Anyone out there using Umbrella from OpenDNS? What exactly is it?

Question

I'm still looking for a centrally-managed AV/malware management system and I've been testing out both Panda and Webroot (due to their 'cloud-based' structure that doesn't require a server for me to manage).

Just got some information from OpenDNS (which I love and have been using for years) about their "Umbrella" service. It appears to be AV and OpenDNS rolled into a single package for mobile users (we have a sales team always on the road).

Just wondering if anyone has insights as to how Umbrella actually works?

Answer 1

Great thread Brian and Ramhound. I work at OpenDNS and may be able to offer some clarity...

Our Umbrella products use a combination of DNS routing, VPN tunneling and selective proxying to secure any devices behind Internet gateways (e.g. router, WiFi AP) or the devices (e.g. desktops, laptops, tablets, phones) themselves. The backbone is built on OpenDNS's global network, but we've added traffic enforcement technologies beyond only DNS monitoring and filtering in 2012. In 2013, we're excited to continue this trend.

In regards to AV scanning, you're both correct that we do not presently use a signature database to match for known malicious executables. However, our approach of preventing connections to malicious sites is not limited to only those that are known to host threats. We're harnessing the insights from over 50B+ daily requests, plus our knowledge for how all sites are related to one another (learned from our global Anycast-routed network) to predict what other sites are also used for malicious purposes. Whether or not the threats on these additional sites are known yet to the AV community.

Having said this, we do not advise removing existing AV clients as it was pointed out that removable media, email attachments and other vectors can still be used to infect the device. Also, AV is still effective for blocking most known threats. But industry analysts like IDC believe its efficacy has fallen to 30-50% of all threats out there.

What Umbrella does really well for your security program is to not only add defense-in-depth, but also add defense-in-breadth. Since we restore visibility and control for your nomadic workers, and we apply our protection for any application, protocol or port. Web proxy-based solutions offered by Webroot and Panda are limited to HTTP (80), and maybe HTTPS (443). They also don't address mobile devices like iPhones very well, if at all, which use APIs that do not allow AV apps to effectively scan for threats.

Hope this helps, and please continue the thread if you have further questions or would like to discuss other Internet security matters.

Answer 2

I spent some time talking with an Umbrella rep and it appears to consist of generalized protection delivered in the form of DNS monitoring and filtering.

The DNS resolution protection should help prevent accessing website that are known to contain malware payloads (limited protection here)

If a client gets infected with Malware somehow (website, file attachments, flash-drive, etc.), the Umbrella solution works by identifying that malware's attempts to contact the mothership. Those attempts would ideally be blocked and the admin would be notified.

However, there seems to be no quarantine/removal functionality as part of Umbrella.

... Seems like a nice extension of the OpenDNS platform, but not ready to replace an actual AV client.