Testing So-Called 'Unified Threat Managers'

snydeq writes "The InfoWorld Test Center has released vulnerability testing results for four so-called 'unified threat managers' — single units that combine firewall, VPN, intrusion detection and prevention, anti-malware, anti-spam, and Web content filtering in lieu of a relay rack stuffed top to bottom with appliances. The lab threw nearly 600 exploits of known vulnerabilities in a wide range of popular OSes, applications, and protocols, and despite being designed to thwart such threats, the UTMs as a class allowed hundreds to pass through. Why did the UTMs miss so many exploits? A lack of horsepower to perform the necessary deep packet inspection under load is suspected, as the lab pushed the limits of each unit's throughput with legitimate traffic. 'The upshot is, although the vendors have packed these devices with additional gateway security functions, clearly many UTMs are still strictly firewalls at heart.'"

Comments

Re:No Cisco product?

[John Hasler]

> It would have been nice to see how the ASA5500 series appliances stood up to the test.

If you send them one I'm sure they'll test it. It appears that Cisco wouldn't.

Re:I used to love Sonicwall

[C_Kode]

An Sonicwall TZ190 starts around $500 and an SSG5 can be had for about $500. They are comparable products. This is the base router without the annual subscription for filtering and virus type scanning extras that they both support, but are unnesessary for use.

Re:No Cisco product?

[John Hasler]

> Of course, these days most people don't perform due diligence...

They never did, and it made IBM billions.

Re:general purpose != good

[mvdwege]

I have news for you: UTM is old news. Vendors have been selling this stuff for years already. And yes, the complaint remains: a mish-mash of badly integrated components that eat up a significant part of your performance.

I admin these things for a living, and they're a pain. Their management interfaces suck, the false negative rate sucks, and turning on the various protection methods eats up to 80% of your bandwidth.

Mart