In a major expansion and consolidation of its threat detection and response portfolio, SonicWall Inc. has announced a slew of new and updated security products, including multiple firewalls, a newly formalized cloud-based threat intelligence platform, and an updated edition of the company’s deep memory inspection technology that can find hidden malware in Microsoft Office documents and .PDF files.
†
Together with the rest of SonicWall’s product catalog, the new offerings are designed to continuously protect vulnerable end users by feeding real-time threat information from the cloud to locally-installed firewalls, mobile access appliances, and wireless access points. According to Steve Pataky, Milpitas, Calif.-based SonicWall’s senior vice president for worldwide sales and chief revenue officer, only such a mix of onsite and offsite defenses can keep businesses safe in a time of constantly evolving threats.
†
“Just having a firewall installed and turned on may not give the level of protection that’s needed,” he says.
†
Included within the new product wave are SonicWall’s first virtual firewalls and first web application firewall, both of which were previewed in February, as well as an updated set of midrange firewalls not previously disclosed.
†
The NSv line of virtual firewalls is designed to provide the same capabilities as SonicWall’s physical appliances in a software-based form factor suited to private and public cloud networks. It runs on the same SonicOS operating system as the company’s hardware-based security devices.
†
Equipped with deep packet inspection functionality and a real-time intrusion scanning engine, the SonicWall Web Application Firewall is designed to block denial-of-service attacks, context-aware exploits, and other attacks before they can impact solutions running in public, private, and hybrid cloud environments. Like the NSv offerings, it can be deployed locally on the VMWare and Microsoft Hyper-V virtualization platforms or offsite in the Amazon Web Services and Microsoft Azure public clouds.
†
SonicWall’s latest NSa firewalls are designed to give mid-tier organizations the tools and processing firepower needed to perform deep packet inspection of encrypted web traffic at high speed. Officially dubbed the NSa 3650, 4650, and 5650, those units support twice as many SPI connections as their predecessors and four times as many DPI-SSL connections. Those are capabilities businesses forced to process increasing quantities of SSL- and TLS-protected data badly need, according to John Gordineer, SonicWall’s director of product marketing.
†
“We’re seeing the amount of encrypted traffic that’s coming into an organization really take off,” he says. “You need a lot of horsepower and some heavy-duty processing on premises to be able to deal with that.”
†
The 2018 SonicWall Cyber Threat Report, which was published last month, states that 68 percent of all web traffic in 2017 utilized SSL or TLS encryption, a 24 percent increase over the previous year. While most of that data was legitimate, some of it harbored concealed malware.
†
The security strategy SonicWall has been rolling out gradually for the past several years couples on-premises products like the new firewalls shipped today with cloud-based threat intelligence resources. The company officially consolidated those previously-introduced online resources today under a common banner, the SonicWall Capture Cloud Platform.
†
“It’s not 2005 anymore,” Gordineer says of the continuous threat data provided by the Capture Cloud Platform. “You can’t have a device onsite that is updated maybe every time you load new firmware.”
†
Core elements of the Capture Cloud Platform include SonicWall’s Capture Client solution, also previewed in February, which is designed to work hand-in-glove with SonicWall firewalls to provide further assistance with mounting encrypted traffic volumes. Drawing on endpoint detection and response technology from SentinelOne, of Mountain View, Calif., the new system equips SonicWall appliances with machine learning-based continuous behavior monitoring functionality capable of intercepting malicious traffic in real time.
†
Significantly, SonicWall emphasizes, Capture Client automates the installation and management of TLS certificates on multiple devices, simplifying one of the most difficult aspects of DPI-SSL traffic analysis.
†
Other components of the Capture Cloud Platform, all previously released, include SonicWall’s Hosted Email Security solution, Capture Labs Threat Network, and Capture Advanced Threat Protection (ATP) system, a hosted sandbox service that assesses suspicious files and traffic before allowing it to exit the firewall onto the network.
†
That last system now draws on SonicWall’s Real-Time Deep Memory Inspection (RTDMI) technology to protect against malware hidden in .PDFs and Microsoft Office files. First unveiled in February, RTDMI utilizes patent-pending techniques to thwart the custom encryption schemes and other creative mechanisms hackers use to conceal dangerous payloads from traditional security solutions. The system forces malware that exhibits no malicious behavior to reveals its hidden weaponry, even if that code is encrypted and visible for intervals less than 100 nanoseconds.
†
“That component of our Capture ATP sandbox was able to find 3,500 never before seen attack variants through March of this year,” Gordineer says. “It’s incredibly effective at finding things that our other technologies don’t find and that other vendors don’t find.”
†
Adding support for .PDF and Microsoft Office files to RTDMI arms SonicWall customers to ward off an increasingly prevalent threat.
†
“In the last couple of years, vulnerabilities in Flash made Flash the most attractive attack vector,” Gordineer observes. “Now that’s switching, and .PDF and Office docs tend to be one of the most attacked file types.”
†
In conjunction with the official launch of the Capture Cloud Platform, SonicWall also previewed a major refresh of its Capture Security Center offering, which originally reached market under the name Cloud GMS. The revised edition of the cloud-based administration tool is engineered to provide single pane of glass control over everything from policy management and product licensing to security reporting and analytics.
†
Capture Security Center is scheduled to enter general availability on May29th. All of the other products SonicWall described today are either available now or will become available within the next few days.
†
SonicWall’s latest product wave arrives amid evidence that an already hazardous security landscape is growing even more treacherous. In data published today, SonicWall said that its customers experienced an average of 7,739 malware attacks each in the first quarter of 2018, up 151 percent from the same period last year. The Capture Cloud Platform identified over 49,800 new attack variants in the first three months of the year as well.
†
Seeking to ensure that end users always have access to skilled assistance from channel pros with all those threats, SonicWall added a managed security service provider partner specialization to its SecureFirst partner program last month.
†
