Sophos - whats the attraction / whats the alternative ?

[VeryPC_Ed]

Hi Guys (and Gals!),

 

I've seen in my travels loads of businesses and schools using Sophos and I have always wondered one simple thing - why ?

 

I'm not saying it's bad or anything as my curiosity is a result of my lack of exposure to actually using/managing the product as the few times I have come across personally was when it's has caused a problem with something else and we'd been called int to look at the situation (e.g. multiseat / server application solution stopped working all of a sudden etc).

 

Is it a pricing / features / management thing that drives people to choose Sophos over other products on the market ?

 

We have been a ESET partner for a number of years and I've always been rebuffed/met opposition when suggesting people take a look at it, our VAR arm has about 30 small businesses on SLA's who all use ESET (either NOD32 AV or Smart Security) and I can't remember the last time they reported an issue with the AV (last time was a issue with SBS) or a breach and I've definitiely not heard of or seen it attacking itself ! (*cough*sophos*cough*)

 

I'd love to hear some feedback from people on the above and not only on Sophos / ESET but what else you guys are using to plug the holes !

[mattx]

It's quite simple. Schools go with Sophos because it's cheap. And the reason it's cheap is because........ I will leave you to fill in the blanks. I suggest you go with Trend Micro.

[SYNACK]

 

We have been a ESET partner for a number of years and I've always been rebuffed/met opposition when suggesting people take a look at it, our VAR arm has about 30 small businesses on SLA's who all use ESET (either NOD32 AV or Smart Security) and I can't remember the last time they reported an issue with the AV (last time was a issue with SBS) or a breach and I've definitiely not heard of or seen it attacking itself ! (*cough*sophos*cough*)

 

I'd love to hear some feedback from people on the above and not only on Sophos / ESET but what else you guys are using to plug the holes !

 

I have had issues with ESET where its updates ate Exchange's database not once but twice despite it being told to leave it alone. Have also had it bind up Windows Installer DBs breaking installs and break network stacks.

 

We use Symantec Endpoint Protection here which works fine although it can be a tad heavy and does have its issues (recursive update downloads). Its provided under our schools deal.

 

If we were going with something else it would be the Microsoft Endpoint protection as it is the least obtrusive and resource intensive one that I have found but it still does the job. The one downfall of this is the need for the 20 million ton requirement of SCCM to properly manage it, you can have limited management with GPO but loose out on reporting etc.

[glennda]

Personaally I don't like sophos - have just removed ESEt from a client and as we are a mcrappy partner sold them the SaaS offering which at desktop level is ok as long as you don't install firewall or Browser services!

 

I purchased Avast for my last school about a year ago which was really good and half the price of the others.

[VeryPC_Ed]

Hi Matt - thanks for the reply

 

I'd be interested in how cheap it actually is (if anyone wants to Pm me some example pricing that would be ideal)

 

We used to sell Kaspersky back in the day but have also spoken with Bullguard and Trend previously but as we haven't had any issues with ESET and it's been a doddle to install and manage (very little overhead) and the price has always seemed reasonable, I don't think theres been a driving force for moving away.

 

I'd be interested if anyone else has a different take on it - ease of use / locked in / lack of desire to reconfigure network etc

[VeryPC_Ed]

Glennda: I remember using avast free edition donkeys years back on my home PC !

 

We also do a rebranded Vipre as part of our VAR's MSP which seems to be pretty good.

 

I am curious also the resource usage of Sophos / other products as again with ESET we've found it to have quite a light touch on resources was one of the main reasons for dumping Kaspersky as the on premise seemed to be a resource hog on the server.

[glennda]

Avast network edition is rather different to the free home product. The management console is easy to use and tends to "just work". I'll pm you the rough cost of what I paid for it.

[mattx]

Hi Matt - thanks for the reply

 

I'd be interested in how cheap it actually is (if anyone wants to Pm me some example pricing that would be ideal)

 

We used to sell Kaspersky back in the day but have also spoken with Bullguard and Trend previously but as we haven't had any issues with ESET and it's been a doddle to install and manage (very little overhead) and the price has always seemed reasonable, I don't think theres been a driving force for moving away.

 

I'd be interested if anyone else has a different take on it - ease of use / locked in / lack of desire to reconfigure network etc

 

I'm not in education anymore but when I was it got to the stage where we were so fed up with Sophos that when moving over to Trend, the deal was they included [ somehow ] the year we had left with Sophos into the deal.

Where I work now we use KAV and in all honesty I am not really that impressed. The client is fine but the management console is all over the place and VERY un-stable. Problem I have is that I look after 22 offices world wide with lots of remote users on a VPN and of course the usual array of desktops so if I did manage to convince my boss on moving over to Trend then some serious planning would have to be implemented. I would most probably end up writing some scripts alongside the usual MSI approach to installing and removing the other AV software.

[bossman]

@mattx:

 

We been using KAV for the past year and a half with no issues whatsoever, just setup the server point it to the workstations and other servers, install the different clients and it just works.

 

Configure the scanning for 5pm on an evening and updates downloaded on a Saturday push out the updates to the clients 7:30am before the school staff and students come in and it just works.

 

I must admit that the admin console can be a little sluggish but in all its relatively simplistic in its operation.

 

Use to used Symantec corporate edition which also just worked, never had any viral outbreaks in 10 years of operations.

 

Will probably use Microsofts offerings when our license of KAV expires in 1.5 years time hehe!

[mattx]

@mattx:

 

We been using KAV for the past year and a half with no issues whatsoever, just setup the server point it to the workstations and other servers, install the different clients and it just works.

 

Configure the scanning for 5pm on an evening and updates downloaded on a Saturday push out the updates to the clients 7:30am before the school staff and students come in and it just works.

 

I must admit that the admin console can be a little sluggish but in all its relatively simplistic in its operation.

 

Use to used Symantec corporate edition which also just worked, never had any viral outbreaks in 10 years of operations.

 

Will probably use Microsofts offerings when our license of KAV expires in 1.5 years time hehe!

 

I think the biggest issue we have is that some of the smaller offices around the world we have on our MPLS network only have 1 and half meg links. And some of those have QOS on [ mainly for E-mail traffic ] set at around 40% so you can imagine they sometimes do suffer. Once on the client is fine, it's just the Admin front end that I get really frustrated with.

I'm itching to get back to using Trend, one because I'm very familiar with it. Two - it's small footprint and three, I have written various scripts around it.

[witch]

Our antivirus is bought in by county - we changed from Sophos to ESET some years ago. I have only ever had fairly minor issues except for once when ESET took to scanning files etc on the server when they were accessed by anyone - resulting in a very slow network as you can imagine!

[eddyc]

We use sophos because the LEA give it to us free of charge as a part of their broadband provisioning...

 

Had Microsoft Forefront Client Security at my last school...

[localzuk]

Not my choice where I am now. However, it will be disappearing when our MS licensing is fixed! Microsoft SCEP here we come. Sophos + Remote Desktop Servers = Slooow. Saw SavService using 50% of a quad core xeon server's cpu the other day...

[jamesfed]

£150 from our LEA for the whole site (350 PCs) per year.....

 

Looking at using Microsoft Forefront Endpoint but in all honisty it would probably cost me more in time to get it running and deployed than it would be to stick with Sophos.

[MatthewL]

We have gone from McAfee to Forefront to Sophos. We have looked at NOD32 and various other ones and so far the best we have had is Forefront but our licensing is up at the end of the month so we had Sophos installed on Thursday. I used to like Sophos for its management but when it became system hungry I took a dislike to it but after been shown the new version and installing it I cannot fault it. With the deal we have the AV is very powerful and had extra features in that are going to be of use to us and will replace other software we have in use. To me the key thing for liking it is the management console, very quick to report back and easy to use which is better than what we have ever had. I know there was one in Forefront but never got to use it but looking at it in SCCM put me off.

 

We will be designing some policies next week and looking at deploying as some 3000 machines on some 120 networks if it deploys as quick as we did Forefont I will be very happy.

[Gongalong]

Sophos wasn't that cheap for us, that I remember (ironically we renewed for 3 years a month or two ago). It was around £6k for 400 users for 3 years (£2k/yr). Aside from the recent issue it's been OK. For admins the key issue really is the ease of using the console, which for Sophos is OK. It could be more straightforward though, and if anything suffers from information overload.

 

McAfee I would avoid like the plague. This is the one provided for us cheaply by CC. I'm relatively new here, and my predecessors opted to avoid.

 

I've used G-DATA previously. Despite getting good scores in independent testing it missed viruses, so would also avoid like the plague. Also the console was less than brilliant.

 

I've heard anecdotally that Forefront has at least missed a couple of viruses e.g. Conflicker, albeit an old virus.

[glennda]

Mcafee's EPO offering is terrible - for SMB's the SAAS offering (McAfeeASAP) seems to work fairly well and is all cloud managed.

 

I PM'd the cost of Avast to Ed which was 4.5k for 3 years for 900 devices - just shows Avast is fairly good and cheap plus very easy to manage.

[d-taylor]

We were using Symantec Corporate edition (RMVP4) which was a load of ****. Not always clear through the console which computers were infected, had to visit the client tray on the management servers as well as the console to check for infections, often didn't update for no reason, needed re-installing once a year as it would suddenly bring the servers to a halt, and had issues deploying to workstations after CC4 SR1 for a few months and it was overpriced. Last straw was it let a USB virus through, and RM were dragging the Windows 7 version release.

 

We switched to Sophos, and because we got it through the LEA, it is so cheap no one else can match the price. Most schools in North Yorkshire will be using it because of this pricing.

 

Not only that, it actually works! Much better detection rate than Symantec, the console actually alerts you to infections, you can clean most infections remotely with the console, and it deploys all the time to clients no problem. Detection rate is excellent, it's never let us down yet.

 

Yes there was the recent ssh\updaterb issue but they were on the case quickly, and it's one issue in the 3 years we've had the product, so I'm not grumbling.

[gshaw]

Advantages of Sophos... ummm.... errr... can't think of any (unless you're on the LEA deals above)

 

We moved to Kaspersky then onto ESET after KAV turned into a clone of Sophos (i.e. so slow it killed every workstation it was installed on at boot or during scans). Thus far NOD32 has been quick and picked up what it needs to... hope that continues

[Guest TheLibrarian]

We've been using Sophos for ~4 years now.

 

With the obvious exception of their latest false positive escapade we've been very happy with it.

 

After the latest false positive we've changed the "delete it if you can't clean it" policy to "just quarantine it". If we'd not had the delete it policy in place the clean up would have been much simpler, but as it was it was only a few hours work.

 

I should point out that our workstations are also protected by DeepFreeze.

 

 

The main reason we swapped to Sophos was price, secondly was ease of use. IIRC we compared it to NOD32 and Kaspersky; McAfee, Avira and Avast all priced themselves out of the trial.

 

The reason we left Symantec was the sheer volume of issues we had with their Endpoint Protection. Symantec may have a brilliant product on their hands by now - I doubt we'll never know.

[RTFM]

We dumped Sophos as soon as we could after stepping out of our LEA IT agreement, we use Vipre now and its much better

[ess2k]

Certainly agree with you there 'MattX'

We have been with Kaspersky awhile now! and its loads better!

 

It's quite simple. Schools go with Sophos because it's cheap. And the reason it's cheap is because........ I will leave you to fill in the blanks. I suggest you go with Trend Micro.

[Dos_Box]

Moving to Enterprise Software.

[dan400007]

For us the management console for Sophos was very hit and miss - sometimes worked other times didn't. Also the client seems to be very resource intensive, we've just made the change to SCCM with FFEP and its given our older machines an extended lease of life.

 

We used Sophos for a quite a while and back in the days of Sophos 2.5 (I think) it was a brilliant system and filled the 'It just works' requirement. Now you seem to need to beat it with a stick to get it to play nice.

[sparkeh]

Well I have been using Sophos for many years now.

When I first started using it I could cheerfully have thrown it in a skip, but we were at the start of a multi year deal and was stuck with it.

As time has gone on its got better and better and I am now very happy with it.

 

Its easy to deploy and manage and the integrated Disk Encryption that comes with the DPS suite is very nice. Got no issues with it.