Sophos

Sophos provides centrally managed security products for endpoints, servers, email and networks. The platform can bring policy, alerting and investigation into Sophos Central while firewalls continue to enforce controls at the network boundary.

IP6net advises on product selection, licensing and deployment, then supports the components included in the customer’s service agreement. The aim is to establish useful protection and alert handling without enabling controls that have not been tested against normal business applications.

Endpoint and server protection

Endpoint policies can cover malware prevention, exploit mitigation, web controls, peripheral access and application behaviour. Server policies need separate consideration because production workloads, exclusions and maintenance windows differ from user devices.

IP6net can help with:

• Deployment to supported Windows and macOS endpoints and Windows or Linux servers.
• Policy groups for different device or workload requirements.
• Review of exclusions, tamper protection and update status.
• Alert triage and escalation where a device needs investigation.
• Removal of retired devices and reconciliation of licence use.

Sophos Firewall

Sophos Firewall can provide internet routing, network segmentation, VPN access, web filtering and application controls. A firewall deployment starts with the network design: interfaces, VLANs, routes, public services, remote access and failover all need to be understood before rules are migrated.

Where compatible Sophos products and licences are in use, Synchronized Security can share health information between endpoints and the firewall. This can help restrict a device when its security state changes, but it should complement—not replace—clear network segmentation and incident procedures.

Management and reporting

IP6net can monitor agreed Sophos alerts, maintain policies and support firewall or endpoint changes through the normal ticket process. Reporting is most useful when it leads to an action, such as correcting an unprotected device, reviewing repeated detections or adjusting a policy that is blocking legitimate work.

Security products reduce risk but do not remove the need for patching, backups, multi-factor authentication and user awareness. We consider those dependencies when defining the support scope.