To stop advanced cyber threats targeting public cloud data and workloads, you need to ensure your cloud resources are configured correctly – and importantly, know how they can be accessed.
Cloud Optix has already transformed the way organizations address challenges around public cloud visibility and threat detection. So we’re over the moon to support the latest advancements in public cloud security with the launch of Amazon Detective and AWS Identity and Access Management (IAM) Access Analyzer at AWS re:Invent 2019, which gives you a smart way to further meet these challenges.
If you can’t see it, you can’t secure it
Finally, Sophos UTM helps customers comply with AWS Security Best Practices and regulations such as PCI, HIPAA, and FedRAMP with security tools constantly updated to provide comprehensive real time protection, delivered through Sophos Labs, our 24x7 analytics organization and one of the world's leading threat intelligence labs. Sophos ZTNA Gateway – will come as a virtual appliance for a variety of platforms to secure networked applications on-premise or in the public cloud with AWS and VMware ESXi support initially closely followed by Azure, Hyper-V, Nutanix, and others. For every new release version in Amazon Web Services (AWS), Sophos publishes a new Amazon Machine Image (AMI). Every hour, the system checks automatically for new updates in the Amazon Marketplace. Sophos and AWS collaborate to provide rapid response to cloud threats Cloud. AWS. AWS re:Invent 2019. Cloud Optix. Cloud Security We’re excited to support the latest advances in public cloud security with the launch of Amazon Detective and AWS Identity and Access Management Access Analyzer at AWS re:Invent 2019. Sophos Cloud Optix is a strong alternative for Amazon GuardDuty and provides a superset of intelligent threat detection features. The security service is available across multiple platforms such as Kubernetes Clusters, Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP), etc.
Cloud Optix answers a critical market need for visibility into these long-standing and risky blind spots.
Artificial intelligence is used to automate detection and response of cloud architecture security vulnerabilities and misconfigurations. Security teams gain complete visibility into everything they have in the cloud and the ability to respond and remediate security risks in minutes.
Available in Amazon Web Services (AWS) Marketplace, Cloud Optix provides automatic discovery of an organization’s assets across hybrid cloud environments, including AWS, native and managed Kubernetes clusters (Amazon EKS), and Infrastructure-as-Code environments.
Now, with the latest integrations showcased at AWS re:Invent 2019, Sophos is taking this up a notch, accelerating threat investigation with Amazon Detective, and launching the latest capabilities around IAM Access Analyzer.
Connecting activity to spot threats sooner
If you’re managing security over separate AWS accounts, you know how hard it is to connect the dots from different security findings. This is one way attackers get in – after all, they only need to get lucky once.
But, this is also where Amazon Detective comes into its own. Identifying activity such as failed logon attempts or suspicious API calls, it connects disparate actions across your AWS accounts with ease and enables rapid investigation of patterns in behavior, which is simply not possible for busy security teams to do manually.
Sophos Aws
By providing detailed visualizations and analysis, Amazon Detective allows you to understand the root cause of a security finding, as well as the resources affected, so you have the context needed to decide if activities are malicious.
Identify unintended access in seconds
Who has access to my S3 buckets? Can an external account assume my IAM role and access or delete my sensitive data? Good questions… wait a minute, let me check.
Sophos Aws Utm
Well, you don’t have time for that, but IAM Access Analyzer does.
It provides a smart approach to the discovery of cross-account and external account S3 access, giving you the power to analyze hundreds or even thousands of policies across AWS environments in seconds within Cloud Optix. This provides you with the detail and context needed to quickly determine if resource policies have been misconfigured to allow unintended public or cross-account access – leaving your valuable resources or data exposed.
Secure your cloud with Sophos
As integration launch partner for Amazon Detective and IAM Access Analyzer, Sophos Cloud Optix transforms your AWS security posture.
It delivers the continuous analysis and visibility needed to detect, respond and prevent hidden security and compliance gaps that leave them exposed and provides a single view of security posture across AWS, native and managed Kubernetes clusters (Amazon EKS), and Infrastructure-as-Code environments.
Get the latest Cloud Optix updates at @SophosDevOps.
Sophos Aws Vpc
XG Firewall is provided as a virtualized security appliance that runs on an Amazon EC2 instance and deploys inline into an Amazon Virtual Private Cloud (VPC) to scan traffic entering and leaving.
This information is provided as-is without any guarantees. If you require assistance with your specific AWS environment, contact Sophos Professional Services.
Sophos Aws Marketplace
- Go to the Sophos AWS Marketplace Product page and choose which listing you want to use.
XG Firewall is available for standalone deployment using both the BYOL and PAYG licensing methods. Free trial options are available for both license types.
- To subscribe to the software terms, click Continue to Subscribe.
- Then click Continue to Configuration.
- Choose your configuration options. Under Fulfillment Option, select the CloudFormation Template.
- Select your AWS region.
- Click Launch, which will redirect you to the AWS CloudFormation console.
- On the Create stack page, click Next.
A CloudFormation template is used to simplify the process of deploying XG Firewall into an AWS account. The AWS Marketplace listing page redirects to the AWS CloudFormation console and starts a stack creation in your region of choice, as shown below.
- On the Specify stack details page, enter a Stack name.
If you want to use an existing Virtual Private Cloud (VPC), leave the default parameters. If you want to create a new VPC, accept or change the default parameters for AMI ID, EC2 Instance size, Public Subnet Availability Zone, and Network Prefix.
- Enter the required parameters such as the trusted network CIDR used to manage XG Firewall, select the pricing option you wish to use (BYOL or PAYG), and enter the SSH key used for shell access to XG Firewall.
- If deploying into an existing VPC, enter the VPC ID, an existing public subnet ID, an existing private subnet ID, and choose to have the template create a new Elastic IP (EIP) or utilize an existing available EIP.
- Once all information is entered, click Next to continue.
- Click Next and then click Create Stack.
Stack creation normally takes from five to ten minutes. When stack creation is complete, the status changes to CREATE_COMPLETE, as shown below. The Outputs tab shows the EIP assigned to the XG Firewall. After stack creation, the EC2 instance may need additional time to complete startup before it's ready. You can see the status of the EC2 instance in the EC2 Console. You can see details about the EC2 instance, including its physical ID under the Resources tab.
- When the EC2 Instance is running, copy the assigned Public IP and use both https and the web admin port to begin initial configuration: https://PublicIPAddress:4444.
By default, XG Firewall uses a locally-signed certificate so your browser will show a warning message. Once you go past the certificate warning, you see the Welcome to Sophos XG Firewall page.
- Click Click to begin at the bottom of the screen.
You're then prompted to perform basic configuration.
- Set a password for the default admin account used to sign in to the XG Firewall.
- Configure a firewall name and choose the time zone.
- Register your XG Firewall by taking one of the following actions:
- Enter an existing XG Firewall serial number.
- Start a 30-day trial (which will automatically generate an XG Firewall serial number).
- Migrate an existing UTM 9 license.
If you start a trial, you're redirected to the Sophos XG licensing portal, where a new serial number is generated.
- When complete, click Confirm Registration and Evaluation license.
- Click Initiate License Synchronization.
Once the basic setup is complete, the license details are shown.
- If you want to configure advanced settings, click Continue. For AWS deployments, you only need to click Skip to finish.