The security channel is wonderful about getting on board with technologies that customers really need. Why? Because when you live on gross margin, you get no dog yummies for jumping on technologies without mass-market relevance. If you don't sell anything, you don't get paid. That's clear enough, no?
So many VARs have been tracking the adoption of unified threat management (UTM) gear and trying to figure out the right time to throw down. This has become increasingly difficult to determine because, as with pretty much every other security technology, the term UTM means something different to everyone.
Requires Membership to View
To gain access to this and all member only content, please provide the following information:
By submitting your registration information to SearchSecurityChannel.com you agree to receive email communications from the TechTarget network of sites, and/or third party content providers that have relationships with TechTarget, based on your topic interests and activity, including updates on new content, event notifications, new site launches and market research surveys. Please verify all information and selections above. You may unsubscribe at any time from one or more of the services you have selected by editing your profile, unsubscribing via email or by contacting us here
- Your use of SearchSecurityChannel.com is governed by our Terms of Use
- We designed our Privacy Policy to provide you with important disclosures about how we collect and use your registration and other information. We encourage you to read the Privacy Policy, and to use it to help make informed decisions.
- If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States.
 |
||||
|
|
|||
|
||||
Vendors have definitions that sound remarkably like whatever product they "used" to sell -- like firewalls and/or IPS gear. Nearly every vendor says they do UTM now. Users are similarly interested in that they figure they've found a new way to save some money, so they're likely to want to throw everything, including the kitchen sink, into the mix.
So what's a reseller to do? I'm always a fan of taking a step back and examining the user need. Then you can get into specific architectures, decision criteria and ultimately who you want to do business with. But never put the cart in front of the horse. Remember, no demand -- no gross margin -- no paycheck.
The good news is that there is a real need for UTM technology, especially in the mid-market. Mid-sized enterprises have been fed a constant diet of increasingly narrow security technologies to solve terrifyingly narrow problems. They are now rebelling. They don't want another box to solve another problem. They want leverage. They want simplicity. They want integrated management capabilities. And they want it now.
Many customers are willing to replace their existing gear because the ROI of a new box is pretty clear when compared to maintenance renewals and 24/7 support contracts on five or six disparate security products.
So this begs the question, what's in a UTM product? That depends on who you ask, but basically you'll see the following components:
- Firewall/VPN (SSL and IPSec)
- IDS/IPS
- Gateway antivirus and antispyware
- Antispam
- Web filtering/Content filtering
Vendors may also increasingly add Web application firewall capabilities as that market matures. So basically UTM is one box to replace all of the mayhem currently sitting in the customer's DMZ.
To be clear, there isn't a lot of differentiation between the products. According to the data sheets, a UTM is a UTM is a UTM. So when you're trying to decide which vendor to pick, your decision will come down to a few key issues:
- Scalability -- Do you cater to the SMB or enterprise? For the most part, scalability isn't an issue for SMB customers, and for larger customers the architectural differences between products become clear once all of the UTM features are turned on (especially IPS and content filtering).
- Hardware vs. software -- UTM vendors fall into either the purpose-built hardware or software-on-appliance camps. Traditionally, hardware-based solutions (with their own custom chips) have scaled better but tended to be less flexible in adding new capabilities. As the market evolves, these generalizations may not hold, so I recommend you take the solutions you're considering into your lab, and put them to the test. That's the only way for you to really know what'll work for you and your customers.
- Open-source vs. proprietary -- There are some solutions that are largely based on open source technology wrapped in a pretty interface. Other vendors have built all their own stuff.
Ultimately, the vendor(s) you choose will be largely driven by the technologies your customers already have. Changing vendors is risky and usually involves learning a new interface and maybe sacrificing some functionality. That adds friction to the sales cycle. We don't like friction -- it impacts margins.
So if your customer base is largely Cisco, Juniper or Check Point, you pitch the customers first on that solution. In the event the customer hates the incumbent (which is a real possibility), then bring a hardware-based solution (like Fortinet or SonicWall) and a software + appliance solution (like Astaro) to the table. Let the customer decide what is more important to them. Larger enterprises will be interested in modularity and flexibility, so Crossbeam is usually a good fit -- in addition to the typical incumbents.
But get familiar with UTM and do it now. If you don't I can guarantee your fellow VARs will be.
About the author
Mike Rothman is president and principal analyst of Security Incite, an industry analyst firm in Atlanta. Read his blog at http://feeds.feedburner.com/securityinciterants, or reach him via e-mail at mike.rothman (at) securityincite (dot) com.
This was first published in January 2007