Cyberoam UTM vs. CISCO ASA 5500 Series CISCO ASA: Provides

Transcription

Cyberoam Certifications
Cyberoam UTM
vs.
CISCO ASA 5500
Series
CISCO ASA:
Provides Choices and not
a Total Solution.
Westcoast Labs Checkmark Certification:
UTM Level 5
Categories:

Enterprise Firewall

VPN

Anti-Virus and Anti Spyware Gateway

Premium Level Anti-Spam

IPS

URL Filtering
ICSA Certification
Category:
Corporate Firewall with Active- Active High Availability
Awards
Choose between:
• Content Security
Or
• IPS
There is only one
available slot per chassis
in ASA 5500 series. So
the user can either deploy
IPS, or content and virus
filter, not both
Cyberoam UTM’s identitybased access
management paradigm
offers the eighth layer of
security, even in DHCP
and Wireless
environments.
www.cyberoam.com
Winner of 2008/2009 ZDNet Award
Category:

IT Leader

Asia's Most Promising Asian TechnoVisionaries
Winner of 2007 Global Product Excellence Awards Customer Trust Category:

For Integrated Security Appliance

For Security Solution for Education

For Unified Security
Product Review

SC Magazine : Cyberoam UTM Overall Rating:
ÌÌÌÌÌ - 5 Stars
•
PC PRO Recommended : Cyberoam CR15i UTM
Overall Rating: ÌÌÌÌÌÌ - 6 Stars
Cyberoam UTM is Certified by Virtual Private Network
Consortium (VPNC) :

Basic Interop
AES Interop
SSL Portal
SSL Firefox
SSL Java Script
SSL Basic Network Extension

SSL Advanced Network Extension
Cyberoam in Numbers
World wide Presence
Deployed in 90+ countries
Number of Anti Virus Signatures
1.5 Million
Virus Detection Rate
98.46%
Spam Detection Rate
98%
False Positive Rate
1 in One Million
Number of URL categories
82+
AIP (IPS) or CSC (Content and Virus Filter) - Choose Only One
Adaptive Security Appliance (ASA) series comprises new hardware line which funnels VPN acceleration, antivirus, anti-spyware, intrusion prevention and DoS (denial of service) protections into one device. The products
were developed with technologies plucked from the firm's stable of security gear including the IPS 4200 intrusion
prevention appliance, the VPN 3000 concentrator and the firm’s PIX Firewall. It has Trend Micro’s anti-X - antivirus and network quarantine technology based on Cisco’s Network Admission Control (NAC) multi-vendor effort.
The ASA series is plagued by one major limitation. There is only one available slot per chassis; it is not possible
to deploy both; Advanced Inspection and Prevention (AIP) Module and Content Security and Control (CSC)
Security Services Module. The AIP Module is responsible for IPS whereas the CSC Module is responsible for
content security.
In other words, one Adaptive Security Appliance (ASA) is not able to run both IPS and Content Security
simultaneously. This is a serious drawback due to hardware based security modules.
With just one additional security module running the throughput is bound to be good at the cost of
security.
Cyberoam: User Centric Security Approach
•
•
•
•
•
Who do you give access to: An IP Address or a User?
Whom do you wish to assign security policies: User Name or IP Addresses?
In case of an insider attempted breach, whom do you wish to see: User Name or IP Address?
How do you create network address based policies in a DHCP and a Wi-Fi network?
How do you create network address based policies for shared desktops?
Cyberoam UTM approaches the Security paradigm from the identity perspective. The blended threats circumvent
the perimeter defense and launch an attack from within. The network’s own resources are used to subvert it. The
main target is thus the end user who knowingly or unknowingly breaches the perimeter defense.
While providing a robust perimeter defense, Cyberoam’s Identity-based access control technology ensures that
every user is encapsulated in a tight, yet granular security policy that spans across Cyberoam’s Firewall/VPN,
Gateway Anti Virus, Anti-Spam, Web Filtering, Intrusion Prevention Solution (IPS) and Bandwidth Management
solutions.
Major Drawbacks of ASA 5500 Series
•
Insufficient use of Identity as a Control Parameter
Like many other firewalls, ASA 5500 only provides authentication with internal /external databases but it does not
use identity as a matching criteria in firewall rules. This seriously limits the flexibility of the security solution.
•
Self Limiting Approach – Mutually Exclusive Hardware Security Solutions
This is a major drawback in the ASA series. AIP and CSC security modules are hardware based. AIP deals with
IPS, while CSC module is responsible for content filtering, anti-spam and anti virus. There is just one expandable
slot per chassis. This means that at any given point of time ASA is either equipped with AIP or CSC. The user
cannot deploy both the modules simultaneously. This leaves a gaping hole in the security.
•
No Bandwidth Management
ASA 5500’s Traffic Policy management and QoS degrade the throughput of the appliance. Hence, by default,
they are disabled. Moreover these services are limited to the VPN module only.
•
No Multiple Gateways, Link Fail-Over and Load Balancing Support
ASA 5500 series only supports Multiple Gateways, Link Fail-Over and Load Balancing for the VPN module. Other
modules are not supported by these features.
Let us look at these and some other ASA 5500 features in comparison with Cyberoam UTM.
Head to Head Comparison
Points to Ponder
Cisco ASA 5500
Cyberoam UTM
Enhanced Firewall Decision
The firewall component is picked
Cyberoam, in a paradigm shift, extends
Matrix:
from Cisco PIX. It is a good
the firewall’s rule matching criteria to
Firewall is a primary security
firewall that stops short of
include schedule and the user’s identity.
component in network security.
recognizing a user. Identity is an
Similarly, the firewall actions are
external component used for
extended to include complete policy
authentication only.
based control over all the security
A normal decision matrix in a
firewall stops at the IP address of a
solutions like, content filtering, IPS,
machine.
Internet access management,
In the blended threat scenario,
bandwidth management and anti-virus
social engineering is used to target
and anti-spam scans.
the weakest link – end user. So a
user’s identity becomes an
important decision and control
parameter in the firewall matrix.
State-of-Art Identity-based
ASA 5500 does not have this
Cyberoam’s identity-based access
Access Management:
feature.
management feature provides
IAM is a combination of Identity,
unparalleled flexibility, security and
time scheduling and access
control to the network administrator
management. This is a powerful
over the end user.
control mechanism which reaches
down to all the security solution in a
UTM. Identity and time schedule are
the two dimensions used to define a
user’s real time identity in a security
solution.
Adaptable AV/AS Scans:
ASA 5500 does not have such
Cyberoam UTM has an OEM license
For most users, missing a legitimate
granular control over its virus and
from Kaspersky’s Gateway AV.
email is an order of magnitude
spam scans.
Using Cyberoam UTM you can define
worse than receiving spam or virus.
It has anti-X from Trend Micro.
custom spam filtering rules based on
To avoid such an unpleasant
sender or recipient, IP address, mime
situation you need to control the
header and message size.
parameters used to classify a mail
Cyberoam UTM also utilizes
as virus infected or spam and the
configurable RBLs for complete anti-
action taken thereafter. User-based
spam coverage.
customized scans can ensure that
You have the flexibility to configure a
not a single mailed business
scan as per your needs, rather than
opportunity is lost to security.
adjusting yourself to the way a security
solution operates.
Points to Ponder
Cisco ASA 5500
Cyberoam UTM
Security Over Mail Protocol
ASA 5500 scans SMTP and
Cyberoam UTM covers the full protocol
Spectrum:
POP3, but does not support
spectrum which includes SMTP, POP3
Email is one of the most potent
IMAP protocol.
and IMAP. It also provides you the
vectors that affect security and
ability to scan and block the widest
business. While mail with a
range of attachments.
malicious payload is the single
This ensures seamless business
largest threat to security; mails are
continuity and complete protection in
the single largest medium to
case of a Zero Day Vulnerability.
conduct business. Hence the mail
protocol spectrum – SMTP, POP3
and IMAP should be continuously
monitored for blended threats.
Self-service AV Quarantine Area:
ASA 5500 does not have a
The Self-service quarantine area from
Quarantine area is a safe holding
quarantine area.
Cyberoam UTM enables individual mail
area for all suspicious/ infected files.
recipients to view and manage their
This allows organizations to remove
infected messages.
infected files from general
The self-service feature removes user’s
circulation without deleting them.
dependency on administrator to
A gateway quarantine area should
manage quarantine mails.
be self-service as there are a large
number of users involved. So the
users ought to get notified that a
mail has been quarantined and he
can access and deal with it without
depending on the administrator.
Identity-based IPS Policies and
ASA 5500 does not support this
Cyberoam UTM provides IP address
Reporting Ensures Transparency:
feature.
and User-based reports. Providing
To deploy security policies the
complete visibility, it thwarts anonymity
administrator has to know his target.
in DHCP, Wireless and Computer
IP addresses are not target enough.
sharing environments.
The most harmful intrusion attempts
In case of threat detection; it reduces
are attempted from inside a
the administrator’s reaction time. The
network. In IP address based IPS
administrator can personally contact the
policies and reporting the identity
erring user.
gets lost.
Identity based policies also lends
To ensure complete transparency in
unprecedented granularity to the IPS
a network, the IPS policies and
policies.
reporting should also take the user’s
identity into its ambit.
Points to Ponder
Cisco ASA 5500
Cyberoam UTM
Identity-based Tunable IPS
ASA 5500 does not support this
Cyberoam UTM provides the
Policy:
feature.
administrator with the ability to attach
Blanket policies, over time force the
an individual IPS policy to a
administrator to open security loop
combination of source, destination,
holes.
application, identity and schedule.
Customized policies provide you the
This ensures customized IPS policy as
comfort to deploy customized IPS
per your needs.
policies as per your needs.
Cyberoam UTM also provides you the
Custom IPS signatures reach
facility to use custom IPS signatures.
deeper than a firewall and antivirus
These features ensure that your
to protect the network from blended
network security is geared up meet any
threats.
exceptions as well as general threat
conditions.
User and Policy based Bandwidth
ASA 5500 provides IP address
Cyberoam UTM provides user and
Management:
based bandwidth management
policy based bandwidth management.
A Bandwidth management solution
support for its VPN solution only.
It also provides individual upstream and
should provide the flexibility and
downstream bandwidth control.
power for policy based bandwidth
Using Cyberoam UTM you can provide
management in the complete
QoS to a combination of source,
network.
destination and service/service group
by committing bandwidth to users,
applications and servers based on time
schedules.
Cyberoam UTM has user-wise
bandwidth distribution and control over
bandwidth usage individually both:
Upstream and Downstream
User and Schedule Based Web
ASA 5500 is not equipped with
Cyberoam UTM has the ability to club
Filtering Solution:
user and schedule based
Internet access management and Web
Web filtering is not mere allowing
granular control over its content
filtering to achieve policy and schedule-
and blocking of internet access.
filtering solution.
based intelligent Web filtering.
Most successful Web filtering
It’s not equipped with an On
Cyberoam UTM’s On Appliance
solutions have:
Appliance content filtering
proprietorial URL database called
Schedule and Identity based Web
database.
WEBCat is 60+ categories strong with
Filtering
millions of URL categorized within it.
HTTP Based File Upload Control
Using Cyberoam UTM you can control
Logging Web Searches
all uploads over HTTP and log all
search performed on the Web.
Points to Ponder
Cisco ASA 5500
Cyberoam UTM
Phishing and Pharming
ASA 5500 has Phishing
Cyberoam UTM protects against
Protection:
protection, but lacks any
Phishing and Pharming, both. Its
Phishing and Pharming are the next
protection against Pharming.
WEBCat database has a
generation threats instigating the
comprehensive category dealing with
end users to breech the network
Phishing site.
security from within. Phishing is a
In case of a host file corruption due to a
passive baiting through mail and
Pharming attack, the DNS configured in
Pharming is an active process of
Cyberoam UTM makes sure that the
host file corruption which leads the
user is not directed to a malicious site.
user unknowingly to a malicious
site.
Control file transfer Over IM
ASA 5500 provides blanket file
Cyberoam UTM’s application filtering
Prevents Loss of Confidential
control blockage policies.
solutions is powerful enough to control
Information :
file transfer over any IM application.
Unmonitored content leaving an
Identity can be used as a control
organization through an IM
parameter in these control policies.
application introduces security, legal
and competitive risk. It is difficult for
the IT department to discover
potential breaches of policy or to
hold individuals accountable.
User Identity Based
Cyberoam UTM has an on appliance
Comprehensive Reporting:
feature.
integrated reporting module which
Reports are an integral part of any
provides IP address and user identity
security solution as they are the
based in-depth reports.
tools to provide visibility.
All reports are HTTP/HTTPS based,
Clear and precise reports are the
and so are platform, location and client
most valuable tool that makes sure
independent.
that organization’s resources are
productively focused.
Data Transfer Accounting and
Cyberoam UTM provides a
Control:
feature.
comprehensive, application and user
Data transfer accounting and control
based data transfer accounting and
helps you see the actual bandwidth
control.
consumption by an individual or an
This feature comes in handy in
application. This feature also helps
educational institutions where Internet
find the exact Internet usage costing
consumption per individual is important.
in case of fixed data transfer quotas.
Points to Ponder
Cisco ASA 5500
Cyberoam UTM
Gateway Failover and Load
ASA 5500 has a limited feature
Cyberoam UTM supports multiple links
Balancing:
for VPN only.
and load balancing over them too.
In case of multiple ISP links, a
Cyberoam UTM’s gateway failover
failover solution is indispensable.
supports complex rules to check the
However the criteria for classifying
network status of a particular
an ISP link as “non-working” are
application.
critical. There are times that a
Cyberoam UTM can detect and mange
mission critical application is
a link failure for the true use of Internet.
unreachable through a specific ISP
link, while the same is reachable
through the other one.
In this case the failover solution
should take over.
In case of multiple gateway support,
load balancing is indispensable.
Automated Single Sign-On
Cyberoam UTM supports external ADS,
Support:
feature.
PDC, LDAP and Radius; and internal
Automated Single sign-on is the tool
(database of users created in the UTM)
to identify a user in a security
Cyberoam UTM based authentication.
system. It not only automatically
authenticates a user, but also
creates a single security bubble
which can be audited and secured.
Disclaimer:
Confidential, intended for internal circulation only.
The comparison is based on our interpretation of the publicly available information of the compared product.
Either of the product features is likely to change without prior notice.
Document Version: 4.0 – 96016 - 26062009