6

I am currently looking at boosting the network security in my organization. (Currently we just use really basic small business network firewalls we primarily bought for IPSec VPNs).

However, from what I have observed in recent months, there has been an increasingly worrying trend of attacks which the network firewalls might not be able to address and I am starting to look at UTMs as the next security solution for my organization.

While I understand UTMs are essentially all in one security devices, I have a few concerns on

1.) Effectiveness:
How effective they are in terms of mitigation of security threats like:

  • virus mitigation (a lot of them claim they do this effectively, but I am skeptical)
  • email spam (not sure how this is done since the mail server isn't run by us)
  • content filtering / management
  • network intrusions (IPS)

2.) VPN performance :
Currently I am using Cisco ASA type firewalls to run my VPN tunnels, would there be a hit in terms of VPN performance if I replace them with UTMs? (given that they are multi-functional devices)

Just a bit of back ground of my organization setup:

I have about 4-5 outlets, 2 offices and 2 data center sites.

I am thinking of having low-end/tier UTMs installed in the outlets (since they serve a limited no. of users), something mid-range for office and data center sites.

Management is very concerned on the running costs of such an implementation in terms of operating costs (licensing and etc), but I think given the trend of attacks I am seeing, it's time for us to seriously look at Network UTMs.

I have Googled a lot on the effectiveness of UTMs, but I can't seem to find neutral write-ups, so I am keen to hear from people in the community.

Also I would like to hear about some Network UTMs you would personally recommend given my situation. Ideally something with low licensing costs and relatively easy to set up and manage (centralized).

8

This is not a forum for product recommendation. But to give you some things to look out for:

  • Phrases and Buzzwords: UTM, NGFW, IPS, IDS, Firewall, Secure gateway... are just words and say nothing about the technology used and of their limitations. And there are lots of limitations: sometimes because of the underlying technology and sometimes to make it faster and cheaper.
  • Marketing: Everybody claims to be the most secure, the fastest and the cheapest. Often not the best product wins but the one with the best marketing or the lowest price, because normal users can't tell the difference anyway: it's a lemon market.

And what product is best depends on what level of security you need. If you are not dealing with sensitive data it might be enough to protect against ransomware and against malware which integrates your company into a botnet. As soon as you deal with customer data, do interesting research, maybe have connections to government organizations you get more interesting for an attacker because it might be worth to steal data from you or to use you as a trampoline for attacking some more important organization.

Protection against low level DOS is different from protecting users surfing the web. For the first a fast packet filter is needed and for the second you need application level filtering. And it is not only important if the device can do web (or even web 2.0 like lots claim) but how deep they look into the traffic. Simply blacklisting URL's is much easier than actually analyzing the payload but also provides less security. The deeper a device looks into the traffic the more protection it can offer but the slower it will get and the more it will cost. There is no magic sprinkling around this simple fact, even if it is called "next generation firewall" or "unified threat management", "cloud security"...

No NGFW, UTM, whatever will fully protect the network. Thus you need to use isolation between different parts of the network to limit the impact of malware. Do not simply let mobile devices into the critical production network, because you don't know how infected they are. Simply think how you would behave if you know that somebody visiting you might have an infectious disease.

The more you know about your network the better you can protect it, because you can restrict it to what it should do in your opinion and detect any violations. Security is not simply installing some device and forget it, but monitor what's going on in your network, adjust the rules so that they are as tight as possible etc. And you probably must hire somebody to do this for you or outsource the management of the firewall. The best firewall will not help if the person maintaining it has no real understanding of the problems.

Maybe you better don't buy directly from a vendor but go to an independent security company which sells competing products and often also can do the management for you. They will know more about the abilities and limitations of each of the products than a single vendor is willing to tell you. But of course some will simply try to sell you the product where they make the most profit instead the one best suited to your environment.

Sounds hard and expensive? It is. You only know that it might have been smarter to invest in better security (products and also training) if your data are lost, your identity is compromised and the customers look somewhere else in the hope that somebody can keep their data more secure.

I have Googled a lot on the effectiveness of UTMs, but I can't seem to find neutral write-ups, ...

There is no general effectiveness of UTM, because UTM differ a lot both in features and quality. Today you will not find much products which don't claim to be either a UTM or NGFW (or even both) even though they don't differ that much from the previous firewall, IPS or secure gateway products of the same company. Technologically you will often find at the lower end simple packet filters (like Linux iptables) with maybe some IDS (like Snort) and maybe some proxies (like Squid) with added Antivirus and blacklists but there are also more advanced solutions. They differ a lot between the quality of AV which range from open source ClamAV to commercial products of different quality. Same is true for the quality of blacklists, IDS signatures and how fast the vendor responds to new threats.

Bypassing the components of an UTM is often trivial because in edge cases of the protocols the data are interpreted differently in the UTM and the clients (browser etc) - this is a general problem of perimeter firewalls. Sometimes such bypasses can be done at the packet layer already (see Stonesoft Evader 2013), sometimes at the application layer (see my research 2015) or also at the layer of antivirus analysis as in this research from 2012.

Thus you should not expect too much security from these devices and better implement defense in depth, i.e. use additionally host based antivirus and isolation between networks with different security levels. But in any case most of them will probably be an improvement to what you have now.

  • thanks for the very detailed input. Very enlightening! Thanks! the links really helped too. – jaglin84 Dec 11 '15 at 3:33
2

As a general rule of thumb, UTM firewalls / security gateways and other products of that type are as good as the sum of their parts multiplied by an integration coefficient that may be different for every person using them.

Understand your requirements, both now and in the future. This includes the security functionality you require as well as user numbers and throughput rates, and then take a look at the products that satisfy all your requirements.

Consider how those products would work in your specific environment, complementing, adding to, and supplementing (or not, as the case may be) the controls already present or planned for implementation in your existing system and network environment.

Look at industry certifications and recommendations from peers. If a product is EAL4+ rated against the Common Criteria (ISO 15408), that is an indication that it has passed some testing, and pretty much does what it claims to do in the technical reference manual (not the marketing brochure!). Whether than translates into real-life security or not is not answered by certification or recommendations, but in certain environments you may need to favour certified products over non-certified ones for liability or regulatory reasons.

Having used UTMs in the past, I have seen how the right one for a particular environment can bring a lot of capability together in a cheaper, more manageable package than would have been possible if one were building the capability with a collection of different products.

I have also seen how over-reliance on UTM anti-virus or IPS capabilities can cause mayhem and woe.

Yes, they CAN work, and they CAN be very effective, and they CAN be very worthwhile. No, unfortunately they aren't always. Be careful and thorough in your research and recommendations.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.