I'm still looking for a centrally-managed AV/malware management system and I've been testing out both Panda and Webroot (due to their 'cloud-based' structure that doesn't require a server for me to manage).

Just got some information from OpenDNS (which I love and have been using for years) about their "Umbrella" service. It appears to be AV and OpenDNS rolled into a single package for mobile users (we have a sales team always on the road).

Just wondering if anyone has insights as to how Umbrella actually works?

  • I ended up answering my own question, but I would certainly appreciate additional thoughts on this type of solution. – Brian Adkins Jan 15 '13 at 17:02
  • Minimum quantities are way too high on Umbrella. 100 license buy-in is a show stopper for me. I tried talking to the founder David Ulevitch but he stopped responding to my messages. Too bad as it looks like a nice product but it doesn't seem like they want the SMB market. – user32342 Oct 23 '13 at 10:08
  • Thanks for the question. Umbrella was on my list of things to learn about from information I gathered at presentations during NullCon last week. I'm also interested in the ShadowServer databases, crysys.hu (and other malware repos), and the malware prevalence service from virtusbtn.com – atdre Feb 19 '14 at 9:03

Great thread Brian and Ramhound. I work at OpenDNS and may be able to offer some clarity...

Our Umbrella products use a combination of DNS routing, VPN tunneling and selective proxying to secure any devices behind Internet gateways (e.g. router, WiFi AP) or the devices (e.g. desktops, laptops, tablets, phones) themselves. The backbone is built on OpenDNS's global network, but we've added traffic enforcement technologies beyond only DNS monitoring and filtering in 2012. In 2013, we're excited to continue this trend.

In regards to AV scanning, you're both correct that we do not presently use a signature database to match for known malicious executables. However, our approach of preventing connections to malicious sites is not limited to only those that are known to host threats. We're harnessing the insights from over 50B+ daily requests, plus our knowledge for how all sites are related to one another (learned from our global Anycast-routed network) to predict what other sites are also used for malicious purposes. Whether or not the threats on these additional sites are known yet to the AV community.

Having said this, we do not advise removing existing AV clients as it was pointed out that removable media, email attachments and other vectors can still be used to infect the device. Also, AV is still effective for blocking most known threats. But industry analysts like IDC believe its efficacy has fallen to 30-50% of all threats out there.

What Umbrella does really well for your security program is to not only add defense-in-depth, but also add defense-in-breadth. Since we restore visibility and control for your nomadic workers, and we apply our protection for any application, protocol or port. Web proxy-based solutions offered by Webroot and Panda are limited to HTTP (80), and maybe HTTPS (443). They also don't address mobile devices like iPhones very well, if at all, which use APIs that do not allow AV apps to effectively scan for threats.

Hope this helps, and please continue the thread if you have further questions or would like to discuss other Internet security matters.

  • Thanks, Barry... That does help my understanding of Umbrella. It's definitely an appealing service, especially for those of us already familiar with OpenDNS core services. – Brian Adkins Jan 16 '13 at 22:07
  • Update... I am now an umbrella customer. – Brian Adkins Jul 4 '14 at 15:48
  • How effective is Umbrella if your mobile worker hooks up to a network (public hotspot, coffee shop, etc.) that does not allow access to external DNS servers, or redirects DNS requests to their own DNS servers at their gateway? In that case, the client could not use the OpenDNS DNS servers, right? – Craig Nov 16 '14 at 19:04

I spent some time talking with an Umbrella rep and it appears to consist of generalized protection delivered in the form of DNS monitoring and filtering.

The DNS resolution protection should help prevent accessing website that are known to contain malware payloads (limited protection here)

If a client gets infected with Malware somehow (website, file attachments, flash-drive, etc.), the Umbrella solution works by identifying that malware's attempts to contact the mothership. Those attempts would ideally be blocked and the admin would be notified.

However, there seems to be no quarantine/removal functionality as part of Umbrella.

... Seems like a nice extension of the OpenDNS platform, but not ready to replace an actual AV client.

  • It sounds like Umbrella isn't an AV service nor advertised as one, it sounds like its a natural evolution of the filtering capabilities OpenDNS already does except for mobile devices. – Ramhound Jan 16 '13 at 17:32
  • I'd agree it is not AV, but they do seem to be positioning it as such with vague messages as "SECURITY EVERYWHERE Umbrella protects all your offices and users everywhere against malware, botnets ... Etc" – Brian Adkins Jan 16 '13 at 19:13
  • I asked a sales rep if they advocated removing my existing AV client and relying solely on umbrella... The answer was 'yes'. – Brian Adkins Jan 16 '13 at 19:21

Not the answer you're looking for? Browse other questions tagged or ask your own question.