Managed Security Services

Fire-Proofing Your Network With UTM,
Part 2: Deploying a UTM appliance — continued

by Lisa Phifer VP Core Competence, Inc. [December 28, 2007]

What's going on?
Anyone who has ever managed a firewall knows the importance of traffic logging and analysis. Ideally, UTM products should make it easier to eyeball dangerous traffic and understand whether and how your deployed defenses actually responded.

Without UTM, you might be forced to sift through several independent event logs, trying to correlate traffic that slipped through your firewall with alerts reported by your IDS and worms detected on servers. With UTM, you can review firewall and IPS and anti-X alerts by looking in just one place.

Here again, the degree of unification varies. UTM events are time-stamped by the same clock and written to the same local log (or sent to the same mailbox or SYSLOG server). But many UTM products incorporate third-party anti-X engines, such as Sophos anti-virus, Symantec anti-spam, or WebSense URL filters. Even when third-party engines are bolted into the same UTM appliance and GUI, they can still trigger independent events.

For example, all alerts generated by each MX1004 service are written to the same log and share the same overall structure, but they differ in detail—even hot-linking to different websites. It is not always easy to tell when multiple alerts were caused by the same incident, but scrolling through all events in time-sequence can be a big help (Figure 2-6). On the other hand, event configuration is disjoint—detailed alert and summary settings must be established independently for each service (Figure 2-7).

Coming up next
Once a UTM appliance has been successfully installed and you understand how basic firewall and perhaps IPS policies are being enforced, it is time to start taking advantage of all those additional security capabilities. To demonstrate the benefits and limitations of UTM anti-X services, Part 3 of this series will dig into the MX1004's network-based threat management features. Stay tuned...

—End

< Back to Part 2, page 1