Posts

7 Reasons to Upgrade to the Next Generation of SonicWall Email Security Appliances

Email security is still a necessity — even as we race toward 2020. That’s because email remains one of the most effective attack vectors for cybercriminals.

In 2018 alone, SonicWall customers faced an average of 4,164 of phishing attacks. That’s far too great a risk to your business or enterprise to go unchecked.

Fortunately, SonicWall offers powerful email security appliances that defeat today’s most dangerous email attacks, including phishing, business email compromise (BEC) and ransomware. SonicWall Email Security appliances are ideal for organizations that require a dedicated and powerful on-premise solution.

Explore the top seven reasons to upgrade your existing SonicWall Email Security appliances to deliver high-performance, enterprise-grade email security for their business.

Boost UI Speed, Productivity

Do more. Faster. Increased RAM enables the latest SonicWall Email Security Appliances to provide a more seamless user experience with a faster and more responsive UI. This saves time and effort for administrators managing the email security for the organization.

Why upgrade: The new SonicWall Email Security appliances come with 8 GB (ES 5000), 16 GB (ES 7000) and 32 GB (ES 9000) RAM compared to 2 GB (ES 3300) and 4 GB (ES 4300 and ES 8300) RAM of legacy versions. This significantly improves the processing power and responsiveness of the appliances.

Process More Email Volume, Faster

Faster cores increase the speed and accuracy of processing inbound and outbound emails with lower latency. The 64-bit processors increase the computational power and the speed of these appliances compared to older 32-bit appliances. The 64-bit processors are designed to take advantage of the increased access to memory (i.e., higher RAM), improving the mail processing and UI responsiveness.

Why upgrade: The new appliances have 64-bit processors and improved CPUs that increase email filtering and email throughput capacities compared to legacy appliances.

Store More Files, Emails Locally

More onboard storage memory allows you to increase local storage of message logs, junk email and email backups right on the appliance.

Why upgrade: The New ES appliances have 500 GB (ES 5000), 1 TB (ES 7000) and 2 TB (ES 9000) of onboard storage memory compared to 250 GB and 750 GB storage on the old ES series.

Stop Advanced Email Attacks

As SonicWall continues to add advanced threat protection features like Capture ATP Attachment Sandboxing, Advanced URL Protection and more filtering engines, the new appliances provide optimum performance due to increased RAM and processing power.

Why upgrade: Upgrade to the latest hardware to ensure you stay up-to-date with critical firmware patches and updates, and take advantage of new features that stop targeted phishing attacks, email threats and ransomware.

Expand Email Security to Virtual Environments to Reduce Costs

Virtualizing your infrastructure provides many benefits, while significantly improving the cost-effectiveness and performance needed to protect against advanced email threats.

Why upgrade: Enhance scalability and flexibility by expanding virtual infrastructure (e.g., hard disk, RAM and core CPUs) with ease, or move to hosted email security and eliminate infrastructure needs. You can also minimize your upfront investment with low-cost, perpetual virtual appliance software licenses. This virtual approach also lowers ongoing hardware and infrastructure maintenance costs.

Use Cloud-based Service to Improve Security Resiliency, Availability

Avoid business-crippling email downtime, vastly improve Quality of Service (QoS) and workforce productivity.

Why upgrade: SonicWall Hosted Email Security delivers a high degree of business continuity and scalability while fulfilling aggressive SLAs. Hosted Email Security also includes email continuity that allows employees to send and receive email during planned and unplanned outages to mail servers.

Retain Hardware Support and Warranty

Delivering Email Security is a critical function of IT that keeps employees productive and reduces attack surface for cyber criminals.

For current users, it is imperative your secure email solution is covered with the right warranty and support services.

SonicWall ES 3300/4300/8300 series have entered Limited Retirement Mode (LRM) as of April 2018 and is approaching End of Life (EOL) on April 2020. New firmware starting with ES 9.2 were released only for 64-bit appliances. The ES 3300/4300/8300 series will not be supported beyond 04/01/2020 in case of any hardware or firmware issues.

Why upgrade: Every new version of firmware is packed with advanced features and capabilities. ES 9.2 is the current recommended firmware that provides Advanced URL Protection. ES 9.2 and above are only supported on ES 5000 series or 64-bit VA or 64-bit Windows Server.


About SonicWall Email Security Appliances

SonicWall’s hardened, Linux-based email security appliances defend against advanced email-borne threats such as ransomware, zero-day threats, spear-phishing and business email compromise.

The multi-layered secure email solution provides comprehensive inbound and outbound protection, and is available in a range of hardware appliance options that scale up to 10,000 users per appliance.

Quick Glance: SonicWall Email Security Appliances
Feature ES 3300 ES 4300 ES 8300 ES 5000 ES 7000 ES 9000
CPU Intel 2.0 Ghz Core 2 Duo 2.13 Ghz Xeon Quad Core Celeron G1820 Core i3-4330 Xeon E3-1275 v 3
RAM 2 GB 4 GB 4 Gb 8 GB 16 Gb 32 GB
Hard Disk 250 GB 2 x 250 GB 4 x 750 GB 500 GB 1 TB 2 TB
Processor 32-bit 32-bit 32-bit 64-bit 64-bit 64-bit
Appliance Status In LRM, EOS 4/1/2020 In LRM, EOS 4/1/2020 In LRM,
EOS
4/1/2020
Active Active Active
Firmware Status Not Supported Not Supported Not Supported Full Support Full Support Full Support
Enhanced Anti-Phishing No No No Yes Yes Yes
Advanced URL Protection No No No Yes Yes Yes

Upgrade to SonicWall Email Security

Ready to upgrade to a SonicWall Email Security appliance? Contact your SecureFirst partner today to explore the options that match your business objectives. If you’re not sure who that is, contact SonicWall and we’ll put you in touch.

Bill Conner: How the UK Is Taking Malware Seriously

Bill Conner sat down with Information Age editor Nick Ismail to discuss global malware attack statistics, cross-border cybersecurity collaboration, the increasing need to inspect PDFs and Microsoft Office documents, and how all impact the dynamic U.K. political landscape.

Though malware attack data shows an increase in global attacks, the U.K. has experienced a decrease in these attacks following the WannaCry ransomware strain in previous years.

Conner sees this as a positive change for the U.K. and stated via Information Age, “you guys were all over it” following the WannaCry attack and “most of the vendors in the U.K. and their customers put solutions in place to protect against multiple family variants of ransomware.”

While this is a positive change for the U.K., there is still work to be done globally and Conner says regardless of the often divided political climate, “there’s a good foundation for cyber collaboration across borders.”

“Right now, we need to focus on those PDFs and Office (files), the things you run in your business every day, because they can be exploited for IP and monetary gain. And you can’t even see it.”

Bill Conner
SonicWall President & CEO

In addition to urging governments to look toward political collaboration to tighten cybersecurity globally, Conner explained the majority of this change will come through the dedication of law enforcement.

“Law enforcement sharing is better than political sharing at the moment,” Conner told Information Age. “Public institutions, private organizations and different governments have got to collaborate. But, above all, we’ve got to have dedicated cyber law enforcement.”

While a global cybersecurity strategy may be down the road, Conner says there are places to focus on now to best secure governments, enterprises and SMBs.

What does Conner recommend an organization focus their cybersecurity strategy on?

“What I’m telling governments and enterprises is to forget side-channel exploits for the moment,” he said. “Right now, we need to focus on those PDFs and Office (files), the things you run in your business every day.”

One of the ways to mitigate these specific malware threats requires advanced technology, like SonicWall Capture Advanced Threat Protection (ATP) with SonicWall Real-Time Deep Memory Inspection (RTDMI™), to inspect and mitigate attacks in memory.

Read the rest of Conner’s recommendations and predictions in his interview with Information Age.

Cloud Security: Making the Invisible … Visible

Living in Colorado and having 14,000-foot mountains in my backyard, there are times I end up driving into the clouds. One minute I can be traveling in sunshine and great weather and the next, a cloud surrounds my car.

Entering a cloud, things begin to lose visibility. Soon, you can barely make out anything around you. This is a good time to slow down and get clarity on your surroundings.

As the business market continues to drive into the cloud, it too comes with risk of diminished visibility. The major cloud providers give you tools to secure platforms in the cloud, but they don’t provide you the means of monitoring those solutions to know what is happening in the platform or within a cloud datacenter.

Besides a bill for your monthly traffic, compute and storage usage, you don’t have visibility of what the traffic is within the cloud.

For many, cloud security can be a challenging prospect as each provider has slightly different ways of implementing their security stack. You may have secured your cloud devices, but how do you know what traffic goes in and out of them? And just because you identify the appropriate ports and protocols that are allowed, that doesn’t mean your application can’t be compromised and data exfiltrated through those ports and protocols.

How to Gain Better Cloud Visibility

The challenge when working within the cloud is making the invisible, visible. Cloud providers do not rely upon layer 2 connections, but rather route all the traffic based upon their own algorithms/methods.

In most cloud systems, depending upon how well you’ve defined your security rules, when you launch a new device within a cloud environment, all the other devices within that environment can send traffic to and from each other. This is why micro-segmentation has become one of the cloud buzzwords; we needed the ability to restrict traffic at the host or interface level.

While micro-segmentation will allow you to restrict traffic, how do you inspect the traffic?

How Virtual Firewalls Secure Cloud Environments

SonicWall provides two products to help with this problem of visibility within the cloud: Network Security Virtual Firewall (NSv) and Web Application Firewall (WAF). These products each have their own purposes, but when implemented correctly, they will provide you visibility within the cloud.

Every cloud provider allows you to modify the default route paths and direct traffic within their infrastructure. With these routes, you can direct traffic in and out of NSv or WAF in order to provide additional visibility and inspection of the traffic within your cloud.

You can further improve cloud security by adding Deep Packet Inspection (DPI), Capture Advanced Threat Protection (ATP) multi-engine cloud sandboxing, which includes Real-Time Deep Memory Inspection (RTDMITM), and traffic reporting and analysis.

Setting up the custom route tables to direct traffic within a cloud provider can be a daunting task. SonicWall’s Remote Implementation Service for the NSv Firewalls can help.

Whether you use the SonicWall NSv or the WAF within the cloud, you will have the ability to shed light upon the traffic within the cloud and know that it’s appropriate for your environment. Take back control of your traffic by bringing it to a higher level — above the clouds.

SonicWall Partner Enabled Services

Optimize your investment in SonicWall products with professional services delivered by SonicWall Advanced Services Partners trained to provide world-class professional services for SonicWall customers.

SonicWall’s Multi-Cloud Offering Extends to Hyper-V Private Clouds with Flexible Licensing

Technology and data usage are changing at a rapid pace. Finding a way to store, manage and distribute data is a major challenge. Plus, the need for compute and storage grows at unprecedented rates. You need to buy racks, then hire staff to configure, maintain and monitor appliances.

It’s a no-brainer that cloud adoption is becoming inevitable.

According to a recent study by RightScale, more than 81 percent of enterprises have a multi-cloud strategy in place. Of this group, 51 percent have embraced hybrid cloud environments, while 21 percent use multiple public clouds and 10 percent have various private cloud strategies.

Cloud adoption drives business growth by increasing agility and innovation, while reducing cost. According to Gartner, by 2020 a “No-Cloud” policy will be as rare as a “No-Internet” policy is today. So, you can imagine the importance of secure cloud adoption. It is the future.

Private Cloud Security from SonicWall

In line with this, SonicWall continues to expand its cloud offering with added support of the Microsoft Hyper-V platform on SonicWall Network Security virtual (NSv) firewall series, along with new flexible licensing options. SonicWall also recently announced support for AWS* and Azure platforms.

Hyper-V support is available across the full suite of NSv firewalls. The flexible licensing model introduces a non-perpetual method of licensing your firewalls. Securing data wherever it resides should be consistent and seamless, providing you increased flexibility and an improved security posture.

Do I Need Virtual Firewalls?

While securing the cloud is a must, it is not an easy task. Gartner predicts that through 2020, 95 percent of cloud security failures will be the customer’s fault. And according to Research and Markets, the cloud data center market is expected to reach $67.5 billion by 2023.

With the widespread adoption of virtualization, it becomes increasingly critical to secure workloads and data across your multi-cloud deployment. Virtual firewalls can be deployed quickly, driving productivity and innovation. By being virtual, there is a huge benefit of shifting from CapEx to OpEx models.

Virtual firewalls, like NSv, address some of the critical needs of public cloud security. Below are some of the key benefits of leveraging NSv to protect your public cloud infrastructure and resources.

  • Gain complete visibility into virtual environment for threat prevention
  • Implement proper security zoning and ensure appropriate placement of policies
  • Defend against zero-day vulnerabilities with SonicWall Capture ATP
  • Prevent service disruptions in the virtual ecosystem
  • Gain centralized control and visibility with single-pane-of-glass management via Capture Security Center
  • Leverage agility and scalability without performance impact
  • Maintain security governance, compliance and risk management

Plus, as the threat landscape evolves and takes advantage of various vulnerabilities in the cloud and virtual workloads, it is essential to secure cloud infrastructure. Some of the common type of attacks include cross-virtual machine attacks and side-channel attacks, like PortSmash and Foreshadow.

Virtual firewalls can be used to defend against information threats and protect against unauthorized takeover of virtual machines (VMs). It can provide security at every level of the virtual environment, providing granular security posture control.

What Cloud Platforms do SonicWall Virtual Firewalls Support?

With NSv virtual firewalls you can leverage next-gen firewall capabilities across your multi-cloud deployments. Platform support currently extends to ESXi, Azure, AWS* and Hyper-V*.

How Can I Purchase NSv?

Previously, NSv was available only via perpetual licensing. To solve the challenge of relying just on perpetual model licensing and provide flexibility to our customers, SonicWall introduces non-perpetual licensing for NSv. This is an additional offering to the current SonicWall perpetual licensing model.

SonicWall licensing models provide customers the flexibility to choose perpetual licensing or non-perpetual licensing based on their requirements.

Non-Perpetual Licensing Model

Non-perpetual licensing is ideal for those who require a short-term solution and agile deployments. It’s a single bundle for firewall software, security and support services, making it simple to purchase these appliances. Once the period ends, all services expire at the same time. Customers are notified via MySonicWall before service expiration.

The non-perpetual licensing model is available via the three options: IPS/App Control Subscription, TotalSecure Subscription and TotalSecure Advanced Subscription, which is available over a one-year period.

Service Offering Type Bundled Service
IPS/App Control Subscription NSv Software + IPS + App Control + Support
TotalSecure Subscription NSv Software + CGSS + Support + CSC
TotalSecure Advanced Subscription NSv Software + AGSS + Support + CSC

Perpetual Licensing Model

Perpetual licensing is SonicWall’s traditional licensing model where firewall services do not expire, while security and support services do. Perpetual licensing is suitable to customers that require long-term solutions.

Virtual Firewall Promo: NSa/NSsp with NSv

The SonicWall NSv promo enables organizations to extend the next-gen security of their private data center to the public cloud and ensure end-to-end security of their multi-cloud environment.

Organizations can test drive SonicWall virtual firewalls at no additional cost or commitment to see if it fits their needs and requirements.

  • Test drive an NSv with a TotalSecure subscription for one year at no additional cost
  • Get an NSv TotalSecure subscription with Comprehensive Gateway Security Service (CGSS), Capture Security Center and 24×7 support
  • Requires eligible SonicWall NSa or NSsp firewall with an active AGSS/CGSS subscription
  • Deploy NSv firewalls across public and private cloud platforms, including ESXi, Azure, AWS* and Hyper-V*

To take advantage of the SonicWall NSv virtual firewall promo, please contact your dedicated SonicWall SecureFirst partner or reach out to SonicWall online.

What to Look for in a Next-Gen Virtual Firewall

To best capitalize on virtualization trends, IT must operationalize the complete virtualization of computing, networking, storage and security in a systematic way. A new approach is required to select an appropriate and effective next-generation virtual firewall solution. Download our exclusive brief to explore fundamental capabilities, core solution requirements and best practices.

* Hyper-V and AWS availability pending.

Cybersecurity for SMBs: Bundled Network Security Delivers Cost-Effective Protection

If you’re a small- or medium-sized business (SMB), don’t bury your head in the digital sand. Cybercriminals don’t discriminate. Your data, credentials or access could be valuable to them in ways not immediately apparent. SMB cybersecurity is critical.

Unfortunately, SMBs also haven’t received the necessary guidance in terms of government support. That’s alarming since in September 2018 alone, the average SonicWall customer faced 1,662 malware attacks. For the year, SonicWall recorded 8.5 billion malware attacks globally — a 54 percent increase over 2017.

There is good news, however. In August 2018, President Trump signed into law the new NIST Small Business Cybersecurity Act. New legislation in Canada and the UK bring hope for similar protections.

But in many cases, cybersecurity guidance isn’t immediately available. In the U.S., for example, NIST has a year to deliver the guidance (read our eBook to learn more). Regardless of geographic location, a year is a long time for SMBs to wait to either enhance or begin their cybersecurity strategy. For this reason, SonicWall has created cost-effective cybersecurity bundles tailored specifically for SMBs.

Bundled Security for SMBs

The SonicWall TotalSecure SMB Bundle* provides robust cybersecurity technology and services that defend growing SMBs from the volume and sophistication of modern cyberattacks.

The tailored package includes high-performance network security, endpoint protection, cloud sandbox, content filtering, online management and more. Admins can also use powerful reporting functions to easily check the health of the network and endpoints and remediate threats if ever needed.

What’s included What you get
  • Perimeter firewall protection, including SSL traffic inspection
  • Intrusion prevention
  • Content filtering
  • Zero-day defense via Capture ATP with RTDMI
  • Behavior-based endpoint security
  • Endpoint rollback (Windows only)
  • Advanced reporting and attack visualization

Bundled Security for Small Offices

The SonicWall TotalSecure SMB Bundle* also is available for small or home offices. It provides foundational cybersecurity tools that help smaller organizations mitigate cyberattacks from the perimeter to the endpoint.

It’s a comprehensive, out-of-the-box solution to stop cyberattacks, help remediate issues, protect endpoints and manage security — easily and efficiently.

What’s included What you get
  • Perimeter firewall protection, including SSL/TLS traffic inspection
  • Intrusion prevention
  • Content Filtering Service
  • Behavior-based endpoint security
  • Endpoint rollback (Windows only)
  • Advanced reporting and attack visualization

SonicWall has been protecting SMBs for more than 27 years. SonicWall is the No. 2 cybersecurity vendor in the SMB space, according to Gartner’s Market Share: Unified Threat Management (SMB Multifunction Firewalls), Worldwide, 2017 report.

Contact SonicWall to build or enhance your cybersecurity posture for true end-to-end protection from today’s most malicious cyberattacks, including never-before-seen threats.

Lock In Your SMB Bundle

It’s time to use real-time cybersecurity to protect your business from cyberattacks. Contact a SonicWall security expert today. We’re ready to help you build a sound, cost-effective security strategy that’s just right for your business.

* Please contact SonicWall or your SonicWall SecureFirst partner for regional availability.

How to Secure Your Website & Protect Your Brand Online

A study by the SMB Group in 2017 showed that more than 85 percent of small- and medium-sized (SMB) businesses and mid-tier enterprises are adopting digital transformation. This is changing the role of the traditional website from a “static set of HTML pages” to a highly dynamic online experience platform. The website is now the custodian of the organization’s digital brand.

But, as once said by Ben Parker (yes, Spiderman’s late uncle), “With great power comes great responsibility.”

IT executives now have to protect users — and their data used by the website — from a larger spectrum of web application threats. The recent Whitehat Security’s 2018 Application Security Report highlighted these concerns:

  • About 50 percent of vulnerabilities discovered on a website are Serious; remediation rates are less than 50 percent
  • The average time to fix a vulnerability ranges from 139 to 216 days
  • More than 30 percent of websites are still showing poor developer cybersecurity skills (e.g., information leakage, cross-site scripting and SQL injection)
  • SSL/TLS is not adopted well enough; 23 percent of those are weak and riddled with vulnerabilities

SonicWall WAF 2.0 was launched in April 2018 as a standalone virtual appliance deployable in public and private cloud environments. SonicWall WAF delivers an award-winning web application firewall technology that works alongside SonicWall next-generational firewalls (NGFW) to protect businesses and their digital brands.

The SonicWall WAF is backed by threat research from SonicWall Capture Labs for virtual patching of exploits, reducing the window of exposure significantly.

In fact, when the attacks associated with British Airways and Drupalgeddon came out, the SonicWall WAF was able to protect customers without any updates. With the SonicWall WAF, administrators can protect their websites from the wide spectrum of web threats including those targeting the vulnerabilities called out in the OWASP Top 10.

Five New Enhancements to SonicWall WAF 2.2

The next evolution of the product, SonicWall WAF 2.2 gains five significant new features and enhancements, including a new licensing model.

Real-Time Website Malware Prevention with Capture ATP Integration

With the increasing threat of malware, many websites are also at risk of advanced malware attacks like cryptojacking and the famous CTB-locker malware that targeted WordPress websites.

Malware is injected into websites through the use of vulnerable plugins or by using file-upload facilities available with many websites. SonicWall WAF now integrates with the Capture Advanced Threat Protection (ATP) sandbox service. It detects malware embedded in traffic streams by leveraging the industry-leading, multi-engine malware analysis platform, including Real-Time Deep Memory Inspection (RTDMI). Any attempts to inject or upload malicious files to a website would be inspected in-line (as opposed to after the fact) while maintaining an optimal user experience.

Simplifying Transport Layer Security, SSL Certificate Management with ‘Let’s Encrypt’

The biggest challenge for securing website communication is the need for legitimate SSL/TLS certificates for encryption and decryption. Legitimate certificates are expensive to purchase, manager, monitor and renew.

But with SonicWall WAF 2.2, organizations can take advantage of the Let’s Encrypt service through a built-in integration that not only offers free certificates, but will also automatically monitor and renew digital certificates.

This eliminates the administrative effort to enable SSL/TLS required on the website to turn on support for SSL/TLS.

By combining Let’s Encrypt integration, Perfect Forward Secrecy (PFS) and HTTP Strict Transport Security (HSTS), the SonicWall WAF ensures that websites are only accessible via a secured and encrypted channel, which also improves search engine visibility and ranking.

Seamless Multifactor Authentication Controls Access to Sensitive Content, Workflows

The most common cause of information leakage from websites stems from improper access control on websites, sometimes via unauthenticated pages and others because of the lack of strong authentication controls (remember the Equifax attack?).

With SonicWall WAF 2.2, administrators can redirect users to an authentication page for any part of the web application by leveraging an existing authentication page or with a WAF-delivered login page.

Administrators can also enforce second-factor authentication using client certificates or one-time passwords (OTPs) to validate users trying to log in to the web application are, indeed, genuine users.

API Support for Managed Cloud Service Providers

Cloud service providers often manage and host websites for their customers. In many cases, they leverage DevOps and programmable infrastructure using APIs to launch hosting environments, web application platforms and ready-to-use infrastructure. But if security is not embedded into these DevOps workflows, they leave gaping holes and become liable for website security.

With SonicWall WAF 2.2, administrators can automatically launch WAF virtual appliances and programmatically provision security for websites using scripts in DevOps workflows. This includes creating a web application to be protected, enabling exploit prevention, enabling Let’s Encrypt Integration for free SSL/TLS support and enabling Capture ATP integration for malware prevention.

New Utility-based Licensing Model, An innovation for WAF Virtual Appliances

With SonicWall WAF 2.2, organizations may purchase protection on a per-website basis. This helps reduce the total cost of ownership (TCO) by purchasing only what they need. Four types of websites are currently supported based on the amount of data that is transferred to/from the website per month.

Size Data Volume
Pro Website 10 GB per Month
Small Website 50 GB per Month
Medium Website 200 GB per Month
Large Website 500 GB per Month

A sizing calculator will recommend the compute requirements for the WAF virtual appliance and will provide guidance to website administrators on what type of license they need to buy based on a variety of metrics like sustained/peak throughput, average visits per day etc.

SonicWall WAF helps administrators secure their websites and their digital environment, thereby establishing trust in their digital brand.

Get to Know SonicWall WAF

The SonicWall Web Application Firewall (WAF) now integrates with the award-wining SonicWall Capture Advanced Threat Protection (ATP) sandbox service and Real-Time Deep Memory Inspection (RTDMI) technology. Explore how this innovative product can defend your websites and applications from both known and unknown cyber threats.

SonicWall Extends Next-Generation Firewalls to Public Cloud Deployments, Including AWS and Azure

Attacks on public cloud infrastructures increase every day.

“We are in the third era of computing — the cloud and mobile era — but security considerations on cloud are still not widely understood,” said Mark Russinovich, CTO of Microsoft Azure. “It is important to address the public cloud security concerns to facilitate its adoption.”

In this third era, securing the public cloud is critical. According to IDC, 83 percent of workloads are virtualized today, and 60 percent of large enterprises run virtual machines (VM) in the public cloud. With the rapid pace of cloud transformation, securing workloads in the cloud becomes challenging.

SonicWall takes on this challenge and extends the security of the private cloud to public clouds with SonicWall Network Security virtual (NSv) firewall series. In addition to public and private cloud security, NSv can also provide end-to-end security for multi-cloud deployments.

Cloud technology provides greater agility, scalability and infrastructure consistency, improving business efficiency. Public cloud environments supported by SonicWall NSv includes Amazon Web Services (AWS)* and Microsoft Azure.

True Next-Generation Virtual Firewall Series

SonicWall NSv series brings industry-leading next-generation firewall (NGFW) capabilities, such as application intelligence and control, real-time monitoring, IPS, TLS/SSL decryption and inspection, advanced threat protection, VPN and network segmentation capabilities, to protect your AWS and Azure environments.

NSv supports all security and networking features similar to SonicWall next-gen hardware firewall appliances, including our patented Reassembly-Free Deep Packet Inspection (RFDPI) technology and award-winning Capture Advanced Threat Protection (ATP) sandbox with Real-Time Deep Memory Inspection (RTDMI) to stop both known and unknown (e.g., zero day) cyberattacks.

You can gain complete visibility and control of your traffic across multiple virtual private cloud (VPC) and virtual networks (VN), plus provide seamless security and management capabilities with a single-pane-of-glass experience. With NSv, you can take advantage of agility, scalability, high-performance, lower operational cost, quick time-to-deployment and drive innovation.

The public platform support is available across multiple NSv models, such as NSv 200/400/800/1600. Based on the fully-featured SonicOS 6.5.0, NSv makes the move to the cloud easier and safer.

Protect Public Cloud Data, Applications with SonicWall NSv

NSv addresses some of the critical needs of public cloud security. Below are some of the key benefits of leveraging NSv to protect your public cloud infrastructure and resources.

  • Gain complete visibility into virtual environment for threat prevention
  • Implement proper security zoning and ensure appropriate placement of policies
  • Defend against zero-day vulnerabilities with SonicWall Capture ATP
  • Prevent service disruptions in the virtual ecosystem
  • Gain centralized control and visibility with single-pane-of-glass management via Capture Security Center
  • Leverage agility and scalability without performance impact
  • Maintain security governance, compliance and risk management

SonicWall NSv can be deployed in a variety of use cases including the ones below:

  • Internet gateway for ingress/egress traffic protection
  • Lateral protection of east-west traffic
  • Site-to-site VPN deployment
  • Secure end-to-end remote access
  • Multi-cloud secure connectivity

Why Choose SonicWall NSv?

In addition to the various key benefits in leveraging NSv, below are some additional reasons why you should choose NSv as the security of choice in the public cloud.

  • Patented technologies like RTDMI, RFDPI and more
  • Robust products with over 26 years of award-winning technological innovation
  • Powerful security, powered by SonicWall next-generation firewall capabilities, now extending to the cloud

* AWS availability date pending.

Try SonicWall NSv for Azure

SonicWall NSv is currently available for Azure public cloud environments. Visit the Azure Marketplace to gain next-generation security for your most sensitive Azure workloads.

September 2018 Cyber Threat Data: Ransomware Threats Double Monthly, Encrypted Threats Still Growing

We’re into October and based on this year’s reports so far, the threat landscape is continuing to evolve and change as the global cyber arms race grows.

Phishing attacks continue to trend downwards, with September data showing the volume of attacks down 92 percent compared to the same time last year. The reasons for this decline are not 100 percent clear, but may be partly attributed to increased awareness as people are becoming more adept at identifying phony websites and sharing information about common scams.

While phishing is still a threat, particularly as the holiday season approaches, it appears that cyber criminals are continuing to favor attacks involving malware, ransomware, TLS/SSL encrypted attacks and intrusion attempts. SonicWall Capture Advanced Threat Protection sandbox, with Real-Time Deep Memory Inspection (RTDMITM), has discovered 27,680 new attack variants this year, further evidence that cyber criminals are pursuing more sophisticated and coordinated methods of attack.

Globally, the SonicWall Capture Threat Network, which includes more than 1 million sensors across the world, recorded the following 2018 year-to-date attack data through September 2018:

  • 8.5 billion malware attacks (54 percent increase from 2017)
  • 2.9 trillion intrusion attempts (49 percent increase)
  • 262.4 million ransomware attacks (108 percent increase)
  • 1.9 million encrypted threats (56 percent increase)

In September 2018 alone, the average SonicWall customer faced:

  • 1,662 malware attacks (24 percent decrease from July 2017)
  • 791,015 intrusion attempts (19 percent increase)
  • 56 ransomware attacks (99 percent increase)
  • 70.9 encrypted threats (61 percent decrease)
  • 10 phishing attacks each day (92 percent decrease)

 SonicWall Capture Security Center

SonicWall cyber threat intelligence is available in the SonicWall Security Center, which provides a graphical view of the worldwide attacks over the last 24 hours, countries being attacked and geographic attack origins. This view illustrates the pace and speed of the cyber arms race.

The resource provides actionable cyber threat intelligence to help organizations identify the types of attacks they need to be concerned about so they can design and test their security posture ensure their networks, data, applications and customers are properly protected.

Get the Mid-Year Update

Dive into the latest cybersecurity trends and threat intelligence from SonicWall Capture Labs. The mid-year update to the 2018 SonicWall Cyber Threat Report explores how quickly the cyber threat landscape has evolved in just a few months.

Protecting Your MSSP Reputation with Behavior-Based Security

You’ve been here before. Your customer gets hit by a cyberattack and they ask, “Why did this happen? Shouldn’t your managed security service have protected us?”

Unless you give them a satisfactory answer, they may be shopping for a new partner. Over the past few years, I’ve heard several MSSPs having to explain to their customers that the malware or ransomware attack could not be stopped because they didn’t possess the technology that could mitigate new attacks.

Don’t put yourself in a situation where you can’t properly safeguard your customers — even against new or unknown attacks. To protect both your customers and your reputation against the latest threats, you need to deploy behavior-based security solutions that can better future-proof your customer environment.

The Logistics of Threat Prevention

When talking with people about threat prevention I ask, “How many new forms of malware do you think SonicWall detected last year?”

I usually hear answers in the thousands. The real answer? 56 million new forms or variants of malware in a single year. That’s more than 150,000 a day. Every day, security companies like SonicWall have teams of people creating signatures to help build in protections, but this takes time. Despite the industry’s best effort, static forms of threat elimination are limited.

Layering Security Across Customer Environments

MSSPs understand the importance of selling perimeter security, such as firewalls and email security, to scrub out most threats. These solutions will cover roughly 94-98 percent of threats. But for the smaller percentage of threats that are no less devastating, this is where behavior-based solutions come into play.

On each edge-facing firewall and email security service you need to have a network sandbox, which is an isolated environment where files can be tested to understand their intended purpose or motive. For example, the SonicWall Capture Advanced Threat Protection (ATP) sandbox is an isolated environment that is designed to run suspicious files in parallel through multiple engines to resist evasive malware. With the ability to block a file until a verdict has been reached, you can ensure that you will deliver highly vetted and clean traffic to end users.

Endpoints require a form of security that continuously monitor the system for malicious behavior because they roam outside the network perimeter and encounter fileless threats that come from vectors like malvertising.

SonicWall’s endpoint security solution (called Capture Client) only uses roughly 1 percent of the CPU’s processing power on a standard laptop. It can stop attacks before they happen as well as halt attacks as they execute. MSSPs love the ability to prevent dynamic attacks but also roll them back (on Windows only) in case they do initiate.

Behavior-based Security in Action

The power of behavior-based security was clear with the initial WannaCry attack in 2017. It was made famous when 16 NHS hospitals in the UK were shut down due to this viral ransomware attack. These sites were protected by a competitor whose CEO had to explain himself and apologize on national television.

The sites protected by SonicWall were up and running and helped pick up the slack when the others went down. Three weeks before the attack, SonicWall put protections in place that prevented Version 1 of WannaCry and its SMB vulnerability exploit from working.

But it was the behavior-based security controls that helped to identify and stop all the subsequent versions that came after. This same pattern emerged again with the NotPetya and SamSam ransomware attacks; static defenses followed by proactive dynamic defenses.

Furthermore, SonicWall’s reporting enables MSSPs to be alerted when something has been stopped. SonicWall Capture Client attack visualization gives administrators a view of where the threat came from and what it wanted to do on the endpoint.

This approach gives our customers — and MSSPs powered by SonicWall — the ability to protect against threats detected by SonicWall. But this strategy also protects against attacks that shift and change to bypass safeguards. By doing our best to build protections in a timely manner, as well as providing technology that detects and stops unknown attacks, we protect your customer as well as your reputation.


This story originally appeared on MSSP Alert and was republished with permission.

How MSSPs & Artificial Intelligence Can Mitigate Zero-Day Threats

So, here’s the problem: unknown zero-day threats are just that — unknown. You have no way (besides historical experience) to predict the next vulnerability avenue that will be exploited. You, therefore, don’t know what will need patching or what extra security layer needs injecting. This ultimately leads to a forecast-costing dilemma as you cannot predict the man hours involved.

The other quandary faced when tackling complex targeted zero days is the skills gap. Staffing a security operations center (SOC) with highly skilled cybersecurity professionals comes at a cost and only becomes profitable with economies of scale that a large customer base brings.

Coupled with the shortage of skilled cybersecurity professionals in the open market, how can you get your SOC off the ground? Could artificial intelligence (AI) level the playing field?

Machine Learning Reality Check

Machine learning and behavioral analytics continue to grow and become synonymous with zero-day threat protection. Is this all hype or is it the new reality? The truth is, it is both.

There is a lot of hype, but for good reason: AI works. Big data is needed to see the behaviors and therein the anomalies or outright nefarious activities that human oversight would mostly fail to catch. Delivered as a layered security approach, AI is the only way to truly protect against modern cyber warfare, but not all AI is deterministic and herein lies the hidden cost to your bottom line.

AI-based analysis tools that provide forensics are very powerful, but the horse has bolted by the time they are used. This approach is akin to intrusion detection systems (IDS) versus intrusion prevention systems (IPS). The former are great for retrospective audits, but what is the cleanup cost? This usage of behavioral analysis AI solely for detection is not MSSP-friendly. What you need is automated, real-time breach detection and prevention. Prevention is key.

So, how do you create an effective prevention technology? You need security layers that filter the malware noise, so each can be more efficient at its detection and prevention function than the last. That means signature-based solutions are still necessary. In fact, they are as important as ever as one of the first layers of defense in your arsenal (content filtering comes in at the top spot).

By SonicWall metrics, the ever-growing bombardment of attacks the average network faces stands at 1,200-plus per day (check out the mid-year update to the 2018 SonicWall Cyber Threat Report for more details).

When you do the math, it’s easy to see that with millions of active firewalls, it’s not practical to perform deep analysis on every payload. For the best results, you must efficiently fingerprint and filter everything that has gone before.

Aren’t All Sandboxes Basically the Same?

Only by understanding the behavior of the application and watching what it’s attempting to do, can you uncover malicious intent and criminal action. The best environment to do this is a sandbox, but no SOC manpower in the world could accomplish this with humans at scale. In order to be effective, you must turn to AI.

AI understands the big data coming from behavioral analysis. It can adapt the discovery approach to uncover threats that try to hide and, once determined as malicious, can fingerprint the payload via signature, turning a zero day into a known threat. It is the speed of propagation of this new, known signature to the protection appliances participating in the mesh protection network that drives the efficiencies to discover more threats.

Also, it’s the size of the mesh network catchment area that allows you the largest overall service area of attaches, which helps your AI quickly learn from the largest sample data set.

Luckily, SonicWall has you covered on all these fronts. With more than 1 million sensors deployed across 215 territories and countries, SonicWall has one of the largest global footprint of active firewalls. Plus, the cloud-based, multi-engine SonicWall Capture Advanced Threat Protection (ATP) sandbox service discovers and stops unknown, zero-day attacks, such as ransomware, at the gateway with automated remediation.

Our recent introduction of the patent-pending Real-Time Deep Memory Inspection (RTDMITM) technology, which inspects memory in real time, can detect and prevent chip vulnerability attaches such as Spectre, Meltdown and Foreshadow. It’s included with every Capture ATP activation.

At SonicWall, the mantra of automated, real-time breach detection and prevention is fundamental to our security portfolio. It is how our partners drive predictable operational expenditures in the most challenging security environments. Only via connected solutions, utilizing shared intelligence, can you protect against all cyber threat vectors.


A version of this story originally appeared on MSSP Alert and was republished with permission.