Tech Primer

Unified Threat Management (UTM)

What is Unified Threat Management (UTM)?

Unified Threat Management is an emerging trend in the firewall appliance security market. It is the evolution of the traditional firewall into a product that not only guards against intrusion but performs content filtering, spam filtering, intrusion detection and anti-virus duties traditionally handled by multiple systems.

When hackers were the primary focus of an IT enterprise, a firewall was sufficient to protect most networks. Then as viruses became more prevalent, corporates took to anti-virus gateways that scanned for viruses followed by Web content filtering, and later, spam filtering. This resulted in a mess of systems that were costly to administer and took up valuable rack space.

As the hardware that powered today’s enterprise firewalls became more robust it became viable to add functions that were traditionally off the box right into the firewall. Firewalls became ‘firewall appliances’. This is where Unified Threat Management comes in. Rather than administer multiple systems that handle anti virus, content filtering, intrusion detection and spam filtering, companies can purchase a Unified Threat Management firewall appliance that integrates all of the above into a single rack mountable network appliance. The multiple functionality of the Unified Threat Management appliance can be the justification for replacing older more basic firewalls.

What do they consist of?

IDC has defined what a UTM appliance must consist of to be regarded as such. First, it must have a operating system and an installation process that requires a minimum of human intervention. The appliance must have the ability to perform network firewalling, intrusion detection and prevention (IDS/IPS) and gateway anti-virus (AV). All capabilities need not be utilised, but the functions must exist in the appliance. A UTM appliance may also include other features such as security management and policy management by group or user.

What are the advantages of using a UTM tool?

Why are people buying threat management security appliances when many excellent software-based security applications are already on the market? Simply put, convenience and ease of installation are the key advantages of threat management security appliances. The growth of the threat management security appliance market is largely on account of:

Reduced complexity: The all-in-one approach simplifies product selection, product integration, and ongoing support.

Easy to deploy: Customers or more often VARs, VADs, or MSPs can easily install and maintain the products. Increasingly, this process is handled remotely.

Synergies with high-end software solutions: Appliances are used in remote sites where an enterprise does not have security professionals on the ground. A plug-and-play appliance can be installed and managed remotely. This management is synergistic with large, centralised software-based firewalls.

Low operator interaction: Users have a tendency to play with things, and the black box approach limits the ‘damage’ users can do. This reduces trouble calls and improves security.

Troubleshooting ease: When a box fails, it is easier to swap it out than troubleshoot. This process gets the node back online quicker, and a non-technical person can also do it. This feature is especially important for remote offices without dedicated technical staff onsite.

Is there a market for UTM appliances?

Overall, IDC forecasts that the threat management security appliance market will grow at a combined annual growth rate of 17 percent between 2003 and 2008. This translates into a global market of $3.45 billion. Appliances have become popular by being a simple means of delivering security software. By 2007, 80 percent of all security solutions will be delivered via a dedicated appliance. IDC believes that, over the next five years, the revenue generated by the sale of UTM appliances will exceed that of standard firewall/VPNs, effectively replacing these products.

How do you judge a UTM appliance?

Here are five simple considerations when evaluating the pros and cons of buying a UTM appliance:

• Make sure there are no holes in your security set-up. A UTM appliance provides blanket security cover for Internet-based threats
• In order to fully provide unified threat management, the appliance must include all the important security elements such as firewall, AV filter, anti-spam filter, URL filter and IDS/IPS
• The UTM appliance must be foolproof; update important elements such as AV filter databases and should be easy to use
• A UTM appliance should work 24x7x365—forming permanent, transparent protection for your company network
• It should be affordable and comprehensive

Which companies offer UTM solutions in India?

Fortinet, NetScreen (acquired by Juniper Networks), Symantec, NetScaler, WatchGuard Technologies and Elitecore Technologies.