UTM appliances have quickly gained in popularity, partly because the all-in-one approach simplifies installation, configuration and maintenance. Such a setup saves time, money and people when compared to the management of multiple security systems. Instead of having several single-function appliances, all needing individual familiarity, attention and support, network administrators can centrally administer their security defenses from one box. Also, the multiple functions of UTM appliances have made it easier to convince management to replace older, more basic firewalls that cannot evaluate application-layer traffic.
A more recent UTM feature is the ability to inspect all network traffic, including encoded, compressed, encrypted and wireless traffic. Other newer enhancements include strong authentication controls as well as traffic anomaly detection. UTM's popularity will surely cause vendors to add new defense features. I can see extended log-analysis mechanisms, such as behavioral analysis of network traffic, becoming a common feature soon.
When you are evaluating a UTM, it is important to ensure that the device's different functionalities fulfill all of your security policy requirements. It's also important to make sure that the appliance is easy to use and keep up-to-date. Do not get caught up in the sales and marketing hype that tends to surround a lot of products in this area of network protection.
One drawback of an all-in-one device like a UTM is that it creates a single point of failure on your network. Should the product go down, it can create a major cap in your defensive posture. Good UTMs, however, have failover features that can allow connections to a secondary gateway if the primary one becomes unavailable. Effective UTMs also have plenty of processing power, so production won't be hindered when the devices look for both application-layer and content-based attacks. Some have predicted that purely software-based enterprise UTMs would emerge, but because they need to run on purpose-built security devices with a hardened operating systems designed to handle the role of real-time protection and control, I consider this scenario unlikely.
This was first published in May 2007