with support for OATH-
ÌÌ Offers instant discovery, positive identification, and
TOTP one-time passwords directly on the firewall,
automated action to detect and isolate threats
eliminating the need for a separate 2FA solution
ÌÌ Integrates host health status into the security
 Supports IPSec, SSL VPN, User Portal, and
policy settings of your firewall, allowing you to
WebAdmin access (We recommend using the free
isolate or limit the access for compromised
Sophos authenticator app for iOS and Android)
systems until they are cleaned up
ÌÌ Sophos Transparent Authentication Suite (STAS)
ÌÌ Enhanced Application Control helps your firewall
configuration has been added to the interface,
determine the application responsible for
enabling easy setup without requiring the CLI
generating uncategorized network traffic

Enhancements in Web Filtering ÌÌ Limits access to destinations and servers

ÌÌ Web Caching allows the Web Filter to speed up based on the status of their Heartbeat
requests for frequently visited sights, when enabled
Enhanced Wireless Controls
 Endpoint update data can also be
ÌÌ Cyberoam’s UTM/next-gen firewall wireless
cached for Sophos Endpoints
controller in CyberoamOS 10.6.2 includes secure
ÌÌ Server name indication (SNI)-based categorization hotspots, support for all Sophos Access Point
for better classification of HTTPS websites models, time-based SSIDs, and more

ÌÌ Intuitive, easy-to-maintain web policies ÌÌ Three modes of secure hotspots or Guest Wi-Fi
dramatically reduce firewall rule counts access inlcude: Terms of Use Acceptance, Password
of the Day, and Vouchers for Internet Access
ÌÌ Addition of a ‘Warn’ action for situations where
Block and Allow aren’t the suitable option
Stronger Email Protection with Built-in DLP
ÌÌ Limited access to a selected Google Apps domain,  Supports secure POP and secure IMAP protocols
reducing the risk of data loss from users transferring
 New Secure PDF Exchange (SPX) encryption
documents to their personal Google Apps.
encapsulates emails and attachments into an
ÌÌ Enforcing search engine filters for content encrypted, password-protected PDF, allowing
with a Creative Commons license, reducing access only to the intended recipient
the exposure to inappropriate images
 Built-in DLP scans your outgoing
emails for sensitive information
Affordable Remote Office Security
ÌÌ Extends security of your main office to remote offices  Dual antivirus provides maximum
recognition rate by scanning the traffic
 A Remote Ethernet Device (RED) in the remote
twice using different virus scanners
office connects to the main office’s firewall, safely
routing all branch traffic through the main office  Offers full store-and-forward support for MTA that
allows the firewall to store mail when target servers
ÌÌ RED appliances can be centrally managed
are unavailable — ensuring business continuity
through your Cyberoam UTM/next-gen firewall
devices (after upgrading to SFOS)
Sophos Firewall OS

SSL VPN On-appliance Reporting

ÌÌ Access site-to-site VPN tunnels that can ÌÌ Additional reports are available for new features,
be established via an SSL connection including ATP, Security Heartbeat, Wireless Access
Points, Email Protection, SPX and DLP, and RED
Enhanced Web Application Firewall/
ÌÌ The enhanced User Threat Quotient includes
Web Server Protection
advanced threats triggered from user
ÌÌ Reverse Authentication verifies users with
endpoints, in addition to their web behavior
a web appliation firewall when a real web
server does not support authentication
Microsoft Azure Platform Support
 Ensures a user only needs to authenticate once, ÌÌ Supports deployment in Microsoft Azure as a
even when there are more than one real web preconfigured virtual machine from the Microsoft
servers assigned to a virtual web server Azure Marketplace, with pay-as-you-go or bring-your-
own-licensing (BYOL) pricing and licensing options
ÌÌ Defines real web servers using site path routing,
ensuring incoming requests are forwarded

ÌÌ Web Application Firewalls now supports HTML

rewriting, MSRPC support, antivirus scanning,
and SQL injection/XSS protection

United Kingdom and Worldwide Sales North American Sales Australia and New Zealand Sales Asia Sales
Tel: +44 (0)8447 671131 Toll Free: 1-866-866-2802 Tel: +61 2 9409 9100 Tel: +65 62244168
Email: sales@sophos.com Email: nasales@sophos.com Email: sales@sophos.com.au Email: salesasia@sophos.com

© Copyright 2017. Sophos Ltd. All rights reserved.

Registered in England and Wales No. 2096520, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, UK
Sophos is the registered trademark of Sophos Ltd. All other product and company names mentioned are
trademarks or registered trademarks of their respective owners.

17-03 SFOS-NA (SM)