UTM appliances whip blended security threats

Taking one part stateful inspection firewall, one part intrusion prevention, and equal parts anti-virus, anti-spam, anti-spyware, and content filtering, UTM (Unified Threat Management) appliances blend traditionally separate security services into a single device, providing not only comprehensive protection against Internet-based threats but also streamlined access to policies and reporting.

Now, instead of jumping between separate security tools and management UIs, admins need only go to one place to manage and monitor these systems. Updates are scheduled and initiated from a single console, reports are viewed from one appliance, and policy is managed from one device.

By moving all of these security services into a single device, UTM appliances are supposed to reduce the admin’s workload; ease-of-use is one of the main selling points. A well-crafted UI can make short work of checking for signature updates, recent activity, and alerts. All of the solutions I tested provided “at a glance” monitoring and management, although some did it better than others. For the datacenter folks, all of the appliances can report back to all common reporting systems, including Syslog and SNMP tools, and all have their own branded central management tool.

A possible argument against UTM appliances is that security guys can no longer pick specific solutions for each defense; they have to use the UTM vendor’s bundled products. If, for example, the enterprise has standardized on CA’s anti-virus and anti-spyware products but wants another vendor’s firewall/VPN, there is no way to integrate the two systems into a common management platform.

For most, this argument is moot. The security services bundled together are typically “best of breed” services in their own right. For example, Astaro uses a combination of Kaspersky and open source signatures for virus protection, whereas WatchGuard and ServGate employ McAfee AV. I don’t believe any security administrator is going to stop using desktop anti-virus or anti-spyware protection and rely solely on the network edge device. UTM’s goal is to stop the threats before they can enter the network, with desktop protection as the last line of defense.

Take your places, please

For this round up of UTM solutions, we requested the model most suited for branch-office deployment. For us, that meant the smallest rack-mountable device that supports all core UTM features and can be managed centrally from the corporate datacenter. We ended up with a range of products from Astaro, Fortinet, ServGate, SonicWall, and WatchGuard, all 1U appliances and more than up to the task. Symantec, Secure Computing, and TippingPoint were invited but were not able to participate due to various scheduling conflicts. 

I ran each appliance through a series of test scenarios similar to what any protected office might experience. I placed each firewall in front of a Windows SBS (Small Business Server) 2003 server running Outlook Web Access, the standard SBS remote workplace portal, SMTP mail services (Exchange), and an FTP server. I created inbound policies designed to expose yet protect each service. I then tried to exploit these services using Core Impact from Core Security Technologies.