New SonicWall TZ Series Firewall

/0 Comments/in /by

GROW BY LEVERAGING THE WEB is today’s small and medium business rally call. But, it is the echo to the call that you need to pay attention to: as you open the internet door wider, you are also opening the door for more cyber-attacks. Protection does not have to break the bank or leave you up at night. With the new SonicWall TZ Series Firewalls, you can get a better firewall that performs at faster broadband speeds at a low total cost of ownership.

The new SonicWall TZ is better.

There is no reason why your firewall does not have the same protections that big business demand. The thinking behind all our network security products is to not cut corners when it comes to inspecting traffic. We inspect the whole file, no limits on file size, the port or protocols being used. The new TZ offers 1 GbE network interfaces and gives you the type of protection that big businesses, large universities and government agencies enjoy. Now, you can impress your big business partners with enterprise grade protection with anti-malware, intrusion prevention, content and URL filtering, application control and secure mobile access.

The new SonicWall TZ is faster.

Faster broadband is the starting point, then, you want faster wireless. To accomplish this, your firewall needs lots of horsepower. The SonicWall TZ has plenty. Designed with the knowledge of the exploding growth in SSL use, the new series has the horsepower to identify malware lurking in encrypted SSL traffic. With an integrated wireless controller, the business does not require additional costs to offer their customers and employees that extreme speeds that 802.11ac can deliver.

Product image of the SonicWall TZ Firewall series

The new SonicWall TZ is affordable.

In the past, to meet high speed broadband requirements, business owners would have to pay a hefty price. The new SonicWall TZ300 can deliver full Deep Packet Protection at 100 Mbps broadband speeds for less than a thousand dollars (this TotalSecure bundle includes the Appliance, content filtering, application control, intrusion protection, SSL inspection and antivirus).

The new SonicWall TZ is the new solution for small and medium businesses

Don’t let cybercriminals compromise your organization. The new SonicWall TZ can solve your performance and security requirements at a price that does not break the bank. For more information, take a look at the SonicWall TZ Series Data Sheet that gives you the details on this great new product.

Download Datasheet

A Giant Step Forward for Small Business with New SonicWall TZ

/0 Comments/in , /by

Security has not kept up with the improvements in delivery and pricing of broadband speeds. This is especially true with smaller organizations. When these smaller organizations are compromised, they often go out of business.

Larger organizations are also at risk: just look at the news. I keep thinking back to a June 11, 2014 article in USA Today asks, “Is insecurity the new normal?” The article goes on to say that what once captured big headlines has become commonplace. With no end in sight to curtailing the growth of cybercrime, attacks have become chronic. Verizon’s 2014 Data Breach Investigations Report shows a continued upswing in cyber-attacks. Here we are well into 2015 and the wave of breaches continues on. Our goal is to keep networks secure and stay ahead of threats.

Today at Interop in Las Vegas, we announced five new products that can help the distributed enterprises and small and medium business stay ahead of cyber criminals. The new  SonicWall TZ Series of products offers market leading solutions at prices that can fit into tights budgets. The five new firewalls are the SonicWall SOHO, SonicWall TZ300, SonicWall TZ400, SonicWall TZ500 and SonicWall TZ600.

With the SOHO, we are again recognizing that the small office needs to be part of a better security perimeter. The TZ300 and TZ400 are outstanding solutions for the smaller office, whether it is a small business or retail environment. With the TZ500 and TZ600, you get a product that can scale as you grow. The products have the flexibility to meet the special needs of the distributed environment. A SonicWall firewall at the home office with GMS software will allow a centrally managed system to ensure common protection across all locations.

More than ever, small businesses can afford the same security as their larger counterparts. The TZ series recognizes the need to match faster internet connections with security performance that delivers enterprise level security effectiveness. Meeting protection and performance requirements for our customers leads the reason for this refresh.

These are not just about award winning products, but part of SonicWall’s recognition that better security means better business to deliver award winning solutions from the best security team in the industry. With customers who use our new TZ products, you get enterprise grade protection at a price you can afford. With these new products we respond to the dual needs of our customer performance and protection. All of the new SonicWall TZ Series products show exceptional performance and capabilities. In our 2015 SoincWall Security Annual Threat report, we saw a 100 percent spike in growth encrypted SSL traffic. With the TZ300, TZ400, TZ500 and TZ600, the ability to inspect encrypted SSL files will be included in our TotalSecure offer.

For all our products, our design goal is to provide products that inspect the whole file. Unlike our competitors who can only maintain performance by inspecting a limited number of ports, file sizes or protocols like SSL, SonicWall products protect you by not cutting corners with security.

Building a strong security perimeter needs to extend beyond the home office to include branch offices and retail sites. The SonicWall TZ series is part of a tightly coupled security solution when combined with GMS for management and 802.11ac SonicPoints. We offer products at price points that provide any value conscious organization the same level of security effectiveness found in our enterprise products. As you grow, and cybercriminals continue to attack, customers and suppliers rely on  SonicWall to be the strongest link in the security chain protecting from unwanted intrusions, corrupt websites, and hidden malware.

Our products are better: All of our products share the same security engine that earned SonicWall SuperMassive E10800 a recommended rating by NSS Labs.

Our products are faster: Our new products increases both the core count and core speed to further enhance Deep Packet inspection performance without compromising network throughput. Coupled with our new 802.11ac SonicPoints, your wireless communication can reach wired speeds.

Our products continue to be affordable solutions for any size business. Our bundle pricing is an affordable path to broad protection that can be renewed at very affordable rates.

SonicWall has a reputation for providing solutions to meet the needs of any size of business. The new TZ product line joins the NSA and SuperMassive product lines to give any organization, be it a business, a school, a hospital or a government agency state of the art tools to solve their network security needs. As part of the broad SoincWall Security solution that includes identity and access management, patch management and encryption.

Beyond launching new firewalls, SoincWall’s commitment to provide solutions will allow your business to thrive and grow by taking advantage of all the power the internet has to offer with the confidence that you are protected by SoincWall Security.

If you are planning to be at Interop, come visit SoincWall Security at booth 1827. Follow SonicWall Security on twitter @SoincWallSecurity.

Three Reasons to Make The Jump to 802.11ac

/0 Comments/in /by

Back in 2013 we started to hear about the next leap forward in wireless technology, 802.11ac. Then last year, we began to see WiFi-enabled products enter the market that integrated the new standard. Now, it’s getting harder to find the latest laptop, tablet or mobile phone that doesn’t come with 802.11ac as a standard feature. The previous wireless standard, 802.11n, will be phased out in the coming years. Given all this, is it time for your organization to upgrade its wireless access points (WAPs) to models that run 802.11ac?

The crux of the decision comes down to cost versus benefit. How much is it going to cost me to replace my existing WAPs or add new ones to my network? The answer is, it varies. You can purchase a low-end 802.11ac access point for a little over $100. On the other end of the spectrum a higher-end WAP can cost up to $1,000. Why the discrepancy? Pricing is based on the number of radios and antennas, quality of the internal components, software features and a few other factors. If you own a small- or mid-sized organization you probably don’t need all the bells and whistles. There are plenty of solutions that will allow you to take advantage of 802.11ac at a price that makes it worth your while.

Given the cost, what’s so compelling about 802.11ac WAPs that you should consider making the jump? After all, there’s a good chance most of the WiFi-ready devices accessing your network are still using 802.11n. Partly it’s planning for the future. It’s estimated that there will be more than 1 billion WiFi devices based on 802.11ac by the end of this year, and that number will only be going to grow. At some point you’re going to replace those old laptops and tablets and 802.11ac will be the only wireless option on the new devices. But what are the reasons that will really make it worth your while? Here are three.

  • Superior wireless performance – 802.11ac promises up to 1.3 Gbps of wireless throughout, 3x that of 802.11n. It’s likely you won’t see that level of performance since there are many factors that influence throughput. However there’s no denying the significant speed increase 802.11ac brings. Faster performance means faster access to information which translates into higher employee productivity. Not only that, it allows your employees to utilize higher-bandwidth mobile and collaboration apps such as streaming HD video and SharePoint without experiencing the same signal degradation you get with 802.11n.
  • Enhanced signal quality – Faster speeds are a great thing. So is having a high-quality wireless signal. The 802.11ac standard operates in the 5 GHz frequency band, which has fewer wireless devices competing for airspace and is therefore less prone to signal interference. In addition, 802.11ac uses wider 80 MHz channels and has more non-overlapping channels than 802.11n, which operates in the 2.4 GHz frequency band. Add these up and the result is better signal quality.
  • Backward compatibility – Like earlier wireless standards, 802.11ac is backward compatible. This means your 802.11a/b/g/n devices can still connect to an 802.11ac access point. So, if you have a significant investment in devices using these standards you’re in luck. Even better, if you choose an access point with dual radios and one of the radios supports 802.11ac, you can dedicate one radio to devices using 802.11ac and the other to devices running the older standards.

Making the move to wireless access points that support 802.11ac is going to cost you some money. Depending on your requirements, it doesn’t need to be that much. The performance benefits of high-speed wireless generally justify the expense and you’ll be setting your organization up for the future when every WiFi-enabled device you purchase comes standard with 802.11ac. SonicWall offers a family of high-speed 802.11ac wireless access points called the SonicPoint Series. Read more about how these secure, high-speed access points can help your organization.

Download White Paper

The Future All Encrypted Internet: Is Your Security Platform Future-Ready?

/0 Comments/in /by

According to a recent Gartner report1, encrypted web traffic now comprises up to 40 percent of total web traffic for financial institutions. NSS Labs2 estimated 25 percent to 35 percent for a typical enterprise. However, for some businesses, NSS believes it could be as high as 70 percent. Our own research published in the 2015 SonicWall Security Annual Threat Report is in line with these estimates. Based on raw telemetry data gathered via the SonicWall Global Response Intelligence Defense (GRID) Network, SonicWall Security threat researchers found a 109 percent increase in the volume of HTTPS web connections from the beginning of 2014 to the beginning of 2015 with continued growth into 2015. And, by the end of 2014, as shown here, the HTTPS web connections comprised 60 percent of total web connections.

This data clearly supports the massive industry trend that moves towards an all encrypted Internet, not only to make it more difficult for cyber-criminals to eavesdrop on web connections, but also to ensure the privacy of personal information. Many cyber-security experts have been pushing the industry towards the perceived ideal of “HTTPS Everywhere”, in which plain text on the internet is replaced with encryption to achieve these objectives.

However, with the increased use of Secure Sockets Layer (SSL) or the newer Transport Layer Security (TLS) encryption protocol by the good guys, there is a corresponding increase in the use of encryption to hide malware from organizations. Using SSL/TLS, skilled attackers can cipher command and control communications and malicious code to evade intrusion prevention system (IPS) and anti-malware systems. These methods of attacks pose greater risks to any size organization because it is more complex and difficult to detect. After all, a security system cannot stop what it cannot see. Therefore, it is crucial to have a very capable SSL/TLS inspection mechanism that can effectively resist these evasive tactics. The “Gameover” banking Trojan is a good example of how attackers use encryption to conceal their presence while delivering malware to victims through legitimate but compromised websites. With most cloud-delivered web applications such as online banking, e-commerce and social networking websites as well as popular search engines already adopting the HTTPS standard, decrypting and inspecting encrypted web traffic now becomes mandatory for organizations.

The catch here is that legacy network security solutions either don’t have the ability to inspect SSL/TLS encrypted traffic or their performance is so low that when doing the inspection, they are effectively unusable. The key difference in inspecting encrypted versus plain text traffic is the 6 additional compute processes that must occur before any data is sent back and forth between a client’s browser and web server over the HTTPS connection.

  1. Client initiates SSL/TLS security handshake with server to confirm identities. Client tells the server or in this case security device what ciphers and keys it wants to use.
  2. Security device intercepts request and establishes session using its own certificates in place of server.
  3. Security device then initiates its own SSL/TLS handshake with server on behalf of client using admin defined SSL/TLS certificate.
  4. Server completes handshake and builds a secure tunnel between itself and security tool.
  5. Security device decrypts and inspect all traffic coming from or going to client for threats and policy violations
  6. Security device re-encrypts traffic and sends along to client

The two key areas of SSL/TLS that affect inspection performance are establishing a secure connection and decryption and re-encryption for secured data exchange. Each area is very compute intensive which impact overall scanning speed of the security system. According to NSS Labs2, the performance penalty on a security system when SSL inspection is active can be as high as 81 percent.

What does all this really mean to your organization?

Here are my top recommendations for protecting your organization against the ever increasing use of encryption for Internet traffic.

  1. If you haven’t conducted a security audit for some time, now is a good time to undertake a comprehensive risk analysis to identify your risks and needs.
  2. Upgrade to a capable, extensible next-generation firewall (NGFW) with integrated IPS and SSL inspection design that can scale support future growth.
  3. Update your security policies to defend against a broader array of threat vectors and establish numerous security defense methods to respond to attacks whether that traffic is HTTP or HTTPS.
  4. Implement continuous training for your staff to be aware of the danger of social media, social engineering, suspicious websites and downloads, and various spam and phishing scams.
  5. Inform users never to accept a self-signed and non-valid certificate.
  6. Make sure all your software is up to date with all the security update and patches. This will help protect all the machines from older SSL exploits that have already been neutralized.

SonicWalls security recommendations for 2015 revolve around eight key findings documented in the 2015 SonicWall Security Annual Threat Report. Download a copy now to learn more and get practical advice on how to protect your organization from the emerging threats identified in the report.

1Security Leaders Must Address Threats From Rising SSL Traffic, Gartner, December 2013
2SSL Performance Problems, NSS Labs Gartner, June 2013

Download Report

Introducing Secure Mobile Access 6200/7200 SMA 11.2

/0 Comments/in /by

IT organizations are struggling to keep up with mobile worker demand for access to more resources from more device types without compromising security. Often, mobile workers are accessing company resources from multiple devices concurrently, increasing traffic volumes, session counts and putting significant strains on legacy access infrastructure.

To help meet mobile enterprise needs, SonicWall is introducing three new secure access gateway appliances that increase scalability up to 8x over the previous generation. We’re also adding new features to the SMA OS that allow access from more devices, to more resources, more securely. In line with the expanded functionality of our gateway solution, the brand name for the appliances is changing from E-class Secure Remote Access to Secure Mobile Access. New appliances and features include:

  • SonicWall Secure Mobile Access 6200 Appliance with support for up to 2000 concurrent sessions
  • SonicWall Secure Mobile Access 7200 Appliance with support for up to 10,000 concurrent sessions
  • SonicWall Secure Mobile Access virtual appliance for HyperV with support for up to 5000 concurrent sessions
  • SonicWall Secure Mobile Access OS release 11.2 with HTML 5 browser access to Citrix Xendesktop and Xenapps (ICA support) via the SMA Workplace portal. This enables secure, clientless access for most smartphones, tablets and laptops while reducing reliance on troublesome Java and ActiveX components. (In addition to existing support for access to RDP published apps and desktops)

The portfolio also includes the flagship E-Class SRA EX9000 appliance that supports up to 20,000 concurrent sessions, and the Secure Mobile Access virtual appliance for VMware that supports up to 5000 concurrent sessions.

The new SMA appliances will be available to ship May 5, 2015. E-class SRA customers with current support contracts can now upgrade to SMA OS 11.2 at mysonicwall.com. For more information, please refer to the SonicWall Secure Mobile Access website.

Five Tips for Protecting Your Email

/0 Comments/in /by

Organizations are wary of the impact to their business due to spam, phishing and virus emails that enter their organization. I spend a considerable amount of my time with customers and partners discussing ways to protect their networks, users, and data from inbound threats. But it is equally important to understand the implications of not having outbound protection. Broadly, the issues around outbound email can impact the reputation of your email infrastructure which may result in your mail servers being blacklisted, leaving your resources scrambling to repair the problem and your reputation. In addition, a lack of attention to outbound protection can result in compliance violations due to leakage of sensitive information. Below, you can see that the majority of the organization’s email is inbound, but outbound is also measurable and when you remove inbound spam and junk, outbound becomes even more significant.

Graphic of inbound versus outbound email

Typical daily volume of Inbound vs. outbound email

To protect your email, here are 5 important tips:

1) Improve the trustworthiness of your email

Utilizing certain techniques, you will be able to prevent your email domains from being spoofed and from hackers sending fake/phishing emails. As a first step, set up a Sender Policy Framework (SPF) record for your domain. This allows you to identify which mail servers are allowed to send email on behalf of your domain thus prevent spammers from forging it. As a second step, set up Domain Keys Identified Mail (DKIM), which provides a method for validating a domain. Implementing DKIM involves signing each outbound email with a private key and setting up the corresponding public key in your Domain Name Server (DNS). Finally, implement Domain-based Message Authentication, Reporting & Conformance (DMARC) and configure policies to improve the trustworthiness of legit email and make better judgment on illegit ones.

2) Monitor who is spoofing your domain

Staying on the topic of DMARC, there is a second benefit to its implementation that involves a feedback loop from receiving servers. Typically senders remain largely unaware of whether or not their email domain is being spoofed. DMARC provides a way for the email receiver to report back to the sender about messages that pass and/or fail DMARC evaluation. This can be done by updating the DNS record and adding an attribute “rua=mailto:postmstr@domain.com”. You need to ensure you have an email security solution like SonicWall Email Security that supports DMARC and can process this information to create actionable reports.

3) Implement encryption

Organizations must protect their intellectual property and sensitive information from inappropriate distribution while ensuring compliance. If your organization is in a regulated industry like healthcare, banking, insurance etc., and/or you are doing business with such entities, you might want to consider encrypting your email. You should review your internal corporate and government regulatory needs and setup policy filters accordingly. For example, some companies chose to block EXE or MP3 files from delivery; or require that attachments containing company confidential information be re-routed to an approval box; or encrypt email containing Personal Health Information (PHI) when communicating with customers and partners.

4) Add multi-layered anti-virus protection.

My colleague John Gordineer wrote a blog where he emphasized the need for a layered security approach for better protection. Should one of your employee machines get infected and become a zombie system that originates spam, phishing or virus-laden email, you could see your email server blacklisted and your ISP connection shut down. Having multiple anti-virus engines scanning outbound email is a very critical part of the overall multi-layered security strategy organizations need to adopt.

5) Monitor and control the volume of outbound email

Not every flurry of outbound mail is due to a zombie infection. There are times when an internal resource (either a person or a system) can send thousands of emails without proper authorization that can result in your domain being blacklisted. To avoid such scenarios, you can enforce controls on the amount of email that any individual account can send within a specific period of time. Make sure your organization has an email security solution that can automatically block such emails and block the sender from sending more emails until appropriate corrective action can be taken.

Organizations have a responsibility to implement the right inbound and outbound controls to protect their employees, customers and partners email ecosystems. To learn more about protecting your network from email-borne attacks and other exploits, read the new SonicWall Security eBook, “Types of Cyber-Attacks and How to Prevent Them”.

Download eBook

Ten Tips for Protecting POS Systems from Memory Scraping Malware

/0 Comments/in /by

In the recently published 2015 SonicWall Security Threat Report, one of the observations on the evolution of attacks on POS systems is the rise in popularity of malware that uses memory scraping to steal sensitive data. No matter how many layers of encryption are applied to sensitive payment data and how carefully this encryption is deployed, at some point the primary account number and other sensitive information must exist in an unencrypted form in order to be useful. The moment that payment data is decrypted for processing, it ends up in the memory of the POS machine, creating a perfect window of opportunity for an attacker to snag this data. Advanced malware can use multiple techniques to access and scan contents of this temporary storage and look for patterns that resemble raw payment data. This data can then be used, for example, to clone cards for fraudulent purchases. This is exactly what happened in some of the high profile retail breaches of 2013 and 2014.

The ultimate goal of RAM scraping malware is exfiltration of the unencrypted data stolen from memory of the infected machine. Therefore, this malware will be very well hidden and it will attempt to remain as invisible as possible in order to access as much data as possible. Mitigating the risks of being hit with such malware falls into two categories: Pre-infection best practices to avoid infection and post-infection best practices to detect and control the attack.

Pre-infection best practices

Protecting yourself from new advanced attacks must always be done on top of executing on the basics which serve to reduce the risk of getting critical systems such as POS systems infected by any malware.

  1. Keep the OS and applications on POS systems fully patched. Most patches are security related, so ignoring them only opens up a larger window of opportunity for attackers.
  2. Firewall off the POS network from the rest of the network with strong (i.e. bare minimum access) access policies as well as with Intrusion Prevention and Anti-Malware.
  3. Use strong, non-default and not shared, passwords.
  4. Deploy and enforce endpoint anti-virus as a last measure of defense.
  5. Encrypt traffic VPN tunnels.
  6. Enable protection against MAC spoofing within the POS network and for critical systems with which the POS terminals communicate.
  7. Lock down remote access to pin-point level of access. Do not allow full L3 tunnels into sensitive networks and use remote access tools that allow verification of remote host integrity before granting access.

Post-infection best practices

A good to approach in evaluating your network security stance is to assume that you will be infected at some point in the future and design processes to allow you to detect and control the infection. In the context of memory scraping malware, the ultimate observable behavior will be communication with non-trusted hosts on the internet. It may not be immediate and it may not be in bulk, as the attacker may want to put time between the act of infection and the act of data theft. However, sooner or later, the attacker will need to get the stolen data from the POS systems into his or her possession. This may happen naively via direct communication, or via more sophisticated methods such as using another compromised system outside the POS network, but with a connection to the POS network, as a gateway. That system may reside in a network that is less strictly observed than the POS network on which may not raise alarms at communication with random servers on the internet.

There are several key technologies that can help you detect or neutralize this data exfiltration:

  • Don’t allow direct communication with the internet from the POS network. This will lock down allowable communications and will block and detect naïve approaches at data exfiltration. For processing purposes, payment data can be sent via an encrypted tunnel to another trusted server(s) on the network (outside the POS network) and then via another encrypted tunnel to the processing server. Communication between these systems should be whitelisted by the firewall via ACLs, with all other traffic (besides perhaps management and updates) blacklisted.
  • Deploy Geo-IP and Botnet filtering detection on all networks. Lock down communication from sensitive systems only to locales that they need to communicate with (if your processor is in the US, why would your POS data need to have access to and from Europe, Asia, LATAM, etc.?)
  • Configure DLP and SSL Decryption to detect Credit Card type data leaving the network in plaintext or inside of SSL tunnels to internet hosts that are unknown. In other words, only allow such data to flow to CC processing servers known to you. Communication of such data to any other system on the internet should be intercepted, logged and investigated. Deny any SSL communication from sensitive networks that does not lend itself to inspection by not accepting your NGFW SSL inspection certificate.

Firewalls occupy an extremely valuable piece of real estate on any network since all Internet bound traffic must go through them. When properly deployed, next-generation firewalls play an important role in reducing the risk of advanced malware infection and data theft in POS networks. To find out more about the capabilities of state of the art NGFWs from SonicWall, read the eBook “Types of Cyber-Attacks and How to Prevent Them.” Follow me on Twitter: @threadstate.

download ebook