Moving Beyond Proxies
|
|
- Randall Cunningham
- 8 years ago
- Views:
Transcription
1 Moving Beyond Proxies A Better Approach to Web Security January 2015
2 Executive Summary Proxy deployments today have outlived their usefulness and practicality. They have joined a long list of legacy security products, providing limited security functionality against today s advanced threats. Once upon a time, Proxies fulfilled a need traditional firewalls could not meet: visibility into web traffic starting with categorization of HTTP and later HTTPS traffic. However, little to no emphasis was put on traffic and the vast number of applications utilizing other avenues of accessing corporate networks. Proxy vendors still over-emphasize the importance of HTTP and HTTPS traffic while downplaying the role of applications utilizing other entry points in cyber attacks. The limited benefits of proxy solutions come at a great cost: network latency, complex and costly deployments, arbitrary security limitations, such as application bypass lists, and slow adoption of new security technologies are just some examples of the downfalls of proxy deployments. With their roots in Web access control, proxies base security decisions primarily on URL categories, and secondarily on content, leaving proxy customers vulnerable to attacks in spite of complex security deployments. The shortcomings of proxies intensified with the explosive growth of web- and network-based applications, combined with the changing threat landscape and increased adoption of mobile technology. These changes brought with them the need for less complex, more comprehensive, and higher performing solutions a need met by today s next-generation security platforms with fully integrated security technology that protects all applications, entry points and users with streamlined, easy-to-manage deployments able to handle today s speed of business. The Rise and Fall of Proxies A Short Overview Traditional firewalls enforced network access via positive control models. Access Control Lists (ACLs) performed this function, often in routers. Unfortunately, these traditional firewalls shared a common shortcoming the inability to inspect all of the applications traversing the network across all ports and protocols. Proxy-based devices offered the ability of more granular analysis and visibility into a small set of applications and protocols where traditional firewalls were blind. Many organizations started to deploy proxy-based devices to gain a degree of visibility and control over web traffic because their stateful inspection firewalls lacked this critical capability. Those who added dedicated proxies in conjunction with their existing legacy firewalls now had access to security functions such as URL filtering, and web access control. Over time, proxy-based devices evolved to become part of a growing collection of security point solutions, like dedicated anti virus (AV) or Intrusion Prevention Systems (IPS). Each point solution came with a limited view of network traffic, mainly focused on HTTP (port 80) and HTTPS (port 443) traffic. Each solution also added to the complexity of security networks, while still not improving the lack of visibility into non-web based traffic. Web proxies are inherently slow. The effort needed to inspect HTTP and HTTPS traffic inline results in growing network latency especially in today s accelerating business environment with ever increasing web traffic. Web content has become so dynamic, that latencies associated with proxy web traffic inspection have become a major burden to IT departments. Companies started to deploy multiple proxy appliances just to keep up with network requirements, adding to an already complex network environment. The explosive growth of web- and network-based applications, combined with the changing threat landscape, and the fast adoption of mobile access technology in the work place brought with it the need for less complex, more comprehensive, and higher performing solutions that address the needs of today s business environment. Let s take a closer look at why more and more businesses are choosing to move away from proxies. PAGE 3
3 The Increasing Irrelevance of Proxies Limited visibility into ports and protocols The list of applications and protocols supported by most proxies is limited to a handful of applications (e.g. web-based clients and media streaming) and specific protocols, such as HTTP (port 80), HTTPS (port 443), and FTP (port 21). While many applications are web-based by design, and are using ports 80 or 443, some very common applications, like Skype, BitTorrent, or Lync are capable of dynamically seeking out and utilizing any available port on the network. These port-hopping capabilities allow these applications to scale, be responsive, service the needs of the user and bypass the limited visibility and security technologies of proxy-based devices. Similarly, proxies are limited in their ability to protect against evasive techniques used by tools such as open proxy servers (e.g PHProxy or CGIproxy), or anonymizers (e.g. Tor or Hamachi). Scanning determined by URL category, not content With their origin in URL categorization the security functionality of proxies is built around that capability. Security decisions are made based on URL categorization, with the majority of identified web requests bypassing additional security engines. Only a small amount of all web traffic is sent for content inspection, since the URL category determines what is analyzed for content. This prioritization of URL categories over actual content is accompanied by a higher exposure to threats and decreased security. Decreased network performance Proxy-based devices require significantly more computing resources due to the additional proxy connections being established between the source client, the proxy device, and the destination server. These workload demands, along with the latency introduced with proxied connections, have relegated proxy-based devices to be deployed where rapid throughput and high scalability are not key requirements. Confining the placement of proxies to a small portion of traffic on the network can help; otherwise the entire organization s network performance may suffer. Growing application bypass lists To address the performance issues of proxies, web security vendors are constantly increasing the list of applications that bypass the security engines. This application bypass list is often determined by the security vendor and cannot be modified by the customer. In addition, vendors provide their customers with the option to create their own application bypass lists. These lists impose arbitraty limitations on the capabilities of the purchased security solution, and reduce its effectiveness. Slow adoption of new security functionality Proxy-based products struggle to keep pace with the rapid development of new applications and updates of existing applications or protocols. Proxies simply can t scale appropriately to keep pace with the highly dynamic content of the Internet and Web 2.0 applications that continually undergo updates and improvements. Interruptive Technology With proxy deployments all users across the organization must have their traffic requests steered to the proxy-based device. There are two primary proxy deployment methods, explicit and transparent, both involve complex implementations and include unique challenges. In both scenarios, traffic egress points need to be cut and proxies need to be physically inserted, resulting in major traffic interruptions and frequent traffic-flow complications. An Administrative and Financial Nightmare Deployments of proxy-based solutions are becoming increasingly complex in order to keep up with today s web security requirements. Antivirus appliances, external database servers, management servers, and SSL decryption appliances are just a few examples of additional hardware required to PAGE 4
4 deploy a proxy solution. This bolt-on approach is becoming increasingly pricey and difficult to manage. As can be seen in figure 1 below, a typical deployment of proxy solution is crying out for simplification. SQL Server Log Server Management Server Transparent Identification Agent LB Firewall SIEM HA Policy Server Web Proxy Figure 1: A typical Proxy deployment is too complex for today s business environment The Beauty of Integrating Web Security into a Next-Generation Security Platform Unlike proxy solutions, next-generation security platforms have complete visibility into network ports and applications. Palo Alto Networks next generation security platform tackles the fundamental problems associated with proxy-based security solutions, including standalone URL filtering. It combines the benefits of Threat Prevention, Sandboxing, and URL filtering with the comprehensive application control of the Palo Alto Networks nextgeneration firewall and eliminates compromise by natively classifying all traffic, identifying the application regardless of port, determining the content, malicious or otherwise, and mapping the traffic to the user, regardless of location or device type. This allows companies to achieve their security objectives without the latency or complexity of proxy deployments: I No Longer Needed Their Proxies A top technology provider for a global consulting firm currently protects approximately 8,000 users via a High Availability (HA) pair of Palo Alto Networks PA-5020 security platforms at their network perimeter. These appliances integrated smoothly with the customer s existing high-speed switching gear, and were placed in front of their standalone, proxy-based URL filtering devices. Gain unprecedented visibility into the applications, the related content and users with actionable intelligence for policy setting, forensics and reporting Safely enable applications, allowing only those you need to run the business and implicitly denying all others Prevent known threats by eliminating unwanted applications to reduce your threat footprint and applying port-agnostic threat prevention to allowed traffic Seven months after having deployed the Palo Alto Networks security platform, the network design consultant realized that their proxy appliances hadn t been logging any security alerts. Upon investigation, they learned the Palo Alto Networks equipment was catching all of the malware and continued to protect their network against threats. The customer decided to disconnect and decommission their proxy-based appliances, simplifying network architecture and saving operational and capital expenses. PAGE 5
5 Block unknown threats that could potentially come through newly developed cloud applications with real-time sandbox-based behavioral analysis and automated signature delivery A Unified, Comprehensive Security Platform for known and unknown threats The Palo Alto Networks next generation security platform a combination of next-generation firewall and advanced threat prevention technologies delivers visibility into, and control over applications, users, and content for enterprise data networks to protect against known and unknown threats alike. Tightly integrated technologies identify the applications in use across all ports, search for threats within the content, and identify the user associated with the event. Advanced threat technologies continually look for and block known and unknown threats inside the application traffic. The first task executed by Palo Alto Networks next generation security platform is to determine the precise identity of the application regardless of port, protocol, or evasive technique employed; the identity then becomes the basis of the firewall security policy. Palo Alto Networks next generation security platform is continually updated with information on the latest applications and threats, along with malware details collected by the WildFire cloud-based virtual environment. Easy-to-deploy, integrated Technology Deploying network security technology from Palo Alto Networks is easy and doesn t require multiple, independently managed endpoint solutions, or hardware components. With a single policy, all Palo Alto Networks security technologies can be brought to bear against that policy s traffic. An administrator simply specifies one or more security profiles within the management console, creating effective security policies. Palo Alto Networks security platforms offer flexible deployment modes along with a rich set of networking features, allowing network engineers to easily insert the network security platform into any existing network architectural design. Complete Visibility without the Latency of a Proxy The Palo Alto Networks platform sees all network traffic across all ports. Predictable, highspeed performance is achieved through a single-pass software engine combining application, content and user ID, along with a Palo Alto Networks offers a next generation security platform that safely enables all applications through granular use of controls and prevention of known and unknown cyber threats for all users on any device across any network. A True Solution Shouldn t Take Forever A Canadian organization in the energy industry with one thousand employees struggled with implementing proxy devices into their network environment. They spent an entire year toiling with their proxies, but couldn t get it to work to their satisfaction resulting in six to seven use cases they never fully solved. Palo Alto Networks offered a solution evaluation. Installing the equipment using a Layer 1 (Virtual Wire) deployment mode, the engineer was able to solve all of the company s proxy problems in just half a day. This compelling demonstration convinced the customer to purchase several Palo Alto Networks solutions and manage them with a Palo Alto Networks Panorama central management console. purpose-built hardware platform that uses function-specific processing for networking, security, threat prevention, and management functions. Dynamic, Contextual Policies more than URL Filtering and Web Security Complete visibility and control over applications, users and content arm security administrators with meaningful data points PAGE 6
6 to use in creating dynamic, contextual policies. In contrast, traditional standalone URL filtering and web security devices, such as proxies, only see a small portion of network traffic and focus solely on classifying websites into defined URL categories. They lack the shared intelligence, which Palo Alto Networks next generation security platform offers. The Palo Alto Networks URL filtering security profile works alongside all other integrated technologies and available security profiles, thereby creating a complete threat protection framework, using context gained from the network traffic. For example, Palo Alto Networks App-ID technology perfectly complements the URL filtering security profile to enforce control of network activity, while preventing the use of URL filtering avoidance tools. Identifying the application, who the user is and where they re coming from is a powerful capability in policy enforcement, especially when combined with URL filtering and threat prevention security profiles. Ultimately, this liberates security administrators to create policies that safely enable traffic, versus simply blocking or allowing traffic for a specific URL category. Protection across the entire network for all devices The next generation security platform can be seamlessly extended from on-premises protection to remote and mobile users with GlobalProtect mobile user protection and Traps endpoint protection. Both technologies extend policies seamlessly to remote, mobile, and endpoint users. This eliminates the need for additional point solutions, which would increase the complexity of a proxy deployment even more. THREAT INTELLIGENCE CLOUD AUTOMATED NATIVELY INTEGRATED EXTENSIBLE NEXT-GENERATION FIREWALL ADVANCED ENDPOINT PROTECTION Figure 2: Palo Alto Networks Next Generation Security Platform PAGE 7
7 Moving Beyond Proxies with Palo Alto Networks Next Generation Security Platform As applications and threats continue to evolve, it becomes increasingly difficult for some organizations to secure their networks without getting in the way of their employees conducting business. Challenges unfold as diverse users roam the network with an assortment of company-owned and personal devices, accessing new types of applications that communicate across many different network ports and protocols. Although proxy-based devices support the original capabilities of traditional firewalls with an added degree of visibility and control over web traffic, that visibility is restricted to a limited number of protocols such as HTTP (port 80) and HTTPS (port 443). Palo Alto Networks delivers a next generation security platform to secure corporate networks, utilizing dynamic policies that take advantage of the context shared between applications, users, and content gleaned from the platform s central location within the network. The platform provides complete network visibility to apply granular security over an organization s users and safe enablement of their applications regardless of ports, protocols, or evasive techniques. Implementing next-generation security and threat prevention technologies from Palo Alto Networks provides IT organizations the confidence to reevaluate their original requirements for utilizing proxy-based devices, like standalone URL filtering solutions. Contact your Palo Alto Networks authorized reseller to learn more and arrange an online or in-person demonstration Great America Parkway Santa Clara, CA Main: Sales: Support: Copyright 2015, Palo Alto Networks, Inc. All rights reserved. Palo Alto Networks, the Palo Alto Networks Logo, PAN-OS, App-ID and Panorama are trademarks of Palo Alto Networks, Inc. All specifications are subject to change without notice. Palo Alto Networks assumes no responsibility for any inaccuracies in this document or for any obligation to update information in this document. Palo Alto Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice. PAN_WP_MBP_010715
Still Using Proxies for URL Filtering? There s a Better Way
Still Using Proxies for URL Filtering? There s a Better Way October 2013 The Arrival of Proxies Firewalls enforce network access via a positive control model, where only specific traffic defined in policies
More informationContent-ID. Content-ID URLS THREATS DATA
Content-ID DATA CC # SSN Files THREATS Vulnerability Exploits Viruses Spyware Content-ID URLS Web Filtering Content-ID combines a real-time threat prevention engine with a comprehensive URL database and
More informationWildFire. Preparing for Modern Network Attacks
WildFire WildFire automatically protects your networks from new and customized malware across a wide range of applications, including malware hidden within SSL-encrypted traffic. WildFire easily extends
More informationThe Advanced Attack Challenge. Creating a Government Private Threat Intelligence Cloud
The Advanced Attack Challenge Creating a Government Private Threat Intelligence Cloud The Advanced Attack Challenge One of the most prominent and advanced threats to government networks is advanced delivery
More informationContent-ID. Content-ID enables customers to apply policies to inspect and control content traversing the network.
Content-ID Content-ID enables customers to apply policies to inspect and control content traversing the network. Malware & Vulnerability Research 0-day Malware and Exploits from WildFire Industry Collaboration
More informationVM-Series for VMware. PALO ALTO NETWORKS: VM-Series for VMware
VM-Series for VMware The VM-Series for VMware supports VMware NSX, ESXI stand-alone and vcloud Air, allowing you to deploy next-generation firewall security and advanced threat prevention within your VMware-based
More informationREPORT & ENFORCE POLICY
App-ID KNOWN PROTOCOL DECODER Start Decryption (SSL or SSH) Decode Signatures Policy IP/Port Policy Application Signatures Policy IDENTIFIED TRAFFIC (NO DECODING) UNKNOWN PROTOCOL DECODER Apply Heuristics
More informationBreaking the Cyber Attack Lifecycle
Breaking the Cyber Attack Lifecycle Palo Alto Networks: Reinventing Enterprise Operations and Defense March 2015 Palo Alto Networks 4301 Great America Parkway Santa Clara, CA 95054 www.paloaltonetworks.com
More informationApp-ID. PALO ALTO NETWORKS: App-ID Technology Brief
App-ID Application Protocol Detection / Decryption Application Protocol Decoding Application Signature Heuristics App-ID uses as many as four identification techniques to determine the exact identity of
More informationCASE STUDY. AUSTRIAN AIRLINES Modernizes Network Security for First Class Performance
CASE STUDY AUSTRIAN AIRLINES PAGE 1 PA-5020 (2) Austrian Airlines is Austria s largest carrier and operates a global network of routes to around 130 destinations. The company s hub at Vienna International
More informationCASE STUDY. NEXON ASIA PACIFIC Nexon Securely Onboards 25 Cloud Customers in Only Eight Months
CASE STUDY NEXON ASIA PACIFIC PAGE 1 Nexon Asia Pacific is a Managed Security Service Provider (MSSP) that delivers infrastructure and software to provide secure connectivity and productivity applications,
More informationEnterprise Security Platform for Government
Enterprise Security Platform for Government Today s Cybersecurity Challenges in Government Governments are seeking greater efficiency and lower costs, adopting Shared Services models, consolidating data
More informationCybercrime: evoluzione del malware e degli attacchi. Cesare Radaelli Regional Sales Manager, Italy cradaelli@paloaltonetworks.com
Cybercrime: evoluzione del malware e degli attacchi Cesare Radaelli Regional Sales Manager, Italy cradaelli@paloaltonetworks.com About Palo Alto Networks We are the network security company World-class
More informationA Modern Framework for Network Security in the Federal Government
A Modern Framework for Network Security in the Federal Government 1 A MODERN FRAMEWORK FOR NETWORK SECURITY IN THE FEDERAL GOVERNMENT Trends in Federal Requirements for Network Security In recent years,
More informationSECURITY PLATFORM FOR HEALTHCARE PROVIDERS
SECURITY PLATFORM FOR HEALTHCARE PROVIDERS Our next-generation security platform prevents successful cyberattacks for hundreds of hospitals, clinics and healthcare networks across the globe. Palo Alto
More informationNext-Generation Firewall Overview
Next-Generation Firewall Overview Business and technology advancements have steadily eroded the protection that the traditional firewall provided. Users have come to expect to be able to work from any
More informationHow to Dramatically Reduce the Cost and Complexity of PCI Compliance
How to Dramatically Reduce the Cost and Complexity of PCI Compliance Using Network Segmentation and Policy-Based Control Over Applications, Users And Content to Protect Cardholder Data December 2008 Palo
More informationNext Generation Enterprise Network Security Platform
Next Generation Enterprise Network Security Platform November 2014 Lyndon Clough - Territory Sales Manager Derran Guinan Systems Engineer Agenda The Palo Alto Networks story Today s Threat Landscape The
More informationNext-Generation Firewall Overview
Next-Generation Firewall Overview Fundamental shifts in the application and threat landscape, user behavior, and network infrastructure have steadily eroded the security that traditional port-based firewalls
More informationAPERTURE. Safely enable your SaaS applications.
APERTURE Safely enable your SaaS applications. Unsanctioned use of SaaS (Software as a Service) applications is creating gaps in security visibility and new risks for threat propagation, data leakage and
More informationDecryption. Palo Alto Networks. PAN-OS Administrator s Guide Version 6.0. Copyright 2007-2015 Palo Alto Networks
Decryption Palo Alto Networks PAN-OS Administrator s Guide Version 6.0 Contact Information Corporate Headquarters: Palo Alto Networks 4401 Great America Parkway Santa Clara, CA 95054 www.paloaltonetworks.com/company/contact-us
More informationNext-Generation Firewall Overview
Next-Generation Firewall Overview Recent changes in application behavior and usage patterns have steadily eroded the protection that the traditional firewall once provided. Users are accessing any application,
More informationCASE STUDY. RHEINLAND VERSICHERUNGSGRUPPE Who Ensures Security for The Insurers? RHEINLAND VERSICHERUNGSGRUPPE Who Ensures Security for The Insurers?
CASE STUDY RHEINLAND VERSICHERUNGSGRUPPE PAGE 1 RheinLand Versicherungsgruppe (RheinLand Insurance Group) is the holding company for several insurance companies. Established in 1880, it operates RheinLand
More informationPalo Alto Networks Next-Generation Firewall Overview
PALO PALO ALTO ALTO NETWORKS: NETWORKS: Next-Generation Firewall Firewall Feature Feature Overview Overview Palo Alto Networks Next-Generation Firewall Overview Fundamental shifts in application usage,
More informationThings Your Next Firewall Must Do
10 Things Your Next Firewall Must Do Introduction Without question, your network is more complex than ever before. Your employees are accessing any application they want, using work or personal devices.
More informationFirewall Feature Overview
Networking P A L O A LT O N E T W O R K S : F i r e w a l l F e a t u r e O v e r v i e w Firewall Feature Overview A next-generation firewall restores application visibility and control for today s enterprises
More informationUsing Palo Alto Networks to Protect the Datacenter
Using Palo Alto Networks to Protect the Datacenter July 2009 Palo Alto Networks 232 East Java Dr. Sunnyvale, CA 94089 Sales 866.207.0077 www.paloaltonetworks.com Table of Contents Introduction... 3 Granular
More informationPalo Alto Networks Next-generation Firewall Overview
PALO PALO ALTO ALTO NETWORKS: NETWORKS: Next-Generation Firewall Firewall Feature Feature Overview Overview Palo Alto Networks Next-generation Firewall Overview Fundamental shifts in application usage,
More informationUnified Security, ATP and more
SYMANTEC Unified Security, ATP and more TAKE THE NEXT STEP Martin Werner PreSales Consultant, Symantec Switzerland AG MEET SWISS INFOSEC! 27.01.2016 Unified Security 2 Symantec Enterprise Security Users
More informationWhat s Next for Network Security - Visibility is king! Gøran Tømte March 2013
What s Next for Network Security - Visibility is king! Gøran Tømte March 2013 Technology Sprawl and Creep Aren t the Answer More stuff doesn t solve the problem Firewall helpers have limited view of traffic
More informationMay 2010. Palo Alto Networks 232 E. Java Drive Sunnyvale, CA 94089 408-738-7700 www.paloaltonetworks.com
Application Visibility and Control: In the Firewall vs. Next to the Firewall How Next-Generation Firewalls are Different From UTM and IPS-based Products May 2010 Palo Alto Networks 232 E. Java Drive Sunnyvale,
More informationSonicWALL Clean VPN. Protect applications with granular access control based on user identity and device identity/integrity
SSL-VPN Combined With Network Security Introducing A popular feature of the SonicWALL Aventail SSL VPN appliances is called End Point Control (EPC). This allows the administrator to define specific criteria
More informationAchieve Deeper Network Security and Application Control
Achieve Deeper Network Security and Application Control Dell Next-Generation Firewalls Abstract Next-generation firewalls (NGFWs) have emerged to revolutionize network security as we once knew it. Yet
More informationCybersecurity Imperatives: Reinvent Your Network Security With Palo Alto Networks
Cybersecurity Imperatives: Reinvent Your Network Security With Palo Alto Networks August 2013 Executive Summary Cybersecurity has become a leading topic both within and beyond the corporate boardroom.
More informationNetwork Security for Mobile Users
Network Security for Mobile Users Establishing a Logical Perimeter October 2014 Table of Contents Executive Summary 3 The Enterprise Standard of Security 4 Many Ways to Leave the Network 4 A Requiem for
More informationPalo Alto Networks and Splunk: Combining Next-generation Solutions to Defeat Advanced Threats
Palo Alto Networks and Splunk: Combining Next-generation Solutions to Defeat Advanced Threats Executive Summary Palo Alto Networks strategic partnership with Splunk brings the power of our next generation
More informationDatabase Security in Virtualization and Cloud Computing Environments
White Paper Database Security in Virtualization and Cloud Computing Environments Three key technology challenges in protecting sensitive data Table of Contents Securing Information in Virtualization and
More informationAchieve Deeper Network Security
Achieve Deeper Network Security Dell Next-Generation Firewalls Abstract Next-generation firewalls (NGFWs) have taken the world by storm, revolutionizing network security as we once knew it. Yet in order
More informationNext-Generation Firewalls: Critical to SMB Network Security
Next-Generation Firewalls: Critical to SMB Network Security Next-Generation Firewalls provide dramatic improvements in protection versus traditional firewalls, particularly in dealing with today s more
More informationCisco ASA and Cloud Web Security: Best-in-Class Network Security Combined with Best-in-Class Web Security
White Paper Cisco ASA and Cloud Web Security: Best-in-Class Network Security Combined with Best-in-Class Web Security Introduction Organizations that want to harness the power of the web must deal with
More informationSecurity is a top priority. The reasons for reliable network security keep growing.
Network Security Security is a top priority. The reasons for reliable network security keep growing. Convergence of voice and data networks Changing compliance regulations Explosion of Web 2.0 business
More informationWhat s Next for the Next Generation Firewall Vendor Palo Alto Networks Overview. October 2010 Matias Cuba - Regional Sales Manager Northern Europe
What s Next for the Next Generation Firewall Vendor Palo Alto Networks Overview October 2010 Matias Cuba - Regional Sales Manager Northern Europe About Palo Alto Networks Palo Alto Networks is the Network
More informationPreventing Data Leaks At The Firewall A Simple, Cost-Effective Way To Stop Social Security and Credit Card Numbers From Leaving Your Network
Preventing Data Leaks At The Firewall A Simple, Cost-Effective Way To Stop Social Security and Credit Card Numbers From Leaving Your Network December 2008 Palo Alto Networks 232 E. Java Dr. Sunnyvale,
More informationFROM PRODUCT TO PLATFORM
FROM PRODUCT TO PLATFORM DATA EQUIPMENT 2016 Mikkel Bossen Agenda Today s Challenges Data Growth, SSL encryption, Application Growth & SaaS What s hiding in under the surface? Legacy Security is that really
More informationCASE STUDY. UNIVERSITY OF SOUTHAMPTON Top UK Research University Gets Future-Proof Solution for Bandwidth and Security Needs
CASE STUDY UNIVERSITY OF SOUTHAMPTON PAGE 1 Founded in 1862, the University of Southampton is a public university located in Southampton, England. It is a research-intensive university and a founding member
More informationPalo Alto Networks. October 6
Palo Alto Networks October 6 Agenda Malware Trends by the numbers Protect Locally Share Globally Delivery methods 21.5% ~14% OF MALWARE HAS BEEN DELIVERED OVER APPS OTHER THAN WEB AND EMAIL IN 2015 8.2%
More informationIntegrated Approach to Network Security. Lee Klarich Senior Vice President, Product Management March 2013
Integrated Approach to Network Security Lee Klarich Senior Vice President, Product Management March 2013 Real data from actual networks 2 2012, Palo Alto Networks. Confidential and Proprietary. 2008: HTTP,
More informationCarbon Black and Palo Alto Networks
Carbon Black and Palo Alto Networks Bring Together Next-Generation Endpoint and Network Security Solutions Endpoints and Servers in the Crosshairs of According to a 2013 study, 70 percent of businesses
More informationSourcefire Solutions Overview Security for the Real World. SEE everything in your environment. LEARN by applying security intelligence to data
SEE everything in your environment LEARN by applying security intelligence to data ADAPT defenses automatically ACT in real-time Sourcefire Solutions Overview Security for the Real World Change is constant.
More informationTop 10 Reasons Enterprises are Moving Security to the Cloud
ZSCALER EBOOK Top 10 Reasons Enterprises are Moving Security to the Cloud A better approach to security Albert Einstein defined insanity as doing the same thing over and over again and expecting different
More informationMoving Network Security from Black and White to Color Refocusing on Safely Enabling Applications
Moving Network Security from Black and White to Color Refocusing on Safely Enabling Applications July 2009 Palo Alto Networks 232 E. Java Drive Sunnyvale, CA 94089 408-738-7700 www.paloaltonetworks.com
More informationTHREAT INTELLIGENCE CLOUD
THREAT INTELLIGENCE CLOUD Leveraging the Global Threat Community to Prevent Known and Unknown Threats Palo Alto Networks 4401 Great America Parkway Santa Clara, CA 95054 www.paloaltonetworks.com Executive
More informationThe Benefits of SSL Content Inspection ABSTRACT
The Benefits of SSL Content Inspection ABSTRACT SSL encryption is the de-facto encryption technology for delivering secure Web browsing and the benefits it provides is driving the levels of SSL traffic
More informationPalo Alto Networks Cyber Security Platform for the Software Defined Data center. Zekeriya Eskiocak Security Consultant Palo Alto Networks
Palo Alto Networks Cyber Security Platform for the Software Defined Data center Zekeriya Eskiocak Security Consultant Palo Alto Networks Evolution towards a software defined data center Server Virtualiza-on
More informationWhite Paper. Time for Integrated vs. Bolted-on IT Security. Cyphort Platform Architecture: Modular, Open and Flexible
White Paper Time for Integrated vs. Bolted-on IT Security Cyphort Platform Architecture: Modular, Open and Flexible Overview This paper discusses prevalent market approaches to designing and architecting
More informationSTRATEGIC WHITE PAPER. Securing cloud environments with Nuage Networks VSP: Policy-based security automation and microsegmentation overview
STRATEGIC WHITE PAPER Securing cloud environments with Nuage Networks VSP: Policy-based security automation and microsegmentation overview Abstract Cloud architectures rely on Software-Defined Networking
More informationPanorama PANORAMA. Panorama provides centralized policy and device management over a network of Palo Alto Networks next-generation firewalls.
provides centralized policy and device management over a network of Palo Alto Networks next-generation firewalls. View a graphical summary of the applications on the network, the respective users, and
More informationMEETING CSIP OBJECTIVES WITH AN AUTOMATED AND PREVENTIVE SECURITY APPROACH
MEETING CSIP OBJECTIVES WITH AN AUTOMATED AND PREVENTIVE SECURITY APPROACH A Palo Alto Networks and Channel Partner Case Study Every day, the U.S. federal government experiences increasingly sophisticated
More informationDatabase Security, Virtualization and Cloud Computing
Whitepaper Database Security, Virtualization and Cloud Computing The three key technology challenges in protecting sensitive data in modern IT architectures Including: Limitations of existing database
More informationSecuring the Virtualized Data Center With Next-Generation Firewalls
Securing the Virtualized Data Center With Next-Generation Firewalls Data Center Evolution Page 2 Security Hasn t Kept Up with Rate Of Change Configuration of security policies are manual and slow Weeks
More informationReducing Costs With Next-generation Firewalls. Investing in Innovation Pays Cost Savings Dividends
Reducing Costs With Next-generation Firewalls Investing in Innovation Pays Cost Savings Dividends August 2011 Table of Contents Executive Summary 3 IT Security: Regain Visibility and Control While Reducing
More informationFIREWALL OVERVIEW. Palo Alto Networks Next-Generation Firewall
FIREWALL OVERVIEW Palo Alto Networks Next-Generation Firewall Fundamental shifts in application usage, user behavior, and complex, convoluted network infrastructure create a threat landscape that exposes
More informationFail-Safe IPS Integration with Bypass Technology
Summary Threats that require the installation, redeployment or upgrade of in-line IPS appliances often affect uptime on business critical links. Organizations are demanding solutions that prevent disruptive
More informationOn-Premises DDoS Mitigation for the Enterprise
On-Premises DDoS Mitigation for the Enterprise FIRST LINE OF DEFENSE Pocket Guide The Challenge There is no doubt that cyber-attacks are growing in complexity and sophistication. As a result, a need has
More informationThe SIEM Evaluator s Guide
Using SIEM for Compliance, Threat Management, & Incident Response Security information and event management (SIEM) tools are designed to collect, store, analyze, and report on log data for threat detection,
More informationDeployment Guide for Microsoft Lync 2010
Deployment Guide for Microsoft Lync 2010 Securing and Accelerating Microsoft Lync with Palo Alto Networks Next-Generation Firewall and Citrix NetScaler Joint Solution Table of Contents 1. Overview...3
More informationComprehensive real-time protection against Advanced Threats and data theft
TRITON AP-WEB Comprehensive real-time protection against Advanced Threats and data theft Your business and its data are under constant attack. Traditional security solutions no longer provide sufficient
More informationHow To Bring In Palo Alonnetworks
Viewing Palo Alto Networks as a Strategic Network Security Platform IANS WORKING KNOWLEDGE SERIES CASE STUDY 2010 About Capital Region Health Care (CRHC) and Concord Hospital CRHC includes Concord Hospital,
More informationCASE STUDY OSRAM. Next-Generation Firewall
CASE STUDY OSRAM World s ANNIE Leading WRITE Light SCHOOLS Manufacturer Saves $120,000 Hogwarts Per Works Year by Magic Replacing with 78 Proxy the Servers Next-Generation Firewall PA-5020 (6) OSRAM is
More informationHow To Sell Security Products To A Network Security Company
Market Segment Definitions Author Joshua Mittler Overview In addition to product testing, NSS Labs quantitatively evaluates market size for each of the product categories tested. NSS provides metrics that
More informationPanorama. Panorama provides network security management beyond other central management solutions.
Panorama Panorama provides network security management beyond other central management solutions. Headquarters PANORAMA Simplified Powerful Policy Enterprise Class Management Unmatched Visibility Data
More informationNext Generation Security Strategies. Marc Sarrias Regional Sales Manager msarrias@paloaltonetworks.com
Next Generation Security Strategies Marc Sarrias Regional Sales Manager msarrias@paloaltonetworks.com IT Ever-Evolving Challenges & Constraints Support IT Initiatives Minimize Business Risks from Cybersecurity
More informationPalo Alto Networks Gets Top Marks for Solving Bandwidth and Security Issues for School District
Palo Alto Networks Gets Top Marks for Solving Bandwidth and Security Issues for School District BACKGROUND Located in British Columbia, Canada, the School District of Chilliwack is a learning community
More informationGuideline on Firewall
CMSGu2014-02 Mauritian Computer Emergency Response Team CERT-MU SECURITY GUIDELINE 2011-02 Enhancing Cyber Security in Mauritius Guideline on Firewall National Computer Board Mauritius Version 1.0 June
More informationOVERVIEW. Enterprise Security Solutions
Enterprise Security Solutions OVERVIEW For more than 25 years, Trend Micro has innovated constantly to keep our customers ahead of an everevolving IT threat landscape. It s how we got to be the world s
More informationMcAfee Network Security Platform
McAfee Network Security Platform Next Generation Network Security Youssef AGHARMINE, Network Security, McAfee Network is THE Security Battleground Who is behind the data breaches? 81% some form of hacking
More informationSecuring Traditional and Cloud-Based Datacenters With Next-generation Firewalls
Securing Traditional and Cloud-Based Datacenters With Next-generation Firewalls February 2015 Table of Contents Executive Summary 3 Changing datacenter characteristics 4 Cloud computing depends on virtualization
More informationControlling Peer-to-Peer Applications
Controlling Peer-to-Peer Applications April, 2008 Palo Alto Networks 2130 Gold Street, Suite 200 Alviso, CA 95002-2130 Main 408.786.0001 Fax 408.786.0006 Sales 866.207.0077 www.paloaltonetworks.com Table
More informationNominee: Barracuda Networks
Nominee: Barracuda Networks Nomination title: Barracuda Next Generation Firewall The Barracuda NG (Next Generation) Firewall is much more than a traditional firewall. It is designed to protect network
More informationReducing Costs With Next- generation Network Security Investing in Innovation Pays Cost Savings Dividends
Reducing Costs With Next- generation Network Security Investing in Innovation Pays Cost Savings Dividends August 2013 Palo Alto Networks 3300 Olcott Street Santa Clara, CA 95054 www.paloaltonetworks.com
More information10 REQUIREMENTS FOR YOUR NEXT GENERATION MANAGED CLOUD FIREWALL WHITE PAPER
10 REQUIREMENTS FOR YOUR NEXT GENERATION MANAGED CLOUD FIREWALL WHITE PAPER 1 10 Requirements for Your Next Generation Managed Cloud Firewall Introduction The Internet is ubiquitous for businesses today;
More informationHow To Protect Your Virtual Infrastructure From Attack From A Cyber Threat
VMware Integrated Partner Solutions for Networking and Security VMware Integrated Partner Solutions for Security and Compliance VMware vcloud Networking and Security is the leading networking and security
More informationReadiness Assessments: Vital to Secure Mobility
White Paper Readiness Assessments: Vital to Secure Mobility What You Will Learn Mobile devices have been proven to increase employee productivity and job satisfaction, but can also pose significant threats
More informationRequirements for Your Next Generation Managed Cloud Firewall
10 Requirements for Your Next Generation Managed Cloud Firewall The Internet is ubiquitous for businesses today; it is required in order to communicate with customers, identify and nurture prospects, and
More informationWebsense Web Security Solutions. Websense Web Security Gateway Websense Web Security Websense Web Filter Websense Express Websense Hosted Web Security
Web Security Gateway Web Security Web Filter Express Hosted Web Security Web Security Solutions The Approach In the past, most Web content was static and predictable. But today s reality is that Web content
More information_Firewall. Palo Alto. How Logtrust works with Palo Alto Networks
_Firewall Palo Alto Networks is the next-generation firewalls that enhance your network security and enable any enterprises to look beyond IP addresses and packets. These innovative firewalls let you see
More informationWeb Security Update. A Radicati Group, Inc. Webconference. The Radicati Group, Inc. Copyright March 2010, Reproduction Prohibited
The Radicati Group, Inc. www.radicati.com Web Security Update A Radicati Group, Inc. Webconference The Radicati Group, Inc. Copyright March 2010, Reproduction Prohibited 9:30 am, PT March 25, 2010 Speakers
More informationSHARE THIS WHITEPAPER. Top Selection Criteria for an Anti-DDoS Solution Whitepaper
SHARE THIS WHITEPAPER Top Selection Criteria for an Anti-DDoS Solution Whitepaper Table of Contents Top Selection Criteria for an Anti-DDoS Solution...3 DDoS Attack Coverage...3 Mitigation Technology...4
More informationPalo Alto Networks Next-Generation Firewall Overview
Palo Alto Networks Next-Generation Firewall Overview The firewall is the most strategic network security infrastructure component, it sees all traffic, and as such, is in the most effective location to
More informationSymantec Enterprise Firewalls. From the Internet Thomas Jerry Scott
Symantec Enterprise Firewalls From the Internet Thomas Symantec Firewalls Symantec offers a whole line of firewalls The Symantec Enterprise Firewall, which emerged from the older RAPTOR product We are
More informationV1.4. Spambrella Email Continuity SaaS. August 2
V1.4 August 2 Spambrella Email Continuity SaaS Easy to implement, manage and use, Message Continuity is a scalable, reliable and secure service with no set-up fees. Built on a highly reliable and scalable
More informationThe Dirty Secret Behind the UTM: What Security Vendors Don t Want You to Know
The Dirty Secret Behind the UTM: What Security Vendors Don t Want You to Know I n t r o d u c t i o n Until the late 1990s, network security threats were predominantly written by programmers seeking notoriety,
More informationPANORAMA. Panorama provides centralized policy and device management over a network of Palo Alto Networks next-generation firewalls.
PANORAMA Panorama provides centralized policy and device management over a network of Palo Alto Networks next-generation firewalls. Web Interface HTTPS Panorama SSL View a graphical summary of the applications
More informationSANS Top 20 Critical Controls for Effective Cyber Defense
WHITEPAPER SANS Top 20 Critical Controls for Cyber Defense SANS Top 20 Critical Controls for Effective Cyber Defense JANUARY 2014 SANS Top 20 Critical Controls for Effective Cyber Defense Summary In a
More informationNext-Generation Datacenter Security Implementation Guidelines
Next-Generation Datacenter Security Implementation Guidelines March 2015 INTRODUCTION 3 DEPLOYMENT OVERVIEW 4 IMPLEMENTATION GUIDELINES 4 PA-7050 Boundary Firewalls to protect north-south traffic 5 Virtual
More informationLoad Balancing 101: Firewall Sandwiches
F5 White Paper Load Balancing 101: Firewall Sandwiches There are many advantages to deploying firewalls, in particular, behind Application Delivery Controllers. This white paper will show how you can implement
More information74% 96 Action Items. Compliance
Compliance Report PCI DSS 2.0 Generated by Check Point Compliance Blade, on July 02, 2013 11:12 AM 1 74% Compliance 96 Action Items Upcoming 0 items About PCI DSS 2.0 PCI-DSS is a legal obligation mandated
More informationWildFire Overview. WildFire Administrator s Guide 1. Copyright 2007-2015 Palo Alto Networks
WildFire Overview WildFire provides detection and prevention of zero-day malware using a combination of malware sandboxing and signature-based detection and blocking of malware. WildFire extends the capabilities
More informationThe Application Usage and Threat Report
The Application Usage and Threat Report An Analysis of Application Usage and Related Threats within the Enterprise 10th Edition February 2013 PAGE 1 Executive Summary Global Findings Since 2008, Palo Alto
More informationPAVING THE PATH TO THE ELIMINATION OF THE TRADITIONAL DMZ
PAVING THE PATH TO THE ELIMINATION A RSACCESS WHITE PAPER 1 The Traditional Role of DMZ 2 The Challenges of today s DMZ deployments 2.1 Ensuring the Security of Application and Data Located in the DMZ
More information