Sophos Enterprise console 5.5.0 & AV 10.7.2

[DrCheese]

Looks interesting - Looks like they're bringing quite a few of the features from Intercept X over to the core AV product (Unless I read it wrong!)

 

https://community.sophos.com/kb/en-us/125687

https://community.sophos.com/kb/en-us/126016

[kennysarmy]

Looks interesting - Looks like they're bringing quite a few of the features from Intercept X over to the core AV product (Unless I read it wrong!)

 

https://community.sophos.com/kb/en-us/125687

https://community.sophos.com/kb/en-us/126016

 

Looks like it but I assume you'll still need an additional licence...

[DrCheese]

You do yes, I looked into it and for 600 clients it's around £4k over 3 years. I don't think that's too bad really, if it prevents one attack that's it bought and paid for (If you work out the downtime of having to restore!)

[kennysarmy]

You do yes, I looked into it and for 600 clients it's around £4k over 3 years. I don't think that's too bad really, if it prevents one attack that's it bought and paid for (If you work out the downtime of having to restore!)

 

Not sure I agree.

 

If a student get's hit then surely the worst their permissions would allow is their H:\ to be encrypted, which should just be a 5 mins job to restore from shadow copies or at worst a backup. If the PC was trashed then that's just one PC to re-image.

If a teacher get's hit then it's the above plus perhaps some encryption to some shared areas where they have permission to save.

 

I'd only be worried if an admin was caught by malicious code who had access to lots of shared / mapped drives...but that's why your normal logon should not give you much access and why here the elevated domain admin accounts do not have any mapped drives associated.

 

Cheers

[DrCheese]

It'd depend on the ransomware - Some spread via various software exploits so even if you're fairly restricted you could end up with a lot more encrypted than just a few user files.