Firewall or UTM? - CIOL Feature

Firewall or UTM?

Today, UTMs are a serious contender for providing firewall protection and a whole lot more for enterprises and larger companies.

Ian Kilpatrick

Friday, October 17, 2008

BANGALORE, INDIA: UTMs used to be the domain of smaller companies. But today, UTMs are a serious contender for providing firewall protection and a whole lot more for enterprises and larger companies.

Unified threat management systems (UTMs) have been growing in popularity for the last few years. Traditionally, they have been widely adopted by SMEs, but larger companies and enterprises are now also deploying UTMs, appreciating the benefits they can offer.

UTMs are designed to provide a range of security solutions in a single appliance, reducing costs and simplifying the whole process of security systems management, reporting and installation.

The minimum requirement for a UTM, according to IDC, is a firewall, VPN, antivirus and intrusion detection/prevention. Super UTMs (sometimes called extended UTMs or XTMs) have, however, evolved from this to incorporate additional capabilities which can include URL filtering, spam blocking and spyware protection, as well as centralised management, monitoring, and logging capabilities.

There are many reasons for the growth in popularity of UTMs. Cost is a key issue, with common thought being that a UTM device can cost less than a quarter of the price of equivalent, individual point solutions. Simplified centralised management is a further reason for adopting UTMs. Having multiple security solutions in one appliance makes managing security overall much simpler, as well as enabling easier event consolidation.

Larger companies and enterprises are now also adopting UTMs because they have begun to appreciate the benefits of less expenditure and easier centralised administration. Large companies are typically using UTMs to centrally secure branch and remote offices; or alongside their existing gateway firewall for the additional UTM functionality. Additionally, many companies are using UTMs as their main gateway security appliance for all functions.

The author is chairman of IT security specialist Wick Hill Group

Choosing a UTM

For any company looking at UTMs, it is essential to define requirements and thoroughly research the market, but going for an established name with a proven record in firewall security is a good way of establishing a shortlist. Bear in mind that there is no legal definition of a UTM and that there are significant variations between UTM appliances. The variations are on price, functionality, performance, scalability and most importantly security.

Not all suppliers provide solutions that are suitable for larger companies. Performance is a key element. Many UTMs aren’t designed for all the functions to work together, so performance can rapidly decline when all functions are switched on.

You may want considerable room for growth or an appliance that is licence upgradeable for both performance and function. You’ll also need a firewall that has deep packet inspection as a minimum, not just stateful inspection.

The future of UTMs

Recently, UTM market leader WatchGuard spoke about its plans for the future of UTMs and how they will adapt to current and future needs for network security. These plans indicate that UTMs will be well placed in the future to fulfil the needs of enterprises and larger companies.

WatchGuard’s plan is for UTMs to provide ‘Extensibility’, which means the ability to add onto or extend. UTM appliances will be able to proactively adapt to dynamic network environments, as well as protect against unknown, future threats. As businesses grow, so too will their security platform.

‘Extensibility’ recognises that each network is unique with individualised needs and concerns. The new UTM appliances would interoperate in and support mixed network infrastructures, and have the inherent security technology to be flexible. Administrators will be able to pick and choose the security service they want from the device.

For example, some users may want anti-virus (AV) protection provided at a different source other than the gateway. Here, an administrator could turn “off” the AV protection at the new style UTM appliance, while maintaining full firewall, IPS/IPS as well as web content filtering at the network gateway. The choice of security services would be up to the customer.

Check Point also recently showed the future direction of UTMs with the launch of its Power-1 appliances, designed specifically for larger enterprises and delivering up to 14 Gbps throughput.

Conclusion

Enterprises and larger companies can now seriously consider UTMs, as an alternative to firewalls and other point solutions. Costs savings, easier management and green credentials are just a few of the issues which make them attractive.

Powerful UTM appliances with high performance aimed at very large networks are now available. Future development like ‘Extensibility’ will provide adaptability and future proofing which will help all companies protect in an ever changing security environment.

Larger organisations using point solutions are often unable to scale the solutions to the number of sites they have, because of cost, installation, management, reporting and ongoing support issues. This can lead to organisations deploying reduced security and inferior policies at remote locations. UTMs can help overcome these problems.

Where companies use a powerful UTM as their main firewall and also deploy the same brand UTMs at branch offices, they have the big advantage of being able to manage and report on all their branch office security from one central location. This can give much greater control over branch and remote office security, simplify and improve overall company security, reduce support costs in areas such as patch updating, and reduce data centre costs.

UTM models are now available which are aimed specifically at larger sites, with the high performance and multi-gigabit throughput to deal with thousands of users. Such systems might integrate stateful packet firewalls with VPNs, zero day attack prevention, anti-spyware, gateway anti-virus, intrusion prevention, anti-spam, and URL filtering.

The recent importance of green issues is another reason UTMs are becoming more attractive to larger companies. UTMs integrate several security functions into one single appliance and this fact alone could qualify them to be ‘green’.

One single UTM appliance can replace up to five or six separate security appliances or servers. This saves space data centre space in the office and significantly reduces power consumption, both in the rack and in the air conditioning necessary to cool multiple products. Given the increased pressure on data centres in relation to power issues, this is can be a key benefit.

A UTM could also be considered ‘green’ if it can easily upgrade to add more functionality and performance. This would allow a UTM to grow and change with a company’s needs, rather than having to be wastefully ditched when it fails to cope with increased demands.

A stated disadvantage of UTMs over point solutions is that they have a single point of failure with all security systems potentially down at the same time and this would obviously be a serious problem for large enterprises. . However, one additional appliance can provide failover protection for perhaps five key security functions.

©CIOL Bureau