4 UTM Solutions You Need To Know In This Article

UTM Solutions : In the field of computer security, the range of solutions is wide and diversified, since not all users have the same needs. In the case of the business world, one of these solutions refers to unified threat management, better known by the acronym UTM: it is characterized by proposing a single network product that incorporates different protection functions, such as a detection system and intrusion prevention, antivirus, firewalls.

We have gathered a total of seven proposals. In the case of Barracuda CloudGen Firewall, companies have at their disposal a unified solution of firewall, IPS, URL filtering, double antivirus and application control functions. In addition, it supports a hardware, virtual or cloud deployment. Meanwhile, Bitdefender GravityZone Ultra Suite focuses on endpoint protection and promises security for the following platforms: Windows, macOS, Linux, VMware, iOS, Android and AWS.

ESET is also participating with its Dynamic Threat Defense cloud security sandbox that ‘casts’ an additional layer of defense outside the network and prevents ransomware from running in production environments. For its part, Fortinet FortiGate (available in different product versions) incorporates data loss prevention software to detect possible breaches and exfiltration attempts.

Thanks to the SonicWall Network Security appliance (NSa), enterprises will discover a UTM that provides, among others, the following security measures: application control, malware analysis, URL filtering, DNS security, Geo-IP and botnet filtering services. . From the hand of Sophos arrive the new XGS Firewall devices that are managed in the Sophos Central cloud platform.

The article closes with the WatchGuard Firebox M5800 UTM. It is tied to the WatchGuard Cloud platform and offers a set of big data visibility and reporting tools that identify and extract key network security trends, issues, and threats to help businesses make the best possible decisions.

Comparison:  UTM solutions

• Barracuda CloudGen Firewall 

The Barracuda solution supports the following implementations to suit the needs of each company: hardware, virtual or in the cloud.

Barracuda CloudGen Firewall is designed and built from the ground up to provide organizations with comprehensive, next-generation firewall protection. Thus, it incorporates in a unified solution the functions of firewall, IPS, URL filtering, double antivirus and application control. 

Additionally, tasks that require a greater number of resources -such as sandboxing (for example, necessary for protection against ransomware)- are perfectly integrated in the cloud, avoiding potential bottlenecks in the local HW. It is also worth noting that all platforms and all models of CloudGen Firewall offer the same level of security and maintain maximum protection whether in a branch office, in the central office or in the corporate data center in the cloud.

Packed with over 30 layers of protection technologies, GravityZone Ultra is Bitdefender’s premier security suite, providing security analysts and incident response teams with the tools they need to analyze suspicious activity and investigate and respond appropriately. advanced threats.

It puts the focus on protecting endpoints by constantly scanning endpoints for misconfigurations and making recommendations to reduce the attack surface. It also provides workers with a single console with a single agent for all features, including patch management, firewall, encryption, application control, content control. In addition, the following optional modules are proposed: Patch Management, Security Advanced Email and Data Protection to streamline security processes and reduce response time to incidents.

Based on a simple architecture, Bitdefender GravityZone Ultra Suite covers physical, virtual and cloud deployments, blocking most attacks in the pre-execution phase. It does this before they affect the system thanks to real-time process inspection with machine learning and built-in automated sandbox analysis. For its part, the threat analysis module works in the cloud and continuously filters behavioral events in system activities to create a prioritized list of incidents worthy of further investigation and response.

Fortinet FortiGate

It incorporates data leak prevention software to detect possible breaches and exfiltration attempts. It is available in different versions.

The hallmark of UTM appliances is their all-in-one security approach, making them an ideal solution for organizations with network and security requirements, but limited IT staff and resources. This unique approach was so successful that it became the foundation for the development of today’s next-generation firewall market where Fortinet has more than two decades of experience.

Already today, by combining the next-generation security of FortiGate firewalls with FortiAP and FortiSwitch unified access solutions – all centrally managed by FortiCloud or FortiManager – the manufacturer’s UTM solutions adapt to the needs of each organization . 

Within this context, the natural evolution of the UTM concept, based on the integration of solutions, is the development of the Security Fabric, an architecture that responds to the new challenges posed by the digital economy by integrating traditionally autonomous systems into a single architecture designed in based on five critical and independent attributes: scalability, knowledge, security, processing and openness.

In the UTM market, Fortinet offers several solutions that provide an organization with the type of protection it needs. FortiGate is a next generation firewall equipped with all the capabilities of a UTM. It also has anti-malware capabilities, allowing it to scan network traffic (both incoming and outgoing) for suspicious files. In addition, the Fortinet UTM has an IPS that protects the network against attackers trying to break into it. If a malicious element attempts to ‘exploit’ a security vulnerability, the FortiGate IPS can detect the intrusive activity and stop it dead in its tracks.

ESET Dynamic Threat Defense

This cloud security sandbox provides an additional layer of defense outside of the network. Prevent ransomware from running in production environments.

The solution with which the Slovak firm is participating in this article provides an additional layer of security for ESET products such as Mail Security and the Endpoint range: it does so by using its cloud sandbox technology to detect new types of threats. Specifically, this sandbox consists of multiple types of sensors that complete static code analysis, deep sample inspection using in-memory analysis, and behavioral detection.

Also machine learning. To do this, it employs three different machine learning models when sending a file. It then runs the sample in a sandbox that simulates user behavior by ‘fooling’ anti-circumvention techniques, and then employs a deep learning neural network to compare observed behavior against historical behavioral data. Finally, the latest version of ESET’s scanning engine is used to pull everything apart and scan for any anomalies.

Each analyzed sample is added to the ESET PROTECT On-Prem console list with various information about the sample itself and its origin. But it reflects not only the samples sent to ESET Dynamic Threat Defense, but everything sent to the cloud malware protection system, ESET Live Grid.

From a technical point of view, it provides automatic protection. Thus, when everything is configured, no action is required from the administrator or the user. It is the product for a computer or server that automatically decides if the sample is good, bad or unknown. If the sample is unknown, it is sent to ESET Dynamic Threat Defense for analysis. When the scan is complete, the result is shared and the endpoint products respond accordingly.

Sophos-firewall

Its features include encrypted traffic, deep packet inspection, cloud sandboxes, and user identity-based policies.

Last April, Sophos welcomed its new XGS firewalls that improve performance and advanced protection against cyber attacks. They also have the TLS transport layer, including its native support for TLS 1.3. It is also worth noting the important update that the manufacturer has made in this recently released series from the point of view of hardware.

Going into detail, and thanks to the Xstream architecture of Sophos Firewall, the XGS family devices offer protection against zero-day threats, identifying and stopping not only the known ones but other more advanced potential ones, including ransomware. This protection is ‘powered’ by powerful threat intelligence, available only through SophosLabs Intelix (a type of platform) and based on petabytes of SophosLabs threat data. Thus, suspicious files are securely ‘detonated’ in SophosLabs Intelix virtual environments and subjected to in-depth static analysis for extra detection coverage and information gathering.

Meanwhile, the new Xstream stream processors inside the devices automatically accelerate trusted traffic such as software as a service (SaaS), software-defined wide area network (SD-WAN) and cloud applications, providing the maximum space for traffic that requires TLS and deep packet inspection. This greatly reduces latency and improves the overall performance of important business applications, especially those that use real-time data. Additionally, Xstream stream processors are software programmable, allowing Sophos to offload additional traffic in the future.