Sophos XG Firewall. Integrated Security for Better Protection. Jon Hope Channel Manager UK&I Network Security. James Burchell. Senior Sales Engineer

Transcription

1 Sophos XG Firewall Integrated Security for Better Protection Jon Hope Channel Manager UK&I Network Security James Burchell Senior Sales Engineer

2 In this session What we will cover XG What s included? What s in it for customers? What s in it for partners? Competitive Update XG vs UTM 9 features XG Hardware Licensing & Pricing Support Plans Cross-Selling Opportunities

3 XG What s Included? 3

4 XG Firewall: What does it include? Heartbeat Sophos Firewall OS (SF-OS) New Firewall Operating System and Software Platform XG Series Appliances Identical to SG Series except come preloaded with SF-OS Security Heartbeat Support for Security Heartbeat with Sophos Cloud Endpoints Migration Tools Later this year for migrating UTM 9 to SF-OS Sophos Firewall Manager (SFM) New on-premise Centralized Management Sophos Cloud Firewall Manager (CFM) Centralized Firewall Management in the Cloud (for partners only initially) Sophos iview Reporting Updated on-premise Centralized Reporting

5 Initial Target Market Segments Simple! XG Firewall Targeting New Prospects or Customers with no UTM Cloud customers (gain Security Heartbeat!) SEC customers migrating to Cloud UTM 9 Business as usual for existing UTM customers We WILL look after them! Don t worry about migration just yet Consider at renewal Or when migration tools available (CQ1)

6 Migration Starting as early as next For Customers Free upgrade to SF-OS Phased migration tools Ultimately push-button migration Automatic licensing migration Supports NG/SG + refresh program New capabilities for all customers! quarter For Partners 2 year active development on existing platforms Rich education programs/certification Global partner council as active advisors Partner exclusive early access programs CY 2015 CY 2016 UTM 9 SUM 4.3 XG Firewall CyberoamOS Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 EAL4 + V9.35 RED Wifi App Accuracy MESH impr V1 V9.4 Migration Sandbox subsc SG85, AP15C, RED15W V9.5 Minor features & performance V1.5 V2 V3 V MR MR MR

7 What s in it for Customers? 7

8 Compelling Reasons to Switch.. 1. Simpler 2. Faster 3. All-in-one protection 4. On-box reporting 5. Trusted industry leader

9 How does XG Firewall strengthen our story?

10 1. Simpler

11 XG Firewall: Simply solving common problems Difficult to identify and prioritize issues Complexity of policy creation and management Firewalls full of jargon and difficult to navigate Identifying risks Interactive dashboard instant data and drilldown Policy templates, easy to understand Self-documenting interface and menus User Threat Quotient and App Risk monitoring

12 Unified Policy Management Don t need to navigate multiple modules, or tabs to find polices All policies on one screen Users & Networking Business Applications Sort and Filter by Rule type Source Zone Destination Zone Status

13 Integrated Policies Everything on one screen Layer-8 User Identity Polices Zone based policies Web and App Control per policy IPS and Traffic Flow per Policy Security Heartbeat Policy Limit access for Red or Yellow Heartbeats

14 Business App Policy Templates Templates simplify WAF protection for common business applications Exchange Sharepoint Lync And Much More Templates can be customized Templates can be shared

15 2. Faster

16 Fast Path Technology FastPath optimizes firewall connectivity and routing Once connection is deemed trusted, all related packets take the fast path We properly scan all content in real-time or batch mode we do not stream scan Policy Engine (Who are you? Where are you going?) Malware Engine (Are you carrying anything dangerous?) FastPath Packet Optimization (e.g. for approved traffic travelling together ) Stream scanning (e.g. visual inspection only)

17 3. All-in-One Protection

18 Security Heartbeat & Advanced Threats Accelerated discovery Positive identification Automated response Instant insights into compromised systems Hostname, IP User Time period Threat App/Process

19 Security Heartbeat Network and Endpoint working better together to revolutionize advanced threat protection No Security issues Unwanted Application Compromised Infected Suspect Endpoint Endpoints Automatically isolate systems with Red Heartbeat Advanced Threat Protection 1. ATP detects and blocks suspect C&C connection 2. Context requested from Endpoint 3. Full information exchanged (user, process, etc.) 4. Admin notified about ATP event including context Heartbeat in Network Policies XG Firewall Server Internet Set more restrictive policies for systems with Yellow Heartbeat XG Firewall Accelerated Discovery Endpoint and network protection combine to identify unknown threats faster. Active Identification Reduces time taken to identify infected or at risk device or host by IP address alone. Automated Response Compromised endpoints can be automatically isolated or restricted by firewall policies based on Heartbeat status.

20 Heatbeat demo

21 4. On-Box Reporting

22 All-in-One includes Reporting Complete on-box reporting Standard! New Application and User Risk Analysis App Risk Meter Identifies overall risk level Application dashboard identifies risky apps and who s using them User Risk Quotient (UTQ) Identifies risky users Based on recent web browsing history and advanced threat event triggers

23 User Threat Quotient Identify risky users before they become a problem UTQ based on recent web history and ATP triggers Enables: Quick and easy policy changes User education Targeted intervention

24 UTQ demo

25 5. Trusted Industry Leader

26 Gartner MQ - Leader Sophos: 4th year as a leader in the UTM MQ One of three leaders in a hot space Recognized for our focus on ease of use Only leader to move up and right this year No significant cautions Fortinet: Slips in vision. Still a very strong competitor. Gartner: Difficult to sell and support. Usability and performance doesn t meet expectations Checkpoint: Expensive! Gartner: clients often cite price as the reason for not choosing Checkpoint Dell: Demoted out of the Leaders quadrant. Weakening. Gartner on Sonicwall: Poor usability, Channel disruption Watchguard: Demoted out of the Leaders quadrant. Stagnant. Gartner on Watchguard: Not visible, Not a competitive threat

27 Competitive Chart Sophos Fortinet XG Firewall FG Network Firewall/Protection $ = Another product required Dell SonicWALL TZ Series WatchGuard XTM Series Advanced threat protection Network and Endpoint Integration [Heartbeat] Unified Policies User Risk Visibility [User Threat Quotient] FastPath Packet Optimization Site to site and remote user VPN Secure web gateway Complete Protection [AV, AS, Enc., DLP] Dual antivirus $ $ $ Wi-Fi Reverse proxy Web application firewall User portal Full Reporting Best TMG feature parity $ $ $ $ $ Discover (TAP) Mode Deployment

28 XG Firewall vs. UTM 9 28

29 XG Firewall vs UTM 9 Feature Overlap Lots of compelling reasons to be excited about XG Highly requested features IN Copernicus (NOT in UTM 9) - User-based firewall polices - Zone based policies - IPS and QoS settings per policy - Firmware roll-back - Improved reporting - TAP mode deployments - Improved user authentication - Packet capture in UI - IMAP Proxy - Configuration API Innovations (NOT in UTM 9) - Security Heartbeat - Unified policy model - WAF Policy Templates - Transparent web filtering - Pharming protection Great Sophos UTM Technology - Wireless - RED - WAF - ATP - SPX - Object Model - Web Proxy Engine - Sophos AV Engine - Clientless Access Great Cyberoam Technology Added - User-Identity based Firewall - FastPath packet optimization (200%!) - Authentication - IPS - App Control - iview Reporting - Centralized Management & Reporting UTM features NOT in Copernicus - 3+ Node clustering - Clustering/HA for w models - RED to RED Tunnels - Some web security features (override, category quotas) - Endpoint Management (shifting to Cloud integration for HB) - SMC Integration - 2FA Support

30 XG Firewall: Making it easier to grow Easier to Sell Easier to Demo / PoC Easier to Manage Easier to Cross-Sell Simpler Faster More-inone Reporting Leader 5-Reasons Sophos is better than Competitors Discover (TAP) Mode Sophos Firewall Manager Cloud Firewall Manager iview Reporting Wireless APs / RED New: Centralized Management Centralized Reporting

31 What s in it for Sophos Partners? 31

32 Centralized Management and Reporting Sophos Firewall Manager (and CFM) Sophos iview Reporting Full-featured central mgmt/monitoring of SF-OS devices Free license for partners Reports on SF-OS, UTM 9, & CyberoamOS devices Free license for partners

33 Discover Mode Two options to easily evaluate and produce a comprehensive Security Audit Report TAP/Mirror Mode Existing Firewall Discover Mode Mirror Port Existing Switch Bridge Mode TAP/Mirror Mode No disruptive changes to the network Mirrors traffic through UTM/NGFW Monitor only, no enforcement Visibility (no enforcement) into: User Behavior User-App Risks & Usage Web Risks & Usage Intrusion Attacks & ATP Client Insights (Heartbeat), Virus, VPN coming post v1 Security Audit Report Protected Network Bridge Mode Offers extended reporting insight including Heartbeat Allows optional policy enforcement Traffic is passing through UTM/NGFW Possible use of bypass module

34 Hardware Appliances 34

35 XG Series Appliance Portfolio Hardware Appliance XG 85 XG 105 / 115 XG 125 / 135 XG 210 / 230 XG 310 / 330 XG 430 / 450 XG 550 XG 650 XG 750 Category Small Desktop Small Desktop Small Desktop Medium Midrange 1U Medium Midrange 1U Medium Midrange 1U Large High-end 2U Large High-end 2U Large High-end 2U Network Ports (standard) & 2 SFP 8 (FleXi Port) 8 (FleXi Port) 8 (FleXi Port) 8 (FleXi Port) FleXi Port Expansion Bays Maximum Ports n/a n/a n/a Redundancy n/a n/a n/a n/a n/a 2 SSD (RAID) & 2 nd hot-swap power optional (SG 450 only) 2 hot-swap SSD (RAID) 2 hot-swap power supplies 2 hot-swap SSD (RAID) 2 hot-swap power supplies 2 hot-swap SSD (RAID) 2 hot-swap power supplies Wireless Integr n optional Integr n optional Integr ac optional n/a n/a n/a n/a n/a n/a

36 Positioning for new models XG 85(w) XG 85/ XG 85w Introduced due to demand for lower cost model Same chassis as XG/SG 105/115 but no VGA port Some differences to other models: 8 GB Flash memory no HDD Does not support on-box reporting (use iview free option) No dual AV for V1, Sophos only w model 2 x 2:2 MIMO

37 Positioning for new models XG 750 XG 750 Opens up additional enterprise opportunities 2U chassis 8 FleXi Port bays (1 x 8 GE copper included) max 64 ports Hot swap SSDs, redundant power supplies and fans Different manufacturer, so different FleXi Ports

38 Accessories FleXi Ports, Transceivers & co. Additions to the price list XG 750 FleXi Port Modules 4 x 10GE SFP+* Module for 1U and 750 (550/650 coming later) LAN bypass modules (different for 1U, 550/650 and 750) *Please note: transceivers (mini GBICs) are never included for SFP and SFP+ ports and need to be ordered separately. LAN bypass what s that? Enables fail open operation data flows through the appliance even if there is a hw/sw fault or power outage. Uses relays to create a physical connection between two ports (bypass pair). Use for Bridge Mode when the appliance is connected behind the main firewall. new new BP 1/2 3/4 BP 1/2 3/4 WAN Normal mode LAN LAN LAN WAN Bypass mode LAN LAN LAN

39 XG Firewall Licensing 39

40 Base Firewall Firewall & VPN & Wireless Protection Modules: Network Protection EnterpriseGuard Firewall & VPN & Wireless Included Protection: Network Protection FullGuard Firewall & VPN & Wireless Included Protection: Network Protection Web Protection Protection Web Server Protect. Web Protection Enhanced Support + XG Series Appliance Web Protection Protection Web Server Protect. EnterpriseProtect Enhanced Support + XG Series Appliance TotalProtect

41 Software & Virtual 41

42 Changes to how we license SW/Virtual Addresses sales complexity such as: WAF protecting single server w/ many 1,000s of external users Double counts for IPv4 and IPv6 for the same user In-line with method used by the market in general Changed due to enhanced Base Firewall Sophos UTM XG Firewall Hardware SW / Virtual Hardware SW / Virtual One-time payment Per IP/users One-time payment Per (v) core/ram Incl. Essential Firewall Incl. Essential Firewall Incl. Base Firewall One-time fee for Base

43 Cross-sell Options 43

44 More Opportunities to Cross-Sell 1. RED and Wireless Access Points 2. Centralized Management Heartbeat 3. Centralized Reporting 4. Security Heartbeat with Sophos Cloud Endpoints 5. Support Plans

45 RED and Wireless Wireless included in Base Firewall Don t need to pay more for software Just buy the Access Points Perpetual license use it without renewal RED requires Network Protection Subscription Comes with IPS, ATP, Clientless VPN, and Security Heartbeat

46 Central Management Sophos Firewall Manager (SFM) 3 hardware models, 6 Virtual/SW models Virtual SFM based on # managed devices Support license req d (includes upgrades) Perpetual device management license HW Model SFM200 SFM300 SFM400 Recom. # managed devices Numbers are current estimates SW/Virtual Appliance Model SFMv15 SFMv50 SFMv100 SFMv200 SFMv500 SFMv1000 Licensed # managed devices ,000 Sophos Cloud Firewall Manager (CFM) Version 1 exclusively for Partners No charge for first version

47 Sophos iview v2 Perpetual license Licensing based on the storage size customer wants to report on Support license required (includes upgrades) iview v2 Virtual Appliance Models Central Reporting NEW NEW 100 GB 500 GB 1 TB 4 TB 8 TB Unlimited Free $ 995 $ 1,795 $ 5,995 $ 9,995 $ 19,995 iview v2 is clearly marked on the price list and will be introduced after SF-OS

48 Questions? 48

49