The Dirty Secret Behind the UTM: What Security Vendors Don t Want You to Know

Transcription

1 The Dirty Secret Behind the UTM: What Security Vendors Don t Want You to Know

2 I n t r o d u c t i o n Until the late 1990s, network security threats were predominantly written by programmers seeking notoriety, or those who just wanted to test their skills and have some fun, at the expense of other computer users. As a result, early threats were limited in scope and capabilities, and were easily thwarted using a combination of anti-virus software and stateful packet inspection (SPI) firewalls. However, the evolution of the Internet has been met with increasingly sophisticated attacks. Many of today's threats easily bypass these traditional firewalls. To effectively combat these threats, most enterprises employ a robust, multi-layered security solution that includes protection against a wide range of Web and attacks. Such a layered defense strategy requires complex systems to effectively secure all of the firm s network assets, as well as the ability to stay abreast of the company's network traffic to determine if there are any unusual traffic patterns. Most importantly, the solution requires significant human and financial resources to purchase and operate. S m a l l B u s i n e s s S e c u r i t y N e e d s Because network threats are indiscriminately propagated via the Internet, small businesses face the same security threats and challenges as their enterprise counterparts. However, small businesses normally lack the human and financial resources required to implement a complex enterprise-level security solution a fact that puts them at far greater risk. They do not have the IT resources to spend on complicated installation, maintaining multiple security software packages, cumbersome upgrades, or user licensing issues. Small businesses require a solution that not only provides the same level of security as their enterprise counterparts, but is easily deployed and maintained. Automated tasks, an intuitive GUI, proactive alerts, and comprehensive reporting are all ideal characteristics for this type of solution. For the solution to meet these requirements, it will need to be on a single system that contains all required layers of security. At first glance, Unified Threat Management (UTM) devices seem to best fit the small business security needs, based on the cost, simplicity, and automation of these "all-in-one" devices. UTMs combine traditional firewall and VPN functionality with added security components such as intrusion prevention, anti-virus, URL filtering, and anti-spam. Having all of these security features on one appliance is more economical and easier to manage than the enterprise-level equivalent, thereby making UTMs an attractive solution for small businesses. T h e P r o b l e m w i t h L e g a c y U T M s On the surface, UTMs seemed to offer small businesses exactly what they require in a security solution. However, many security vendors did not realize the enormous amount of processing power required to run so many security components on one piece of hardware. The first UTMs were produced on hardware platforms barely faster than those used for stand-alone firewalls. Enabling any additional security features on the UTM added noticeable latency to network traffic especially anti-virus scanning. Anti-virus scanning is approximately a hundred times more processor intensive than typical firewall packet inspection, so enabling the AV scanning on most of the first UTMs would all but bring the system and network traffic to a crawl. Recognizing this performance problem, UTM vendors responded in different ways to minimize the system resources required by their solution. There have been two different approaches taken in attempt to solve the latency issue. One method is to reduce the number of security programs commanding those limited resources, thereby dramatically reducing the power and functionality of their product. While the enterprise version of a security system may be comprised of best-of-breed software and technology, the small business version of the product may lack key security components. Essential security programs such as intrusion prevention or anti-spam may be withheld, to help improve network processing speeds. Features may also be stripped out of the small business version, making the product less robust or less user friendly. The other method is to reduce the number of processes those security programs employ, by utilizing watered down security technologies. For example, a vendor's enterprise-level URL filtering capabilities may be comprised of 50 million black listed URLs but they cut that down to only a few thousand addresses for the small business version. Similarly, the enterprise-level anti-malware engine containing a million malware signatures may now only contain 3,000 signatures with all heuristic malware detection left out. Or, the enterprise-level anti-spam filter with the capability to catch spam and other malware based on their content or appearance may be reduced to a static blacklist of known spammer IP addresses for the small business version. This became a common practice as vendors filled their UTMs with checklist features that represented the bare minimum in security coverage. Small businesses that deployed these UTMs at their Internet gateways were in reality, faced with significant security exposure. Worst of all, this gave them a false sense of security. Instead of being the end all solution for such businesses, legacy UTMs became a box of compromises. T h e S o l u t i o n The answer to the UTM quandary is to completely rethink small business security and build a security solution specifically for this market from the ground up. Rather than watering down their enterprise product to sell it at a lower price to small businesses, security vendors must recognize 2

3 small businesses as a unique market and seek to satisfy their needs. Security vendors must provide them with a solution that blends the need for comprehensive, robust security with sufficient network performance in a package that fits the typical IT/security budget of a small business. Intuitive GUI interfaces, proactive alerts and reporting, and automatic software updates are also necessary to provide exceptional ease of use. The NETGEAR ProSecure UTM utilizes two elements that are critical to appropriately address the latency problem that has plagued most UTM vendors. First, the hardware is optimal. Since hardware with insufficient processing power creates long network delays and sometimes even timeouts as the system scans for security threats, the NETGEAR ProSecure UTM uses specialized CPUs optimized for network processing that reduces the potential for unacceptable levels of network latency. Additionally, the software on the NETGEAR UTM is optimized to process network traffic. Most security solutions from desktop security to gateway appliances utilize "batch-based" scanning technology. This is the same approach used in legacy desktop anti-virus software solutions where the file is the base unit for scanning. This means that the scanning of a file commences only after the entire file is received, and outputting starts only after the entire file has been scanned. As a result, end-users often experience long delays between the time the file is transferred and scanned. In contrast, the patent-pending Stream Scanning technology employed by the NETGEAR ProSecure UTM is based on the simple observation that Figure 1. UTM Anti-virus Throughput Comparison* network traffic travels in streams. Rather than wait for the entire file to arrive, the NETGEAR ProSecure UTM scans and processes data streams as they enter the network. Once the minimum number of bytes is received, scanning commences. The scan engine continues to scan additional bytes as they become available, while another thread outputs the bytes that have been scanned. This multithreaded approach, in addition to Stream Scanning s complex stream handling algorithms, enables the NETGEAR ProSecure UTM to perform complete scans with virtually no impact on network performance thus eliminating most scanning induced latency found in other legacy UTM solutions. Figure 2. UTM Malware Signature Library Size Comparison 3 * Based on NETGEAR internal throughput measurements done on 4/8/2009

4 Simply having sufficient throughput is not enough. UTM solutions must also possess considerable security technologies to effectively protect small businesses from the persistent stream of threats from multiple vectors. Anti-Spam Efficacy Solution A Solution B Solution C Solution D NETGEAR ProSecure UTM None Cloud based Spam Detection Hybrid In-the-Cloud Spam Detection Overall None Poor Basic Poor Excellent Figure 3. UTM Anti-spam Comparison The Netgear ProSecure UTM employs a fully featured enterprise-class malware scan engine that scans data streams for viruses, spyware, worms, Trojan horses, keyloggers, and other Web- and -based malware. It includes advanced scanning algorithms with an extensive virus/malware library that is up to 200 times larger than those contained in legacy UTM solutions. Most legacy UTM solutions contain insufficient anti-spam capabilities. Many feature basic real-time blacklists (s) as the only form of spam detection, while others choose to leave out anti-spam filtering altogether. The NETGEAR ProSecure UTM features in-the-cloud Distributed Spam Analysis technology that leverages a hybrid in-the-cloud architecture. This form of spam detection is highly adaptive to new types of spam, with little to no false positives and requires no additional user tuning to be effective. Addressing small business security needs in this way enables NETGEAR to provide them with the same level of security as their enterprise counterparts, while not subjecting their networks to unacceptable levels of latency. The NETGEAR ProSecure UTM eliminates the tradeoff associated with current UTMs and replaces it with a solution that truly offers a comprehensive set of robust security features, without compromising network bandwidth. C o n c l u s i o n Today's complex Internet-based security threats warrant a robust, multi-layered security solution to provide effective protection for the company's network. UTM vendors that sacrifice comprehensive protection in favor of higher profits put their small business customers at unreasonable risk. To solve their real-world security needs, security vendors must provide UTM solutions with true comprehensive security. With a complete security offering using best-of breed security technologies, the NETGEAR ProSecure UTM provides small businesses with the comprehensive all-in-one protection they need and deserve. Advanced hardware and patent-pending Stream Scanning technology avoids the crippling network latency that accompanies traditional UTM solutions. All of this, plus an intuitive GUI to facilitate easy setup and management, enables the NETGEAR ProSecure UTM to serve the specific needs of the small business. 4

5 NETGEAR ProSecure Gateway Security Appliance Solutions The ProSecure STM and UTM Gateway Security Appliances feature patent pending Stream Scanning technology that is designed to scan data streams as they enter the network. With Stream Scanning technology, the NETGEAR STM and UTM are able to process large amounts of data in real-time, using a single scan to identify spam, malware, security breaches, or unnecessary applications. This ensures that users on the network receive their and Web content clean and without delay. The ProSecure STM and UTM Gateway Security Appliances use a next-generation hybrid in-the-cloud Distributed Web Analysis architecture that looks up not only locally cached URLs but also hundreds of millions of URLs in the cloud, thus providing virtually limitless coverage. URLs are analyzed and classified into 64 different categories. Users are prevented from accessing sites deemed inappropriate, reducing the chances of downloading threats into the organization while increasing employee productivity. The ProSecure STM and UTM Gateway Security Appliances use a proactive behavioral defense system that eliminates the gap between a vulnerability being exploited and the fix. The NETGEAR solution uses forensic analysis to indentify suspicious characteristics of incoming and outgoing network traffic, and neutralizes them until they can be examined more closely. The ProSecure STM and UTM Gateway Security Appliances use a unique technology that detects and blocks outbreaks based on their rapid and wide distribution behavior. This approach can detect spam and malware outbreaks as soon as they emerge, and block all associated messages in real time. The ProSecure STM and UTM Gateway Security Appliances offer straight forward installation and maintenance. The STM is a transparent bridge that seamlessly integrates into existing network architectures. The UTM is an all-in-one network security solution that replaces any existing firewall or router. Each solution comes equipped with all the security software needed for your business with no per user licenses required. NETGEAR, the NETGEAR logo, Connect with Innovation and ProSecure are trademarks and/or registered trademarks of NETGEAR, Inc. and/or its subsidiaries in the United States and/or other countries. Other brand names mentioned herein are for identification purposes only and may be trademarks of their respective holder(s). Information is subject to change without notice NETGEAR, Inc. All rights reserved.