Unified threat management

Unified threat management (UTM) or unified security management (USM), is the evolution of the traditional firewall into an all-inclusive security product able to perform multiple security functions within one single system: network firewalling, network intrusion detection/prevention (IDS/IPS), gateway antivirus (AV), gateway anti-spam, VPN, content filtering, load balancing, data loss prevention, and on-appliance reporting.[1]

The worldwide UTM market was worth approximately $1.2 billion in 2007, with a forecast of 35–40% compounded annual growth rate through 2011. The primary market of UTM providers is small and medium-sized enterprises (SMEs), although a few providers are now offering UTM solutions for small offices/home offices.[2]

History

UTM solutions emerged of the need to stem the increasing number of attacks on corporate information systems via hacking, viruses, and worms from blended and insider threats. Newer attack techniques target the user as the weakest link in an enterprise, with serious repercussions. Data security and the prevention unauthorized employee access has become a major business concern for enterprises today, because malicious intent and the resultant loss of confidential data can lead to huge financial losses as well as corresponding legal liabilities. Enterprises have only recently begun to recognize that user ignorance can lead to compromised network security.[3]

The main advantage of an UTM solution is its ability to reduce complexity. Its main disadvantage is a single point of failure.[4] The goal of a UTM is to provide a comprehensive set of security features in a single product managed through a single console. Integrated security solutions have become the logical way to tackle increasingly complex, blended Internet threats.[5]

Transition from point to integrated security solutions

Traditional point solutions, which were installed to solve major threat and productivity issues, are often difficult to deploy, manage, and update, which increases operational complexities and overhead costs.[6] The traditional point solution approach led to disadvantages, such as the deployment of reduced security and inferior policies at remote locations. UTMs can help overcome such problems. Instead, organizations of today may rely on an integrated approach to network security and productivity that combines the management of traditionally disparate point technologies.

Role of user identity

Identity-based UTM appliances are the security solutions offering comprehensive protection against blended threats. While simple UTMs identify only IP addresses in the network, identity-based UTMs provide discrete identity information of each user in the network along with network log data. They allow creation of identity-based network access policies for individual users, delivering visibility and control on the network activities. The identity-based feature of such UTMs runs across the entire feature set, enabling enterprises to identify patterns of behavior by specific users or groups that can signify misuse, unauthorized intrusions, or malicious attacks from inside or outside the enterprise.[3]

The strength of UTM technology is that it is designed to offer comprehensive security while being easy to manage. Enterprises get complete network information in hand to take proactive action against network threats in case of inappropriate or suspicious user behavior in the network. As identity-based UTMs do not depend on IP addresses, they provide comprehensive protection even in dynamic IP environments such as DHCP and Wi-Fi and especially in a scenario where multiple users share the same computer.[3]

Regulatory compliance

One feature of UTM appliances is that they provide security technology that can handle the increasingly regulatory environment across the world. Regulatory compliances like HIPAA, GLBA, PCI-DSS, FISMA, CIPA, SOX, NERC, FFIEC require access controls and auditing that control data leakage. UTMs that provide identity-based security and give visibility into user activity while enabling policy creation based on the user identity, meeting the requirements of regulatory compliance. Identity-based UTMs deliver identity-based reports on individual users in the network. This offers short audit and reporting cycles and facilitates the meeting of regulatory compliance requirements in enterprises.

See also

References

  1. ↑ IDC. September 2007. Unified Threat Management Appliances and Identity-based Security: The Next Level in Network security. IDC Go-to Market Services.
  2. ↑ Firstbrook, Peter, Orans, Lawrence & Hallawell, Arabella. 4 June 2007. Magic Quadrant for Secure Web Gateway, 2007. Gartner Inc. 1–28
  3. 1 2 3 Mittal, Richa. Dec 19, 2008. Unified Threat Management and Identity-based Security. Knol Articles. https://web.archive.org/web/20090208112613/http://knol.google.com/k/richa-mittal/unified-threat-management-and-identity/1jdphe4wksldn/5. Accessed May 7, 2009
  4. ↑ Author Unknown. 2009. Definitions –Unified Threat Management. Search Security (Tech Target). http://searchsecurity.techtarget.com/dictionary/definition/what-is-unified-threat-management.html. (accessed May 7, 2009)
  5. ↑ Biztech. 2008. SMBs Driving the Indian UTM Market. Biztech India. http://tech2.in.com/biz/india/features/security/smbs-driving-the-indian-utm-market/19851/0 (accessed May 7, 2009)
  6. ↑ Jacob, John, 2009. The Rise of Integrated Security Appliances. Channel Business. http://www.channelbusiness.in/index.php?Itemid=83&id=252&option=com_content&task=view. (Accessed May 6, 2009)http://www.channelbusiness.in/index.php?Itemid=83&id=252&option=com_content&task=view
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.