Next-Generation Firewalls: CEO, Miercom

Transcription

1 Next-Generation Firewalls: Results from the Lab Robert Smithers Robert Smithers CEO, Miercom

2 Agenda Participating i Vendors and Products How We Did It Categories of Products Tested About the Technology Secure Web Gateway Next-Generation Firewall Unified Threat Management Sandbox Spam Filtering

3 Agenda Three High Risk Event Results CryptoLocker Outbound Botnet Worm and Trojans Industry Average Comparisons Layer 3 Firewall Throughput Malicious Files Legacy Malicious URLs: Blended Malicious Threats Malicious Files Wild

4 Agenda Industry Average Comparisons Malicious URLs Wild: Malc0de Layer 7 Firewall Throughput Max Layer 7 Firewall Throughput Mixed Application Control

5 Participating Vendors and Products Blue Coat ProxySG Check Point 4210 NGFW Check Point SWG Cisco ASA 5545-X with CX Module Cisco ISA550W Cyberoam CR100iNG Dell SonicWALL NSA 2600

6 Participating Vendors and Products Dell SonicWALL TZ 105 (Cloud) Dell SonicWALL TZ 105 (Appliance) FireEye Malware Protection System 1310 Fortinet FortiGate 20-C Fortinet FortiGate 100-D Fortinet FortiGate 800-C Juniper SRX650 Services Gateway

7 Participating Vendors and Products Palo Alto PA-3020 Sophos SG 210 Sophos SG 230 Sophos UTM 220 WatchGuard XTM 525 Websense Web Security Gateway

8 How We Did It Test equipment included: Ixia XG12 and BreakingPoint FireStorm Spirent Studio Security Apposite Linktropy 7500 PRO WildPackets OmniPeek for Windows Windows 7 and Windows XP Clients/Endpoints Monitoring Tools

9 Categories of Products Tested Secure Web Gateway Next-Generation Firewall Unified Threat Management Sandbox Spam Filtering

10 Secure Web Gateway (SWG) Edge security platform against Web-borne threats that can invade enterprise network via Internet browsing; enforces organization s policies for Internet usage and regulatory compliance Essential functionality: URL filtering, malicious code detection/filtering and application control Products with real-time, cloud-based content analysis tend to outperform those that look up URLs and/or threat signatures in static database

11 Secure Web Gateway (SWG) Class of product for organizations of all sizes: SMB and Enterprise Essential functionality: URL filtering, malicious code detection/filtering ti i and application control SMB: protects against basic threats, easy to implement/manage Enterprise: protection extended to advanced and targeted threats, requires more skill and resources to implement/manage O i li t l ith ft On-premises appliance most popular with software, virtual, cloud (SWG as a Service) and on-premises / cloud hybrid versions also available

12 Next-Generation Firewall (NGFW) Evolutionary type of network edge security device Possesses combination of functionality of basic firewall and enhancements Traffic inspection enables detection and blocking of malicious activity Application awareness enables identification of attacks directed at network as well as enforcement of organization s Internet usage and regulatory compliance policies

13 Next-Generation Firewall (NGFW) Available for organizations of all sizes Can be deployed as appliance, virtual appliance or software-based solution Inline bump in the wire deployment: enabling functionality does result in reduced network performance Next-generation firewall arguably has caused basic firewall to go the way of video cassette recorders and VHS tapes, into obsolescence

14 Unified Threat Management (UTM) Just as Next-Generation Firewall, an evolutionary class of network edge security platform Combination of firewall and VPN of basic firewall plus Intrusion Prevention System also found in Next- Generation Firewall, URL filtering and antivirus also found in Secure Web Gateway, and anti-spam and mail antivirus also found in Spam Filtering products Primarily aimed at small and mid-sized businesses

15 Unified Threat Management (UTM) Available as appliance, virtual appliance, software and cloud-based Network administrator must find balance between security and network performance e Individual packets examined by each security function enabled, adding to latency/detracting from throughput

16 Sandbox Security technique for protecting enterprise network from malware by running applications and visiting Websites in a controlled environment FireEye leads market with competitors including AhnLab, Blue Coat, Check Point, Damballa, McAfee, Palo Alto Networks and Sourcefire (acquired by Cisco in October 2013) Sandbox appliance or cloud-based service is part of a multi-layeredlayered security system

17 Sandbox Botnets, zero-day attacks and corporate espionage among factors that fueled advent of sandbox; virtualization has facilitated utilization of sandbox Small percentage of malware has written-in capability to try to defeat sandbox Check environment to determine if it is in a sandbox Seek to be allowed to pass by attempting to time out the sandbox, stalling by performing meaningless calculations

18 Spam Filtering Class of network security device that safeguard against unwanted inbound and outbound spam Inbound: protect networked computers against dangerous forms of spam such as phishing attempts and s those containing viruses Outbound: protect against networked computers from being compromised and used as a zombie in a botnet to generate spam

19 Spam Filtering Spam is no small problem: estimated 50-60% of enterprise Key functionality: protect against inbound, targeted phishing attacks Functionality growing in importance: ability to re-evaluate evaluate URL link(s) in at the time of end user click Available as appliance, software, managed service Based on Gartner 2013 Magic Quadrant: Product leaders are Cisco, Proofpoint, Symantec, Microsoft and McAfee

20 Three High Risk Event Results Specific High Risk Events CryptoLocker Outbound Botnet Worm/Trojan

21 Ransomware trojan CryptoLocker Encrypts specific types of files using RSA public-key cryptography Message displays an offer to decrypt the g p y yp data if payment is made

22 Outbound Botnet Botnet t is a network of compromised computers under control of a third party whose purpose is to invade the network Remains inactive until they get orders from their command and control hosts Designed to steal the most valuable information on a network Outbound botnet t defense protects t corporate data from leaving the network

23 Worms Computer worms are a type of malware that t replicates functional copies of themselves to cause damage to data or software Host program or human help is not needed for them to propagate Worm enters a computer through a system vulnerability and uses a file- or information-transport feature to allow it to travel independently

24 Trojans A Trojan is another type of malware that t appears as legitimate software Users are tricked into loading and executing it Trojans can achieve a variety of attacks on the host from distractions (pop-up p p windows) to major damage (deleting files, activating and spreading other malware) on the host Can also create back doors to give malevolent users access to the system

25 Industry Average Comparisons Layer 3 Firewall Throughput Malicious Files Legacy Malicious URLs: Blended Malicious Threats Malicious Files Wild Malicious Files Wild: Malc0de Layer 7 Firewall Throughput Max Layer 7 Firewall Throughput Mixed Application Control

26 Industry Average Comparisons HTTP Proxy Throughput Firewall + IPS Throughput Application Control / URL Filtering

27 Industry Average Comparisons 3000 Layer 3 Firewall Throughput Throughput ( Mbps) Industry Average 2,057.3 Mbps Lay yer 3 Firewall CR100iNG SonicWALL FortiGate UTM 220 XTM 525 NSA D Source: Miercom, UTM and NGFW Industry Assessment 2014

28 Industry Average Comparisons Malicious Files Legacy Malicious Files Blocked (%) Industry Average 39.3 Mbps SWG Malware Protection Web Security System 1310 Gateway Source: Miercom, UTM and NGFW Industry Assessment 2014

29 Industry Average Comparisons Malicious URLs: Blended Malicious Threats Malicious URLs Block ked (%) Industry Average 25.1 Mbps NGFW ASA 5545-X with CX Module Malware Protection System 1310 FortiGate 800-C SRX650 Services Gateway PA-3020 Web Security Gateway Source: Miercom, UTM and NGFW Industry Assessment 2014

30 Industry Average Comparisons Ma alicious Files Blocked (%) Malicious Files Wild Industry Average 73.5 Mbps Source: Miercom, UTM and NGFW Industry Assessment 2014

31 Industry Average Comparisons Malicious URLs Wild: Malc0de Malicious URLs Blocke ed (%) Industry Average 41.6 Mbps NGFW ASA 5545-X with CX Module Malware Protection System 1310 FortiGate 800-C SRX650 Services Gateway PA-3020 Web Security Gateway Source: Miercom, UTM and NGFW Industry Assessment 2014

32 Industry Average Comparisons 3500 Layer 7 Firewall Throughput Max La ayer 7 Firewall l Throughput (Mbps) Industry Average 2,158 Mbps FortiGate UTM 220 SG 210 SG 230 CR100iNG SonicWALL XTM525 NSA D Source: Miercom, UTM and NGFW Industry Assessment 2014

33 Industry Average Comparisons 3500 Layer 7 Firewall Throughput Mixed l Throughput (Mbps) La ayer 7 Firewal Industry Average ,987 Mbps CR100iNG SonicWALL FortiGate UTM 220 SG 210 SG 230 XTM 525 NSA D Source: Miercom, UTM and NGFW Industry Assessment 2014

34 Industry Average Comparisons Application Control 3500 App plication Cont trol Throughp put (Mbps) Industry Average 1,345 Mbps CR100iNG SonicWALL NSA 2600 FortiGate 100-D UTM 220 SG 210 SG 230 XTM 525 Source: Miercom, UTM and NGFW Industry Assessment 2014

35 hput (Mbps) Firewa all and AV (Pr roxy) Throug Industry Average Comparisons HTTP Proxy Throughput Industry Average 380 Mbps N/A N/A CR100iNG SonicWALL NSA 2600 FortiGate 100-D UTM 220 SG 210 SG 230 XTM 525 Source: Miercom, UTM and NGFW Industry Assessment 2014

36 Industry Average Comparisons 700 Firewall + IPS Throughput Fi irewall and IP PS Throughpu ut (Mbps) Industry Average 330 Mbps FortiGate UTM 220 SG 210 SG 230 XTM 525 CR100iNG SonicWALL 100-D NSA 2600 Source: Miercom, UTM and NGFW Industry Assessment 2014

37 Industry Average Comparisons Application Control / URL Filtering % Pro otocol/app Co ombinations Blocked Industry Average % 65.9 ProxySG SWG Web Security Gateway Source: Miercom, UTM and NGFW Industry Assessment 2014

38 For more information, contact Request our detailed report on UTM and NGFW appliances.