Thoughts on how I could improve my network security?
-
But, like all things of this nature, I've presented my side as to "why" keeping firewalls and the things considered "UTM functions" in separate places.
Now, some feel the opposite. For those that want to say that UTMs (putting lots of applications together onto the router/firewall box) is better than the normal industry standard practice of keeping applications isolated, please present your reasons for wanting that. I've presented solid reasons, that you might not agree with, for why I'd follow industry best practice here. I don't remember anyone saying why they'd do the opposite, only questioning why I'd not do it, which isn't the same as presenting a reason.
So I'm asking... what's the reasons for going against the grain in this one case? There are exceptions to most every rule, but I've not seen anyone anywhere ever present an argument for UTMs, only that they'd use them despite the reasons against them.
-
Also, it's important to remember that just because something isn't the "best way to do it" doesn't imply that the other option doesn't work, just that it isn't as good. Just like how RAID 6 almost always works, even in cases where RAID 10 would have been better. A better design doesn't imply, at all, that non-best designs won't work, only that they don't work as well.
-
Reason to use a UTM:
single interface for all things covered
a single thing to update
single thing to secure (appliance, be it physical or virtual)
functions should integrate together more easily
single vendor to get support fromScott asked for reasons one might provide, so for devil's advocate I provided the above list. Now Scott will tell us why we don't want these things, or why they aren't good.
-
@dashrender said in Thoughts on how I could improve my network security?:
Reason to use a UTM:
a single thing to update
This is not inherent with being a UTM. It might be offered that way, but there is no guarantee. Each application needs updates individually, they are different things. Normally, this would be seen as a negative - a lack of update controls. You'd never want any other enterprise app updated "all as one thing", why this one? Why do you see this as a benefit when normally it would be considered a show stopper if this was on a non-security server, for security and stability reasons?
Also, pretty sure almost no UTM offers this.
-
@dashrender said in Thoughts on how I could improve my network security?:
single thing to secure (appliance, be it physical or virtual)
Again, not a positive. There are still all those pieces to secure, just less ability to protect them from each other. Once again, think of this in terms of any other enterprise app, would you call it "less to secure" when you have SBS vs. dedicated VMs for applications?
-
@dashrender said in Thoughts on how I could improve my network security?:
functions should integrate together more easily
This is marketing and doesn't mean anything here. "Should", but do they? There is no integration issue with separate parts, what does this mean to you?
-
@dashrender said in Thoughts on how I could improve my network security?:
single vendor to get support from
This, again, isn't true. UTMs can be multi-vendor, non-UTMs can be single vendor.
I feel that, and have always felt that, UTMs are sold, conceptually, via marketing channels and depend on a misunderstanding or false assumptions about their behaviour and value to drive their sales.
What is solid, is that lots of separate functions are running on a single box and interact with each other in potentially unstable and insecure ways. Why are we okay with lowering our standards in this one specific case? What about UTMs makes us happen to treat them as second class citizens on the network?
-
@dashrender said in Thoughts on how I could improve my network security?:
single interface for all things covered
Likely, but again, no guarantee. Some UTMs lack a singular interface option.
-
All of the reasons there are the same things with SBS. Look at UTMs in the broader context. What makes people believe them to be unique and outside of otherwise standard best practices or approaches?
-
Remember that even the best UTM vendors also offer their products in non-UTM forms. You can deploy Palo Alto or others without being a UTM.
Without being a UTM, you also have the freedom to pick and choose components and vendors as needed for cost, best of breed, unique needs, etc.
-
Some folks prefer the simplicity of having one throat to choke -- especially in the SMB world. Having run both ends of the spectrum -- that is managing a network with a UTM, vs a separate Firewall and UTM appliance, I can safely say that I prefer to keep them separated.
I saw better Network throughput and performance when keeping the various UTM functions separated out. My worst experience was with Fortinet as a UTM. Enabling IDS / IPS on this device would kill our internet almost immediately.
My best experience with a Non-UTM setup was Smoothwall. We had a Firewall, an IDS, and a Reporting box (three separate devices). Even with the IDS enabled, our internet speeds didn't take a hit.
-
@dafyre said in Thoughts on how I could improve my network security?:
Some folks prefer the simplicity of having one throat to choke -- especially in the SMB world.
But prefer doesn't mean it's a good idea. Lots of people prefer letting their sales people dictate everything, too. It's a reason why it happens, but isn't a reason why it would be a recommendation.
Also, again, bad logic. UTM doesn't mean one throat, non-UTM doesn't mean multiple throats.
-
My gut feel on this is just that marketing has convinced people that, like SAN and cloud, UTM is just "a black box you have to buy" and that you don't need to evaluate it or consider it like standard IT services. It's a "magic check box" approach and people forget, thanks to all the smoke and mirrors, that it is a server like any other with applciations like any other and should be treated as any other system, not a special case. There's nothing special or unique about a UTM, it's just services that use the router's CPU and OS as their platform rather than a server's CPU and OS.
-
@dafyre said in Thoughts on how I could improve my network security?:
Some folks prefer the simplicity of having one throat to choke -- especially in the SMB world. Having run both ends of the spectrum -- that is managing a network with a UTM, vs a separate Firewall and UTM appliance, I can safely say that I prefer to keep them separated.
I saw better Network throughput and performance when keeping the various UTM functions separated out. My worst experience was with Fortinet as a UTM. Enabling IDS / IPS on this device would kill our internet almost immediately.
My best experience with a Non-UTM setup was Smoothwall. We had a Firewall, an IDS, and a Reporting box (three separate devices). Even with the IDS enabled, our internet speeds didn't take a hit.
Sure, but what is the likely reason that internet was so badly affected by you enabling IDS? I'm guessing it was underpowered hardware. Granted this is frequently the case with UTMs.
-
@dashrender said in Thoughts on how I could improve my network security?:
@dafyre said in Thoughts on how I could improve my network security?:
Some folks prefer the simplicity of having one throat to choke -- especially in the SMB world. Having run both ends of the spectrum -- that is managing a network with a UTM, vs a separate Firewall and UTM appliance, I can safely say that I prefer to keep them separated.
I saw better Network throughput and performance when keeping the various UTM functions separated out. My worst experience was with Fortinet as a UTM. Enabling IDS / IPS on this device would kill our internet almost immediately.
My best experience with a Non-UTM setup was Smoothwall. We had a Firewall, an IDS, and a Reporting box (three separate devices). Even with the IDS enabled, our internet speeds didn't take a hit.
Sure, but what is the likely reason that internet was so badly affected by you enabling IDS? I'm guessing it was underpowered hardware. Granted this is frequently the case with UTMs.
That's a common problem, for sure. Almost everyone I have spoken with that has used UTMs found them to create big time bottlenecks. Of course, this is cause by improperly sizing the UTM, but it happens all the time. I presume because of the magic black box effect - they trust that the vendor will make it able to handle the assumed workload at wire speed.
-
@scottalanmiller said in Thoughts on how I could improve my network security?:
@dashrender said in Thoughts on how I could improve my network security?:
@dafyre said in Thoughts on how I could improve my network security?:
Some folks prefer the simplicity of having one throat to choke -- especially in the SMB world. Having run both ends of the spectrum -- that is managing a network with a UTM, vs a separate Firewall and UTM appliance, I can safely say that I prefer to keep them separated.
I saw better Network throughput and performance when keeping the various UTM functions separated out. My worst experience was with Fortinet as a UTM. Enabling IDS / IPS on this device would kill our internet almost immediately.
My best experience with a Non-UTM setup was Smoothwall. We had a Firewall, an IDS, and a Reporting box (three separate devices). Even with the IDS enabled, our internet speeds didn't take a hit.
Sure, but what is the likely reason that internet was so badly affected by you enabling IDS? I'm guessing it was underpowered hardware. Granted this is frequently the case with UTMs.
That's a common problem, for sure. Almost everyone I have spoken with that has used UTMs found them to create big time bottlenecks. Of course, this is cause by improperly sizing the UTM, but it happens all the time. I presume because of the magic black box effect - they trust that the vendor will make it able to handle the assumed workload at wire speed.
This is not an unreasonable expectation. Sadly the vendors have proven that they just don't care about their customers and provide hardware that's not up to the task.
-
@dashrender said in Thoughts on how I could improve my network security?:
@scottalanmiller said in Thoughts on how I could improve my network security?:
@dashrender said in Thoughts on how I could improve my network security?:
@dafyre said in Thoughts on how I could improve my network security?:
Some folks prefer the simplicity of having one throat to choke -- especially in the SMB world. Having run both ends of the spectrum -- that is managing a network with a UTM, vs a separate Firewall and UTM appliance, I can safely say that I prefer to keep them separated.
I saw better Network throughput and performance when keeping the various UTM functions separated out. My worst experience was with Fortinet as a UTM. Enabling IDS / IPS on this device would kill our internet almost immediately.
My best experience with a Non-UTM setup was Smoothwall. We had a Firewall, an IDS, and a Reporting box (three separate devices). Even with the IDS enabled, our internet speeds didn't take a hit.
Sure, but what is the likely reason that internet was so badly affected by you enabling IDS? I'm guessing it was underpowered hardware. Granted this is frequently the case with UTMs.
That's a common problem, for sure. Almost everyone I have spoken with that has used UTMs found them to create big time bottlenecks. Of course, this is cause by improperly sizing the UTM, but it happens all the time. I presume because of the magic black box effect - they trust that the vendor will make it able to handle the assumed workload at wire speed.
This is not an unreasonable expectation. Sadly the vendors have proven that they just don't care about their customers and provide hardware that's not up to the task.
Which is kind of the general nature of a UTM. The starting point here is a device that generally is sold on a basis of misdirection. There are use cases for a UTM, like at a branch office that needs those features but has no server whatsoever. It's not that the product category should not exist at all, but it should be an insanely rare and limited use product. Instead, it is sold as a panacea for those that want security to be a checkbox rather than having to evaluate and properly handle their needs. So that you have vendors making products and marketing products specifically around taking advantage of customers rather than meeting their needs, it follows that other aspects like sizing or configuration might not get much attention to customer needs as well.
-
@scottalanmiller said in Thoughts on how I could improve my network security?:
@dashrender said in Thoughts on how I could improve my network security?:
@scottalanmiller said in Thoughts on how I could improve my network security?:
@dashrender said in Thoughts on how I could improve my network security?:
@dafyre said in Thoughts on how I could improve my network security?:
Some folks prefer the simplicity of having one throat to choke -- especially in the SMB world. Having run both ends of the spectrum -- that is managing a network with a UTM, vs a separate Firewall and UTM appliance, I can safely say that I prefer to keep them separated.
I saw better Network throughput and performance when keeping the various UTM functions separated out. My worst experience was with Fortinet as a UTM. Enabling IDS / IPS on this device would kill our internet almost immediately.
My best experience with a Non-UTM setup was Smoothwall. We had a Firewall, an IDS, and a Reporting box (three separate devices). Even with the IDS enabled, our internet speeds didn't take a hit.
Sure, but what is the likely reason that internet was so badly affected by you enabling IDS? I'm guessing it was underpowered hardware. Granted this is frequently the case with UTMs.
That's a common problem, for sure. Almost everyone I have spoken with that has used UTMs found them to create big time bottlenecks. Of course, this is cause by improperly sizing the UTM, but it happens all the time. I presume because of the magic black box effect - they trust that the vendor will make it able to handle the assumed workload at wire speed.
This is not an unreasonable expectation. Sadly the vendors have proven that they just don't care about their customers and provide hardware that's not up to the task.
Which is kind of the general nature of a UTM. The starting point here is a device that generally is sold on a basis of misdirection. There are use cases for a UTM, like at a branch office that needs those features but has no server whatsoever. It's not that the product category should not exist at all, but it should be an insanely rare and limited use product. Instead, it is sold as a panacea for those that want security to be a checkbox rather than having to evaluate and properly handle their needs. So that you have vendors making products and marketing products specifically around taking advantage of customers rather than meeting their needs, it follows that other aspects like sizing or configuration might not get much attention to customer needs as well.
I get what you're you're saying.. but the costs to an SMB for the research side alone could out weight the cost of the solution. Assuming you hired NTG to research options for you, that would easily be $500 just in research. Assuming you don't have a server, nor a need for a server, when you look at something like a SonicWall at $2000 for 3 years worth of updates, that's 25% of that cost.
I'm not saying there aren't times when it's needed, but as you point out, it's about business decisions.
-
@dashrender said in Thoughts on how I could improve my network security?:
@scottalanmiller said in Thoughts on how I could improve my network security?:
@dashrender said in Thoughts on how I could improve my network security?:
@scottalanmiller said in Thoughts on how I could improve my network security?:
@dashrender said in Thoughts on how I could improve my network security?:
@dafyre said in Thoughts on how I could improve my network security?:
Some folks prefer the simplicity of having one throat to choke -- especially in the SMB world. Having run both ends of the spectrum -- that is managing a network with a UTM, vs a separate Firewall and UTM appliance, I can safely say that I prefer to keep them separated.
I saw better Network throughput and performance when keeping the various UTM functions separated out. My worst experience was with Fortinet as a UTM. Enabling IDS / IPS on this device would kill our internet almost immediately.
My best experience with a Non-UTM setup was Smoothwall. We had a Firewall, an IDS, and a Reporting box (three separate devices). Even with the IDS enabled, our internet speeds didn't take a hit.
Sure, but what is the likely reason that internet was so badly affected by you enabling IDS? I'm guessing it was underpowered hardware. Granted this is frequently the case with UTMs.
That's a common problem, for sure. Almost everyone I have spoken with that has used UTMs found them to create big time bottlenecks. Of course, this is cause by improperly sizing the UTM, but it happens all the time. I presume because of the magic black box effect - they trust that the vendor will make it able to handle the assumed workload at wire speed.
This is not an unreasonable expectation. Sadly the vendors have proven that they just don't care about their customers and provide hardware that's not up to the task.
Which is kind of the general nature of a UTM. The starting point here is a device that generally is sold on a basis of misdirection. There are use cases for a UTM, like at a branch office that needs those features but has no server whatsoever. It's not that the product category should not exist at all, but it should be an insanely rare and limited use product. Instead, it is sold as a panacea for those that want security to be a checkbox rather than having to evaluate and properly handle their needs. So that you have vendors making products and marketing products specifically around taking advantage of customers rather than meeting their needs, it follows that other aspects like sizing or configuration might not get much attention to customer needs as well.
I get what you're you're saying.. but the costs to an SMB for the research side alone could out weight the cost of the solution. Assuming you hired NTG to research options for you, that would easily be $500 just in research. Assuming you don't have a server, nor a need for a server, when you look at something like a SonicWall at $2000 for 3 years worth of updates, that's 25% of that cost.
I'm not saying there aren't times when it's needed, but as you point out, it's about business decisions.
Sadly this is what it comes down to a lot.
-
@tim_g said in Thoughts on how I could improve my network security?:
@dashrender said in Thoughts on how I could improve my network security?:
@scottalanmiller said in Thoughts on how I could improve my network security?:
@dashrender said in Thoughts on how I could improve my network security?:
@scottalanmiller said in Thoughts on how I could improve my network security?:
@dashrender said in Thoughts on how I could improve my network security?:
@dafyre said in Thoughts on how I could improve my network security?:
Some folks prefer the simplicity of having one throat to choke -- especially in the SMB world. Having run both ends of the spectrum -- that is managing a network with a UTM, vs a separate Firewall and UTM appliance, I can safely say that I prefer to keep them separated.
I saw better Network throughput and performance when keeping the various UTM functions separated out. My worst experience was with Fortinet as a UTM. Enabling IDS / IPS on this device would kill our internet almost immediately.
My best experience with a Non-UTM setup was Smoothwall. We had a Firewall, an IDS, and a Reporting box (three separate devices). Even with the IDS enabled, our internet speeds didn't take a hit.
Sure, but what is the likely reason that internet was so badly affected by you enabling IDS? I'm guessing it was underpowered hardware. Granted this is frequently the case with UTMs.
That's a common problem, for sure. Almost everyone I have spoken with that has used UTMs found them to create big time bottlenecks. Of course, this is cause by improperly sizing the UTM, but it happens all the time. I presume because of the magic black box effect - they trust that the vendor will make it able to handle the assumed workload at wire speed.
This is not an unreasonable expectation. Sadly the vendors have proven that they just don't care about their customers and provide hardware that's not up to the task.
Which is kind of the general nature of a UTM. The starting point here is a device that generally is sold on a basis of misdirection. There are use cases for a UTM, like at a branch office that needs those features but has no server whatsoever. It's not that the product category should not exist at all, but it should be an insanely rare and limited use product. Instead, it is sold as a panacea for those that want security to be a checkbox rather than having to evaluate and properly handle their needs. So that you have vendors making products and marketing products specifically around taking advantage of customers rather than meeting their needs, it follows that other aspects like sizing or configuration might not get much attention to customer needs as well.
I get what you're you're saying.. but the costs to an SMB for the research side alone could out weight the cost of the solution. Assuming you hired NTG to research options for you, that would easily be $500 just in research. Assuming you don't have a server, nor a need for a server, when you look at something like a SonicWall at $2000 for 3 years worth of updates, that's 25% of that cost.
I'm not saying there aren't times when it's needed, but as you point out, it's about business decisions.
Sadly this is what it comes down to a lot.
What's worse, is you often have no clue what the research time is going to cost. If NTG, in this case, just did the same or similar research for someone else, you might get lucky and ride the coat tails of that time, but it's every bit as likely that the vendor will simply charge you the same that they charged the previous customer.
