Thoughts on how I could improve my network security?
-
@dashrender said in Thoughts on how I could improve my network security?:
@scottalanmiller said in Thoughts on how I could improve my network security?:
@dashrender said in Thoughts on how I could improve my network security?:
@scottalanmiller said in Thoughts on how I could improve my network security?:
@dashrender said in Thoughts on how I could improve my network security?:
@scottalanmiller said in Thoughts on how I could improve my network security?:
@dashrender said in Thoughts on how I could improve my network security?:
@dafyre said in Thoughts on how I could improve my network security?:
Some folks prefer the simplicity of having one throat to choke -- especially in the SMB world. Having run both ends of the spectrum -- that is managing a network with a UTM, vs a separate Firewall and UTM appliance, I can safely say that I prefer to keep them separated.
I saw better Network throughput and performance when keeping the various UTM functions separated out. My worst experience was with Fortinet as a UTM. Enabling IDS / IPS on this device would kill our internet almost immediately.
My best experience with a Non-UTM setup was Smoothwall. We had a Firewall, an IDS, and a Reporting box (three separate devices). Even with the IDS enabled, our internet speeds didn't take a hit.
Sure, but what is the likely reason that internet was so badly affected by you enabling IDS? I'm guessing it was underpowered hardware. Granted this is frequently the case with UTMs.
That's a common problem, for sure. Almost everyone I have spoken with that has used UTMs found them to create big time bottlenecks. Of course, this is cause by improperly sizing the UTM, but it happens all the time. I presume because of the magic black box effect - they trust that the vendor will make it able to handle the assumed workload at wire speed.
This is not an unreasonable expectation. Sadly the vendors have proven that they just don't care about their customers and provide hardware that's not up to the task.
Which is kind of the general nature of a UTM. The starting point here is a device that generally is sold on a basis of misdirection. There are use cases for a UTM, like at a branch office that needs those features but has no server whatsoever. It's not that the product category should not exist at all, but it should be an insanely rare and limited use product. Instead, it is sold as a panacea for those that want security to be a checkbox rather than having to evaluate and properly handle their needs. So that you have vendors making products and marketing products specifically around taking advantage of customers rather than meeting their needs, it follows that other aspects like sizing or configuration might not get much attention to customer needs as well.
I get what you're you're saying.. but the costs to an SMB for the research side alone could out weight the cost of the solution. Assuming you hired NTG to research options for you, that would easily be $500 just in research. Assuming you don't have a server, nor a need for a server, when you look at something like a SonicWall at $2000 for 3 years worth of updates, that's 25% of that cost.
I'm not saying there aren't times when it's needed, but as you point out, it's about business decisions.
That’s a decent theory. But in the real world is not even remotely the case. The cost of research or “knowing the market” is trivially small and the oversell from vendors is insanely large.
You can see with the SonicWall, you’d save thousands knowing to not buy that one thing.
What solution would you recommend that provide the typical UTM and what's the cost? Assume the client has no infrastructure for VMs already in place, yet they need it anyhow.
- Contrived. You can't know that you need UTM features and not know what is on the market and have all the answers. The knowledge to know one means you must have the other. This scenario cannot arise.
- The common answer, 95% of the time, is that UTM features don't meet the business requirements and the correct answer is to only have a firewall, not a UTM or UTM-like featuers.
- What real world client actually needs UTM features, but doesn't need servers or any other infrastructure? Possible, but realistically this is just being silly. UTMs basically exist to protect servers.
- You can't just answer any question like this, IT is not a checkbox and there isn't any "one size fits all" in anything that we do.
This, to me, shows the kind of thinking that tends to make UTM decisions happen.....
- One mistake build on another.
- Non-business requirements driving decisions (emotional buying)
- Wrong tools for the job based off of marketing trends
- Contrived scenarios
- Fundamentally bad beliefs that we don't need to make IT decisions but that you just check a box on a form that you "bought" a product of type X
- That security is something you buy rather than something that you do
-
@dashrender said in Thoughts on how I could improve my network security?:
I'll correct myself.
You're right - Those are VARs.. SMBs don't know the difference between a VAR and an ITSP, and frankly, most don't want an ITSP, they want someone to handle it from soup to nuts.
Because SMB management aren't good at adulting therefore that's an excuse for them to be bad at adulting?
-
@dashrender said in Thoughts on how I could improve my network security?:
I'll correct myself.
You're right - Those are VARs.. SMBs don't know the difference between a VAR and an ITSP
Every functional adult knows the difference. Please don't mock business people to this degree. It's so insulting. Of course they know. That they don't care is another matter.
-
@dashrender said in Thoughts on how I could improve my network security?:
...and frankly, most don't want an ITSP, they want someone to handle it from soup to nuts.
This is the actual issue. The want to outsource their own business decision making. Which is fine, but is bad practice and as I say in every one of these discussions, you can never use one mistake in bad decision making to justify intentionally making bad decisions.
-
@coliver said in Thoughts on how I could improve my network security?:
@dashrender said in Thoughts on how I could improve my network security?:
I'll correct myself.
You're right - Those are VARs.. SMBs don't know the difference between a VAR and an ITSP, and frankly, most don't want an ITSP, they want someone to handle it from soup to nuts.
Because SMB management aren't good at adulting therefore that's an excuse for them to be bad at adulting?
Of course not, but that doesn't make it any less the reality of the situation.
-
@coliver said in Thoughts on how I could improve my network security?:
@dashrender said in Thoughts on how I could improve my network security?:
I'll correct myself.
You're right - Those are VARs.. SMBs don't know the difference between a VAR and an ITSP, and frankly, most don't want an ITSP, they want someone to handle it from soup to nuts.
Which an ITSP would do. They just wouldn't sell or get a benefit to suggesting a product.
Exactly. ITSP are soup to nuts, VAR are not. ITSP is your partner for your needs, the VAR is your enemy.
-
@dashrender said in Thoughts on how I could improve my network security?:
@coliver said in Thoughts on how I could improve my network security?:
@dashrender said in Thoughts on how I could improve my network security?:
I'll correct myself.
You're right - Those are VARs.. SMBs don't know the difference between a VAR and an ITSP, and frankly, most don't want an ITSP, they want someone to handle it from soup to nuts.
Because SMB management aren't good at adulting therefore that's an excuse for them to be bad at adulting?
Of course not, but that doesn't make it any less the reality of the situation.
And, like every conversation like this, what does this have to do with the price of milk? This is a red herring. Why do you bring this up as if it justifies giving bad advice?
Don't tell people to wear seatbelts, because in reality many people won't.
Really?
-
@dashrender said in Thoughts on how I could improve my network security?:
@coliver said in Thoughts on how I could improve my network security?:
@dashrender said in Thoughts on how I could improve my network security?:
I'll correct myself.
You're right - Those are VARs.. SMBs don't know the difference between a VAR and an ITSP, and frankly, most don't want an ITSP, they want someone to handle it from soup to nuts.
Because SMB management aren't good at adulting therefore that's an excuse for them to be bad at adulting?
Of course not, but that doesn't make it any less the reality of the situation.
Not arguing that point... that still doesn't make UTMs a good idea for most businesses.
-
@coliver said in Thoughts on how I could improve my network security?:
@dashrender said in Thoughts on how I could improve my network security?:
I'll correct myself.
You're right - Those are VARs.. SMBs don't know the difference between a VAR and an ITSP, and frankly, most don't want an ITSP, they want someone to handle it from soup to nuts.
Because SMB management aren't good at adulting therefore that's an excuse for them to be bad at adulting?
It's that they rarely care about adulting, as society makes it so acceptable to just fail.
-
@coliver said in Thoughts on how I could improve my network security?:
@dashrender said in Thoughts on how I could improve my network security?:
@coliver said in Thoughts on how I could improve my network security?:
@dashrender said in Thoughts on how I could improve my network security?:
I'll correct myself.
You're right - Those are VARs.. SMBs don't know the difference between a VAR and an ITSP, and frankly, most don't want an ITSP, they want someone to handle it from soup to nuts.
Because SMB management aren't good at adulting therefore that's an excuse for them to be bad at adulting?
Of course not, but that doesn't make it any less the reality of the situation.
Not arguing that point... that still doesn't make UTMs a good idea for most businesses.
Right, that bad decision makers make bad decisions is not in question. That has no bearing on what a good decision would be.
-
It's like saying that Person X always answers "5". Then asking what 2 + 7 is. But saying that the answer isn't nine because Person X doesn't do math.
-
A lot of places will have SonicWALLs who haven't gotten it through an ITSP. Upper management made the decision to get a SonicWALL through their own research. And that's the way it is, in the real world. Not in Scott's world, but the real world. It happens like that in so many places it's actually odd to me that you haven't seen it happen. Perhaps you've only ever delt with F500s and that's how it is for them.
Then eventually, IT staff comes on board who does know that SoincWALLs and UTMs shouldn't be used in those cases, but they are already there and nobody wants to spend the money to do it better. This is often the case, adn is what Dash was referring to I think.
-
@coliver said in Thoughts on how I could improve my network security?:
@dashrender said in Thoughts on how I could improve my network security?:
@coliver said in Thoughts on how I could improve my network security?:
@dashrender said in Thoughts on how I could improve my network security?:
I'll correct myself.
You're right - Those are VARs.. SMBs don't know the difference between a VAR and an ITSP, and frankly, most don't want an ITSP, they want someone to handle it from soup to nuts.
Because SMB management aren't good at adulting therefore that's an excuse for them to be bad at adulting?
Of course not, but that doesn't make it any less the reality of the situation.
Not arguing that point... that still doesn't make UTMs a good idea for most businesses.
I never said it was.
-
@dashrender said in Thoughts on how I could improve my network security?:
@coliver said in Thoughts on how I could improve my network security?:
@dashrender said in Thoughts on how I could improve my network security?:
@coliver said in Thoughts on how I could improve my network security?:
@dashrender said in Thoughts on how I could improve my network security?:
I'll correct myself.
You're right - Those are VARs.. SMBs don't know the difference between a VAR and an ITSP, and frankly, most don't want an ITSP, they want someone to handle it from soup to nuts.
Because SMB management aren't good at adulting therefore that's an excuse for them to be bad at adulting?
Of course not, but that doesn't make it any less the reality of the situation.
Not arguing that point... that still doesn't make UTMs a good idea for most businesses.
I never said it was.
No, but you present "but most people won't do this" as if it means something in reference to the decision process. Why mention this otherwise?
-
@tim_g said in Thoughts on how I could improve my network security?:
A lot of places will have SonicWALLs who haven't gotten it through an ITSP. Upper management made the decision to get a SonicWALL through their own research. And that's the way it is, in the real world. Not in Scott's world, but the real world.
Where Scott's world = "good business".
Scott never, ever suggested businesses made good decisions. Scott teaches how to make good decisions. Don't equate Scott's ideas of "what good looks like" with a misconception that I think the normal world looks good. The average business is idiotic and fails in under five years. "Normal" means abject failure in business.
-
@tim_g said in Thoughts on how I could improve my network security?:
A lot of places will have SonicWALLs who haven't gotten it through an ITSP. Upper management made the decision to get a SonicWALL through their own research. And that's the way it is, in the real world. Not in Scott's world, but the real world. It happens like that in so many places it's actually odd to me that you haven't seen it happen. Perhaps you've only ever delt with F500s and that's how it is for them.
Then eventually, IT staff comes on board who does know that SoincWALLs and UTMs shouldn't be used in those cases, but they are already there and nobody wants to spend the money to do it better. This is often the case, adn is what Dash was referring to I think.
This is the Cisco arguement. Upper management sees Cisco advertisements during the a football game. That's the extent of their research.
If the case is upper management made the decision and you've made the case as to why that's not the best decision in this situation. Then you did what you could. "Not my Monkey, not my Circus."
-
@tim_g said in Thoughts on how I could improve my network security?:
Perhaps you've only ever delt with F500s and that's how it is for them.
I deal with every business type of every size. But it would be odd for someone to hire me without any intention of trying to do IT well. Just doesn't make sense. So of course, I see only the top crust of any market. ITSPs, practically by defition, never see bad companies or even average. Only VARs see those.
-
@coliver said in Thoughts on how I could improve my network security?:
@tim_g said in Thoughts on how I could improve my network security?:
A lot of places will have SonicWALLs who haven't gotten it through an ITSP. Upper management made the decision to get a SonicWALL through their own research. And that's the way it is, in the real world. Not in Scott's world, but the real world. It happens like that in so many places it's actually odd to me that you haven't seen it happen. Perhaps you've only ever delt with F500s and that's how it is for them.
Then eventually, IT staff comes on board who does know that SoincWALLs and UTMs shouldn't be used in those cases, but they are already there and nobody wants to spend the money to do it better. This is often the case, adn is what Dash was referring to I think.
This is the Cisco arguement. Upper management sees Cisco advertisements during the a football game. That's the extent of their research.
If the case is upper management made the decision and you've made the case as to why that's not the best decision in this situation. Then you did what you could. "Not my Monkey, not my Circus."
Right, it's just a good way to figure out which vendors prey on foolish managers and which managers think that no one will notice them not doing their jobs.
-
@tim_g said in Thoughts on how I could improve my network security?:
A lot of places will have SonicWALLs who haven't gotten it through an ITSP. Upper management made the decision to get a SonicWALL through their own research. And that's the way it is, in the real world. Not in Scott's world, but the real world. It happens like that in so many places it's actually odd to me that you haven't seen it happen. Perhaps you've only ever delt with F500s and that's how it is for them.
Then eventually, IT staff comes on board who does know that SoincWALLs and UTMs shouldn't be used in those cases, but they are already there and nobody wants to spend the money to do it better. This is often the case, adn is what Dash was referring to I think.
That's part of it.
Apparrently I want to insult most adults by saying they can't or don't adult - i.e. don't know the difference between VAR and ITSP, but so few people actually put any thought into it.
This makes me think that there is a hugely untapped market for ITSP like services to the common man. Find a way to siphon 50% of the wasted money that people spend by getting people better options when they are buying stuff.
-
@tim_g said in Thoughts on how I could improve my network security?:
Then eventually, IT staff comes on board who does know that SoincWALLs and UTMs shouldn't be used in those cases, but they are already there and nobody wants to spend the money to do it better. This is often the case, adn is what Dash was referring to I think.
He might be referring to the case, but why refer to it? What's the relevance? No one was questioning the process by which bad companies do bad things. Only pointing out how good decisions get made and what they would look like.
