Defense in depth and unified threat management appliances
Defense in Depth, Intrusion detection, Midmarket security, Single Point of Failure, Unified Threat Management
Experts tout unified threat management appliances as an ideal antimalware, intrusion prevention and content filtering firewall for midmarket companies. But doesn't this counter the long-standing security practice of defense-in-depth? With a one vendor, platform, and management console, aren't we talking about a dangerous single point of failure?
When is UTM good enough? When should we go with standalone devices?
Software/Hardware used:
Software/Hardware used:
ASKED:
May 7, 2009 7:01 PM
UPDATED:
May 8, 2009 5:19 PM
Answer Wiki:
Actually it is defense in depth even though they are all contained on one appliance or device. Think about the layers in a bullet proof vest. They each work in tandem to prevent damage to the person wearing it. However just one type of layer by itself would likely not be enough protection against certain firearms.
Granted it is a single point of failure, but the ability to manage an entire suite of services from one console is attractive to many smaller organizations that may not be able to provide the care and feeding of single purpose devices. The ability of a vendor to patch the entire product suite against vulnerabilities is another good reason to go to a UTM device. If using multiple devices from different vendors, then the vulnerability exposure could potentially be greater if one vendor addresses a vulnerability in their appliance/service but another does not.
I would go to standalone devices if the potential threat to my organization could create capacity/performance issues on the UTM device.
In the IT trenches? So am I - read my <a href="http://itknowledgeexchange.techtarget.com/it-trenches">IT-Trenches blog</a>
To see all answers submitted to the Answer Wiki: View Answer History.
This is definitely a single point of failure but it may be worth the risk given the overhead of managing multiple systems like Labnuke99 says. Everyone’s situation is unique but I recommend this type of system to SMBs quite often.