Five Questions to Ask Security Appliance Vendors

Everyone has jumped on the security appliance bandwagon, but before you make the move to security appliances, be sure to carefully consider your options. You want an innovative solution that truly safeguards your network, but if you don’t know what questions to ask a potential vendor, you could wind up buying “point” products that only complicate your network architecture.

MORE ON Vendor Management

ABC: An Introduction to Vendor Management

Why You Should Create a Vendor Management Office

ABC: An Introduction to Service-Level Agreements

Why Appliances Became Popular

To understand our current predicament, you first have to understand the two key business drivers that have created strong demand for security appliances.

First, appliances are simple to plug into your network and deploy. Generally speaking, all the software comes preloaded and, in many cases, the systems include plug-and-play configuration tools. It’s not as simple as plugging in a toaster, but gone are the days of complex security software that require you to master Unix command lines and in-depth IP information. Point. Click. Configure. Done.

Second, appliances are purpose-built. They are designed around hardened operating systems. While general-purpose operating systems like Windows or Unix come packed with hundreds of different services you can leverage, each service provides another potential window or doorway for a hacker to exploit. It’s a trade-off: The more services you want to run, the greater the risk you might experience a software exploit.

By contrast, a hardened operating system doesn’t have any nonessential services. For example, you don’t need FTP or Telnet capabilities in an e-mail security appliance. You wouldn’t put fancy windows, skylights and breezeways in a fortress. Similarly, prudent security appliance makers strip away all nonessential services from their operating system of choice (typically Unix or Linux). As a result, there are far fewer weak links for a hacker to exploit.

The trend toward appliances began in the late 1990s, as businesses tried to simplify their existing client and server systems while simultaneously entering the Internet age. As e-mail, browsers and Web servers became ubiquitous, traditional corporate barriers disappeared. Businesses needed a simple—yet effective—way to establish virtual borders. Security appliances soon tried to fill that void.

Today, there’s no doubting the popularity of the appliance model. By 2008, a stunning 80 percent of security solutions will be sold as appliances, according to International Data Corp. (IDC is a sister company of CIO.com’s publisher.)

Point Products Can Introduce New Problems

Unfortunately, businesses are beginning to discover that many of these new appliances are causing the very complexity they were designed to eliminate. One frustrated CIO at a Fortune 100 company tells me his organization has 13 different e-mail security point products at a single Internet gateway: One has spam filtering, another is an antivirus system, another provides content filtering, then there’s the encryption appliance…and the list goes on and on.

Each appliance requires a different trained expert to manage and oversee the system. We didn’t mean to do it, but in some ways we’re reverting to the complex client/server systems in the 1990s. Client/server was a wonderful concept, but poor planning prompted many businesses to deploy a wide range of server standards—NetWare, Unix, Banyan Vines, OS/2, Windows and the list went on. The complexity was even worse on the desktop, where frequent application upgrades forced IT to reconfigure and troubleshoot PCs over and over again. Businesses wound up spending far too much time managing their servers and desktops, rather than deploying innovative applications.

The situation is now similar in the security market, where many corporations spend endless hours troubleshooting a range of appliances that weren’t designed to work with one another.

What to Look For

Thousands of businesses have spent the last five years or so building out appliance-based security fabrics, yet many of the threads within that fabric won’t stand the test of time: Will the small company be bought by someone else and will that new owner continue development on the product? Will the company go bankrupt and leave your IT staff responsible for ongoing support?

Look for a Web security gateway that provides bidirectional traffic protection. The solution should protect enterprises from malware, data leakage and Internet misuse, while ensuring policy enforcement, regulatory compliance and a productive application environment. And make sure the appliance continually learns about emerging Internet threats through the vendor’s own global network of intelligent devices.

You should also select a secure messaging gateway that provides security across multiple messaging protocols, including e-mail, instant messaging and Web mail. The gateway should leverage the vendor’s own global network of intelligent devices to proactively uncover spam, phishing attacks, DDoS (distributed denial of service), viruses, zombies and Trojans.

Finally, choose a network gateway security solution for firewall and application-layer protection. The gateway should provide secure network access, protect Internet-facing applications, block viruses, spyware and spam, and create a forensic-quality audit trail for regulatory compliance and reporting.

Some pundits may be tempted to roll all three of these security gateways into a single “God box.” But as you start to roll all capabilities into a single box, performance can lag. An e-mail gateway, for instance, is store-and-forward and doesn’t need to offer subsecond response time. People won’t notice if an e-mail’s delivery lags for 30 seconds or longer. A Web gateway appliance, on the other hand, may require nearly real-time performance.

Practical experience and satisfied customers assert that the best solutions-oriented approach is to leverage Web gateway security appliances, messaging gateway security appliances and network gateway security appliances in tandem for multilayer security.

And remember, as you scan the market for options, be sure to investigate the financial health, stability and potential for the growth of each company.

Interview appliance vendors much in the way you would interview a job candidate, potential business partner or prospective college for your kids.

• Do they have financial staying power?
• How many engineers and PhDs do they have in order to keep up with rapidly evolving security threats?
• Who are their partners within the IT ecosystem? (Then, talk to those partners)
• Who are their existing customers? (Talk to a few)
• How do their systems snap together?

Just remember, with a little foresight and these questions, you won’t make a decision you’ll regret later on.

Daniel Ryan is president and chief operating officer of Secure Computing Corp.

Editor’s note: Caveat columns are written by vendors knowledgeable about the topic presented. However, the vendors often have a stake in the technologies used to solve the problems discussed. Caveat emptor!