Enterprise Buyer Guide

Transcription

1 Enterprise Buyer Guide Umbrella s Secure Cloud Gateway vs. Web Proxies or Firewall Filters Evaluating usability, performance and efficacy to ensure that IT teams and end users will be happy.

2 Lightweight vs. Heavyweight Traffic Routing For secure, fast, scalable and reliable Internet connections to content servers via any application, protocol or port, Umbrella Enterprise first enables secure, fast, scalable and reliable responses from name servers. Umbrella uses a unique Secure Cloud Gateway to route only lightweight traffic with selective proxying thru the infinitely scalable and always available OpenDNS Global Network. Protecting every on-net device requires no new hardware, client software, device changes or network topology changes. Simply enter two Anycast IP addresses used by the OpenDNS Global Network. ALL DEVICES INCLUDING BYOD NO DEVICE OR NETWORK CHANGES RELIABLE CONNECTIONS NO LATENCY NO BOTTLENECKS Existing solutions rely on Web proxies and firewall filters that require routing heavyweight traffic thru hardware with limited scalability and availability. NOT SECURE, NOT ALWAYS SOME DEVICES EXCLUDING BYOD PLUS DEVICE OR NETWORK CHANGES SOME SECURE, BUT SLOW, CONNECTIONS AT SCALE 1 or MORE ISPs PROXY FILTER IT teams re-gain visibility and control over unmanaged devices such as user-owned smartphones, tablets and laptops connected to networks as a result of BYOD (bring your own device) initiatives. IT teams also gain visibility and control over every distributed network where existing solutions had been cost prohibitive to deploy. Umbrella s Secure Cloud Gateway does not overlap with Web proxies or firewall filters, so both may be used in tandem to protect unmanaged devices and networks. And to prevent unwanted connections resulting in security, compliance, productivity or bandwidth risks. Restoring scalability to existing solutions. ALL DEVICES INCLUDING BYOD PLUS ANY EXISTING CHANGES SECURE, FEWER SLOW, CONNECTIONS AT SCALE PROXY FILTER SECURE CLOUD GATEWAY CLOUD-HOSTED Protect every on-net device w/o device or network changes Easy to manage w/o any software or hardware to maintain! #* " Secure every Internet connection any app, protocol or port Filter inappropriate sites and grant overrides to select users! Scale to 1000s of network locations cost-effectively FIREWALL FILTERS *NOTE: Many cloud-hosted web proxies require new on-premises devices to redirect traffic. Umbrella s Secure Cloud Gateway vs. Web Proxies or Firewall Filters Page 2

3 Security vendors often focus on threat efficacy, but gloss over its usability or performance. Vendors often assume administrators are investing their time in addition to their organization s money to use the solution, so they do not focus on how easy it is to: provision and setup enforce and report manage and maintain Also, vendors often offer cryptic or rather meaningless specifications regarding the product s performance, which do not always accurately reflect its: reliability and resiliency connection speed bandwidth throughput Finally, while vendors may claim they have superior threat intelligence and prevention, consider more completely its: on-net device coverage attack surface coverage accuracy and timeliness LOW TCO, HIGH ROI, HAPPY USERS It is not uncommon for Web proxies and firewall filters to take days to weeks before it is effectively enforcing devices and reporting activity. Add on training to learn how to manage all the complex bells and whistles, many which go unused, and on-going maintenance to address performance or efficacy issues, and the ownership cost increases. Umbrella can enforce every device on any network and report activity within an hour of asking for an evaluation trial. Our simple cloud-hosted management console and issue-free operation, means you set and forget it. Often Web proxies and firewall filters are deployed within the network using a less redundant topology than if they never existed, which can result in new points of failure. They add new hops for Internet connections and/or processes applied to Internet traffic, which can increase latency and decrease throughput; leading to less happy users. Umbrella simply replaces a mandatory, already in-use cloud service provided by ISPs. Faster, more reliable connections are a result of OpenDNS s Anycast and SmartCache technologies that reduce hops and processes. Web proxies, in particular, provide minimal on-net device coverage depending on the setup of managed devices or networks. Often only traffic sent by configured browsers is protected; not Web-based outbound botnet traffic from infected devices malicious software. The Web may be the most used protocol, but it is one amongst hundreds that threats utilize and proxies are blind to. Firewalls often only filter by destination for Web traffic; some using a built-in Web proxy. Firewalls filtering other application traffic often do not distinguish between good or bad destinations for this traffic. The Umbrella Security Cloud ensures that malware, phishing, inappropriate sites and botnets never touch your network, regardless of the attack surface (any application, protocol, port or non-managed device). The evaluation matrix on the following page provides more detail on how Umbrella s use of a Secure Cloud Gateway compares to other solutions use of Web proxies delivered in-the-cloud or on-premises or on-premises firewall filters. We believe that you will draw the same conclusions, that Umbrella delivers a more usable, high performance and effective solution than competitors traditional solutions. Umbrella s Secure Cloud Gateway vs. Web Proxies or Firewall Filters Page 3

4 COMPARE THE ADVANTAGES OR DISADVANTAGES BETWEEN DELIVERY PLATFORMS SECURE CLOUD GATEWAY vs CLOUD-HOSTED or or FIREWALL FILTERS Provision & Setup Lightweight DNS traffic redirection without network topology changes for 1 to 1000s of sites No appliances or client software No client setting changes Heavyweight TCP/IP traffic redirection per site Requires network topology change, client software or setting changes Receive and deploy appliance per site Heavyweight TCP/IP traffic redirection per site Requires network topology change, client software or changes Receive and deploy appliance per site Significant configuration to control network traffic flow is likely required to migrate from current firewall Enforce & Report Network-level granularity via public IP Grant override permissions to users Full data retention for 2 years with no hidden fees User-level granularity via directory integration requires complex setup or network-level granularity Data retention often limited or else extra fees User-level granularity via directory integration requires complex setup Data retention limited by internal storage available Network-level granularity via internal IP User-level granularity requires complex setup Data retention limited by internal storage available CHOOSE AN EVALUATION CRITERIA Manage & Maintain Reliability & Resiliency Connection Speed Bandwidth Throughput On-Net Device Coverage Simple set and forget No OS patches or appliance upgrades No security rule tuning No site exceptions to address SSL decryption or authentication issues No outages since launch in 2006 Uses Anycast IPs No new latency Often reduced response time via SmartCache Spikes in traffic will not cause slower speeds Infinite scalability via lightweight queries & responses Any on-net device; managed or not any application, any protocol and any port Often security rules are complex, and require fine-tuning to reduce false positives/negatives SSL or auth. issues require frequent site exceptions Many have had outages despite SLA Lack Anycast IPs Adds new latency due to one or more intermediate hops Likely unlimited, but heavyweight traffic redirection can be limited Depending on setup, only managed devices and configured browser applications only HTTP/S and ports 80/443 OS patch conflicts or upgrade downtime Often security rules are complex and require finetuning SSL or auth. issues require site exceptions Often reduced network redundancy in topology or else expensive Adds new latency due to another intermediate hop Spikes in traffic will cause noticeably slower speeds Limited by resources available on appliance or server; often a bottleneck Depending on setup, only managed devices and configured browser applications only HTTP/S and ports 80/443 Complex and focused on network management, not policy or security, so it is often confusing If SSL or auth. is included, then issues will require site exceptions Sometimes reduced network redundancy in topology May add new latency depending on internal processes and the number of add-on features enabled Limited by resources available on appliance or server Any on-net device; managed or not Filters by destination over HTTP/S, 80/443 May include protocol or application filters, but not by destination Attack Surface Coverage Industry-leading outbound botnet protection Inbound malware and phishing protection Web filtering categories for regulatory & acceptable use policy compliance Ineffective outbound protection due to inadequate network coverage Inbound protection use proprietary and/or 3 rd - party systems Ineffective outbound protection due to inadequate network coverage Inbound protection use proprietary and/or 3 rd - party systems Outbound protection usually not a focus Inbound protection is usually via 3 rd -parties so efficacy is not controlled Accuracy & Timeliness Proactive protection is updated 24x7 via engineers and partners Very few false positives Often need to fine-tune security rules to prevent inaccuracies Often need to fine-tune security rules to prevent inaccuracies Not usually a core focus of business or products, so accurate or timely protection may suffer Umbrella s Secure Cloud Gateway vs. Web Proxies or Firewall Filters Page 4

5 Umbrella is brought to you by OpenDNS. Trusted by millions around the world. The easiest way to prevent malware and phishing attacks, contain botnets, and make your Internet faster and more reliable. OpenDNS, Inc Copyright 2012 OpenDNS, Inc. All rights reserved worldwide. No part of this document may be reproduced by any means nor translated to any electronic medium without the written consent of OpenDNS, Inc. Information contained in this document is believed to be accurate and reliable, however, OpenDNS, Inc. assumes no responsibility for its use. BG-Umbrella-Enterprise-Secure-Channel-vs-Proxy-Filter