Five Questions to Ask Security Appliance Vendors

CIO — Everyone has jumped on the security appliance bandwagon, but before you make the move to security appliances, be sure to carefully consider your options. You want an innovative solution that truly safeguards your network, but if you don't know what questions to ask a potential vendor, you could wind up buying "point" products that only complicate your network architecture.

Why Appliances Became Popular

To understand our current predicament, you first have to understand the two key business drivers that have created strong demand for security appliances.

First, appliances are simple to plug into your network and deploy. Generally speaking, all the software comes preloaded and, in many cases, the systems include plug-and-play configuration tools. It's not as simple as plugging in a toaster, but gone are the days of complex security software that require you to master Unix command lines and in-depth IP information. Point. Click. Configure. Done.

Second, appliances are purpose-built. They are designed around hardened operating systems. While general-purpose operating systems like Windows or Unix come packed with hundreds of different services you can leverage, each service provides another potential window or doorway for a hacker to exploit. It's a trade-off: The more services you want to run, the greater the risk you might experience a software exploit.

By contrast, a hardened operating system doesn't have any nonessential services. For example, you don't need FTP or Telnet capabilities in an e-mail security appliance. You wouldn't put fancy windows, skylights and breezeways in a fortress. Similarly, prudent security appliance makers strip away all nonessential services from their operating system of choice (typically Unix or Linux). As a result, there are far fewer weak links for a hacker to exploit.

The trend toward appliances began in the late 1990s, as businesses tried to simplify their existing client and server systems while simultaneously entering the Internet age. As e-mail, browsers and Web servers became ubiquitous, traditional corporate barriers disappeared. Businesses needed a simple—yet effective—way to establish virtual borders. Security appliances soon tried to fill that void.

Today, there's no doubting the popularity of the appliance model. By 2008, a stunning 80 percent of security solutions will be sold as appliances, according to International Data Corp. (IDC is a sister company of CIO.com's publisher.)

Point Products Can Introduce New Problems

Unfortunately, businesses are beginning to discover that many of these new appliances are causing the very complexity they were designed to eliminate. One frustrated CIO at a Fortune 100 company tells me his organization has 13 different e-mail security point products at a single Internet gateway: One has spam filtering, another is an antivirus system, another provides content filtering, then there's the encryption appliance...and the list goes on and on.

Each appliance requires a different trained expert to manage and oversee the system. We didn't mean to do it, but in some ways we're reverting to the complex client/server systems in the 1990s. Client/server was a wonderful concept, but poor planning prompted many businesses to deploy a wide range of server standards—NetWare, Unix, Banyan Vines, OS/2, Windows and the list went on. The complexity was even worse on the desktop, where frequent application upgrades forced IT to reconfigure and troubleshoot PCs over and over again. Businesses wound up spending far too much time managing their servers and desktops, rather than deploying innovative applications.

The situation is now similar in the security market, where many corporations spend endless hours troubleshooting a range of appliances that weren't designed to work with one another.

What to Look For

Thousands of businesses have spent the last five years or so building out appliance-based security fabrics, yet many of the threads within that fabric won't stand the test of time: Will the small company be bought by someone else and will that new owner continue development on the product? Will the company go bankrupt and leave your IT staff responsible for ongoing support?

Continue Reading