How to choose the right UTM for your Network

How to choose the right UTM for your Network

There are dozens of anti-malware solutions available, each targeting one form of malware or the other. But managing so many of them together can be a pain. Unified Threat Management devices combine the features of various anti-malware products in one single device. Here, we tell you how to choose the right one

Anindya Roy, Rakesh Sharma & Vijay Chauhan

Tuesday, February 08, 2011

Given the growing number of threats to network security, UTMs have become an important part of every organization’s security strategy. UTM is a single device which can block viruses, spyware and spam.

So instead of having individual solutions (software or hardware) for anti-virus, anti-spam, intrusion detection and prevention, etc, you will have a single device that does it all--a UTM. Not only that, but UTMs these days also have many other useful features also added in, like VPN, detailed reporting, bandwidth allocation and much more.
One major shift we have seen in UTMs is in their reporting abilities. Traditionally policies deployed and reporting in a UTM were IP based, irrespective of the identity of the user. Such a technique has some severe drawbacks.
Let’s say that a user with an IP address 10.10.10.10 was doing an intense broadcast on the network for a day but due to some reason his IP got changed every hour. In such a situation, a standard UTM would fail to identify at first go that the broadcast was done by a single machine; rather it would show it as total bandwidth divided by 24 different IPs. In such a case you would not be able to immediately check and find out that only one user is responsible for the broadcast.
You have UTM devices that provide identity based threat management, which makes things simpler. This means irrespective of how many IPs a machine/user changes, the UTM will treat is as a single instance. Now even IT managers can deploy policies directly on the user, irrespective of the location, machine and IP of the user within the organization. Now enterprise class UTMs are available with four quad-core processors, boosting the performance and concurrent connections (these devices can take upto 10,00,000 concurrent connections).
Also the connectivity speed of ports has increased. Today a majority of devices have Gbps ports. Now let’s talk abouty some key buying tips you need to be aware of before you buy a UTM.

Before you buy

The first thing to check is the number of functions supported by a UTM (anti-virus, anti-spam, etc). Vendors can offer a lot of granularity in their UTMs, wherein you can buy and pay for only the functions you really need.
The second thing to check is the number of features each function has. For instance, can the anti-virus scan within zipped files? How many levels of filtering are supported by the anti-spam function, etc. Best is to compare the features of a particular function with equivalent standalone products.
Third thing to check is how well and how granularly can you manage policies using the UTM’s management console? This alone can make your setup more nimble.
So you will not find it cumbersome if you suddenly need to add one more DMZ in your network with a special type of port pinholing in it. A?good UTM will let you do that quickly.
In case you plan to deploy multiple UTMs aross branch offices, then many UTM vendors are coming up with centrally manageable systems with which one can monitor and manage all UTMs from one single interface from anywhere. Imagine how difficult it would be without this feature??Each site would have to be managed separately.

Failsafe Support

Another thing you should watch for is the failsafe option in UTMs. Consider a scenario where GBs of data are transmitted in an hour. And every single packet is scanned to safeguard your enterprise network. But if your single ‘line of defence’ device crashes due to some reason (maybe due to a sheer overflow of data passing through it), then your whole network could becomes vulnerable. Does that mean you need to stop all work, and bring everything to a standstill? The tendency might be to do that to avoid the risk of exposing your network to the outside world. This is where faisafe support is good to have in your UTM. Check what kind of fail safe support does your UTM have. Usually, there would be a backup UTM that would automatically take over without any network downtime.
Monitoring and Reporting

A UTM without monitoring and reporting is of no use today. It’s better to avoid any UTM that doesn’t have these two functions. Even when looking for UTMs that do have monitoring and reporting, you need to make sure that the reports are easy to understand. So, before buying a UTM, ask the vendor to show you a couple of sample reports. Make sure you’re able to interpret them. We’ve seen many UTM?devices, in which the reports are so complicated that it would require a doctorate in security to decipher them.
Right Features
Another thing to keep in mind is the kinds of features supported by a UTM. It shouldn’t happen that you buy a UTM with features that you already have on your network. For instance, if you already hav a VPN?deployed in your organization, then buying a UTM that also has VPN functionality is of no use. That function would become redundant, and you would unnecessarily spend extra for it. So it’s better to purchase a UBM?with just the functions you need, and don’t already have their equivalent standalone devices deployed.
Cache proxy
Nowadays, UTMs also provide caching capability, which can help you save your Internet bandwidth. This is only possible in UTMs that have hard drives inside. The hard drive is able to cache frequently accesssed data, so that the UTM doesn’t waste precious bandwidth to access it from the Internet everytime there’s a request.
So check whether the UTM you’re buying has this built-in. Some UTMs provide this as an optional upgrade. This could be useful if you don’t need the function currently, or don’t have the budgets for it, and would like to consider it later.

©PCQuest