May 27, 2009

Malware-fighting firewalls miss the mark

InfoWorld Test Center attacks Astaro, SonicWall, WatchGuard, and ZyXel firewalls, and only one puts up a fight

In the beginning was the firewall, and it was pretty good. A big box of rules that sat between your network and the evils of the Internet, the firewall examined ports and protocols to decide which packets got in and which were barred at the door. Then things got, as things often do, complicated. New threats came sneaking in on trusted protocols, ports and protocols became tangled, and looking inside packets became just as important as noting their source, destination, and type.

Protecting a network now meant deploying multiple firewall types (network, endpoint, application), anti-virus protection, content filters, intrusion detection systems, and more. Instead of a big box of rules, you needed a relay rack stuffed top to bottom with appliances -- each with its own administrative interface, and each representing a possible point of failure in the network. There had to be a better way, especially for smaller companies that couldn't afford a massive staff to feed and care for the relay racks full of appliances -- and thus, the unified threat manager (UTM) was born.

InfoWorld has many resources we believe will be of value to you. We encourage you to explore the InfoWorld.com site, but wanted to bring the following editorial resources to your attention:

[ Read the InfoWorld UTM reviews: Astaro Security Gateway 425 | SonicWall NSA E7500 | WatchGuard Firebox Peak X5500e | ZyXel ZyWall USG1000. Compare the UTMs feature by feature. ]

Indeed, a rapidly growing number of small and mid-size companies are opting for the administrative and operational simplicity of the single-box solution. And so we decided that UTMs aimed at the mid-size company were the perfect group to use for the rollout of InfoWorld's new firewall and UTM test protocols. When we began this process well over a year ago, we asked for input from virtually every firewall and UTM vendor we knew, and we invited every UTM vendor we could find to send us an appliance to test. In the end, four vendors answered the call. Astaro, SonicWall, WatchGuard, and ZyXel submitted units for this first set of tests.

Although all four fulfill the basic definition of a UTM -- combining firewall, VPN, intrusion detection and prevention, anti-malware, anti-spam, and Web content filtering -- we could not have asked for four more diverse units. There are differences in basic approaches to security (by default, allow most normal traffic or allow absolutely nothing), differences in administration capabilities, big differences in throughput, and most important of all, immense differences in effectiveness against malware.

UTMs unmasked
Among the four devices we tested, only one -- the SonicWall NSA E7500 -- provided a significant level of protection against malware, blocking 96 percent of the attacks we threw at it. The Astaro Security Gateway 425 and WatchGuard Firebox Peak X5500 fell far short, blocking a mere 26 percent and 33 percent of the attacks, respectively. The ZyXel ZyWall USG1000 took the middle ground, blocking a more respectable 69 percent of the attacks. (See chart below.)

Close

On Twitter now

Firewalls

Powered by Twitter

On Twitter now

White Paper

D2D Virtual Tape Library Replication Primer

This whitepaper explains the terminology and concepts behind Data Replication technologies and establishes some sizing rules through worked examples. Learn the new paradigm in disaster tolerance—protect data anywhere.

Download now »

White Paper

An Alternative to Virtualization for Datacenter Cost Savings

Server virtualization is a popular option for dealing with mounting datacenter costs. Another equally promising approach is the use of an Application Delivery Controller. Citrix NetScaler provides a low-cost way for organizations to reduce their server count and accrue cost savings from a reduction in space, cooling, power and personnel.

Download now »

White Paper

Why Your Firewall, VPN, and IEEE 802.11i Aren't Enough to Protect Your Network

The emergence of WLANs has created a new breed of security threats to enterprise networks.

Included in HP ProCurve WLAN solutions is security technology that alleviates threats from WLANs through:
* Monitoring wireless activity inside and out of the enterprise
* Classifying WLAN transmissions into harmful and harmless
* Preventing transmissions that pose a security threat to the enterprise network
* Locating participating devices for physical remediation

Download now »

White Paper

Bringing the Edge to the Data Center

Effectively address data protection challenges, implementing solutions that help store and protect business–critical data while cutting costs and improving efficiency and reliability.

Download now »
mememe 27-May-09 9:18am
It's too bad you didn't try some of the better alternatives like pfsense. I have used/supported sonicwall and watchguard (from the 700 series up to 6 months ago latest version) and pfsense can easily outperform both. Oh yeah, I almost forgot to mention. pfsense is free/open source. http://www.pfsense.org
GeorgeK 27-May-09 10:04am
It should be noted that all SonicWALL® E-Class NSA Series and SonicWALL® NSA Series appliances provide the same level of UTM protection regardless of the model. This way customers of any size can be assured they are protected and choose the model based on their business needs without compromizing security. George. SonicWALL Partner The Netherlands.
bobjohnson 27-May-09 10:19am
Note, 14 mega BYTES per second is still only 112 mega BITS per second. Pretty sad throughput considering Sonicwall claims full UTM performance at 1.7Gbps. Perhaps under ideal conditions, but definately not in this case.

Subscribe to the Security Central Newsletter

Stay informed of the latest security threats and fixes.

White paper

Log Management: How to Develop the Right Strategy for Business and Compliance

This white paper provides guidance on how to develop a strategic approach to managing and monitoring logs, a key function required for compliance with many regulatory mandates and a critical defense against security threats.

Download now! »

White paper

The Essential Series: Security Information Management

Learn about the processes and technologies that support security information management (SIM) operations, as well as the business case for SIM. The series examines different options for implementing SIM and gives you evaluation criteria for selecting the best option for your organization.

Download now! »

White paper

Aberdeen: Choosing and Consuming Managed Security Services

Learn the strategies, actions, and capabilities that Best-in-Class organizations employ and technologies they choose to obtain superior performance against various security performance metrics. This report provides guidelines for identifying which security solutions to consume as a MSS and defines best practices for choosing and managing MSSPs.

Download now! »
©1994-2009 Infoworld, Inc.