In my last post, i blogged about UTM’s which got a fairly positive response over mail :) . UTMs can be simply expressed as Next generation Firewalls, have evolved specifically from conventional firewalls. The first firewalls were software firewalls which were itself evolved from software routers.

Later on as technology evolved, and hardware routers came into scene, hardware firewalls arrived which were nothing more than routers with packet filtering capabilities. Furthermore, the technology matured from basic packet filtering to a more complex control technology which included stateful packet inspection and finally to full application layer inspection devices (IEEE, 1997). Around the year 2000, VPN’s appeared and gained acceptance as the mainstream technology to connect networks securely, remotely. Firewalls followed closely by integrating VPN’s with Firewall which was the natural choice as enterprise solutions required both firewalls and VPNS.

As the prices for bandwidth fell along with the cost of cryptographic hardware needed to encode and decode the traffic, the need for specialized hardware rose which may be used to accelerate the performance.

Unified Threat Management

In mid 2004, International Data Corporation (IDC) defined UTM platforms as to minimally include firewall, VPN, intrusion prevention and antivirus features. Touted as “Next Generation Firewalls”, we have two approaches to design the UTM’s since their inception.

Licensing and Integrating Approach (Multi vendor UTM)

In-house Development Approach (Single vendor UTM)

The above figure illustrates the core architecture and development approach of developing UTMs

Licensing and Integrating Approach (Multi vendor UTM)

The first design approach tried to get the best of worlds by integrating specialized technologies from different security vendors. For e.g.:

Cyberoam UTM licenses Antivirus from Kaspersky, AntiSpam by Commtouch , both who specialize in Antivirus and AntiSpam technologies.

These UTM’s provided an integrated interface to manage all the integrated technologies in the easiest possible manner, while some others require specific management interfaces.

Advantages Limitations Combines the best of all worlds Research and advancement dependent on different vendors, hindrance in optimization of individual applications Less time required in development and deployment of a new UTM box Again, the time is dependent on different security vendors Single Management interface The interface may not be adequate Cost effective If one of security vendor was compromised globally, the UTM was gone as the technology is outsourced Cannot take full benefit of hardware acceleration resources due to multivendor technologies Embedding of new technologies is difficult

In-house Development Approach (Single vendor UTM)

The second design approach is the more difficult out of two, which requires ground up development of a UTM device from scratch, and involves the provision of each security function natively. This was not flawless, each security function must pass a set of market guidelines and standards set by standalone security products effectively in order to be accepted. However, with time, the core functions provided by UTM platforms—firewall, intrusion prevention and antivirus—had matured since the onset of the UTM era, so building competent security functions was both possible and cost effective. Also, this approach had a better management interface as the platform incorporated all the technologies since inception.

Advantages Limitations Unified architecture from scratch All the technologies may/may not be adequate as compared to their professional standalone counterparts Research and advancement dependent on own pace, better optimization of applications More time required in development and deployment of a new UTM box Unified and Best management interface High cost of development In-house code fills security gaps and poses less threat of compromise. Security through obscurity is not always a very good idea. Can take full benefit of hardware acceleration resources, which leads to exponential performance gains Embedding of new technologies is easier

In my next article I will be discussing more about UTMs. Please add your points so I can make it better.

Stay tuned.