Sophos WS1000 review

Appliances can offer an easily deployed network security solution, but Sophos' WS1000 differs from the majority because the base price includes full, 24-hour global support and all database and signature updates as well. Sophos also eases the management burden, as it can remotely monitor the appliance and advise support staff of any problems with it.

The WS1000 is based around a simple, all-Supermicro low-profile rack server offering a basic spec for the price. Noise levels are low enough for a small office and it can function in routed, bridged or transparent gateway modes - and the latter two provide simple drop-in solutions.

To install, you connect a workstation to the separate configuration port and run through a browser-based wizard where you set up the operational mode, enter network parameters for the LAN and WAN ports, add a licence and secure administrative access. Make sure the WAN port has an active internet connection, since the appliance runs a full system check and downloads required updates before allowing you to proceed.

Sophos recently added a bunch of new features in a major upgrade and these include anonymising proxy detection, HTTPS scanning and improved AD support. All are freely available and the appliance automatically adds these during its update phases. It checks Sophos' website every five minutes for any updates, and downloads and applies them all behind the scenes.

A choice of five web-filtering policies help to get you off the ground, but it's easy enough to create your own default and custom policies. These are applied to groups, individual IP addresses or ranges, and you can pick and choose from more than 50 URL categories and apply time periods. You can also apply blocks on up to 30 download file types such as executables and videos.

With AD authentication, your policies follow users no matter which system they log in from, and reports will be able to provide specific details of their browsing habits. A couple of features we like are the option on the dashboard to enter a URL or IP address and see what, if any, category the appliance places it in. From the Group Policy section you can also enter a URL and a username or IP address, and test it to see what the assigned policy would do.

The WS1000 delivers fine filtering performance. With the gambling category blocked we tried to access online bingo sites, and of the 50 attempted we only got through to three. Games were harder to reach; with this blocked, we gave up after 50 unsuccessful attempts. The web interface also offers a good range of reporting facilities, with bar and pie charts showing all web activity. Data from these can be exported in CSV format for use in other reports. When the device was powered off or internet access to it was lost during testing, Sophos advised us via an email alert.

The WS1000 makes light work of implementing strong web-content filtering. The device was easy to install and manage. It also delivered a good filtering performance and is capable of keeping support overheads to a minimum.

Author: Dave Mitchell