Okta and Palo Alto Networks have announced an expanded partnership that aims to unify AI-driven security and deliver improved automated threat response.

The agreement sees the introduction of two new integrations, the first of which combines Okta Workforce Identity with Palo Alto Networks’ Prisma Access Browser to create a conditional access method that restricts access to SSO apps to the secure browser.

Identity Threat Protection with Okta AI is also being integrated with Palo Alto’s AI-powered Cortex SecOps platform, extending to Cortex XSIAM and Cortex XDR, to equip organizations with a unified view of identity risks across their entire attack surface.

As AI continues to pose an increasing risk on user credentials, Stephen Lee, Okta’s VP of technology partnerships, said the integrations aim to help organizations incorporate identity into their infrastructure as part of a “fight AI with AI” approach.

"With Palo Alto Networks, Okta is proud to enhance the interoperability of our AI-powered platforms to prevent risks of siloed tools, providing nearly 2000 joint customers with a comprehensive view of their security posture, context-aware access controls, and secure authentication to stay ahead of today’s threats," he explained.

Secure access & threat detection gains

By integrating Okta Workforce Identity with the Prisma Access Browser, enterprises can now implement an additional defense layer for web-based activity.

This, the duo explained, will enable employees to securely access corporate web applications and data through the browser regardless of whether a device is managed or non-managed.

Security teams will gain enhanced visibility and control over SaaS and web application use, while users will benefit from a secure, consistent, and speedy browsing experience.

Additionally, the new integration between Okta and Palo Alto’s Cortex XSIAM and Cortex XDR offerings introduces additional authentication for risky access and user activity.

The combined capabilities tackle threats through automated responses such as revoking user access, ending active sessions, and quarantining of endpoints.

Fresh commitments to security

Okta and Palo Alto Networks said the new integrations reinforce their shared commitment to driving zero trust adoption while ensuring secure and seamless access for hybrid workforces.

Joint customers will benefit from a “clear, integrated path” to confidently secure operations while simultaneously reducing costs and complexity.

"Our deep integrations with Okta ensure that our solutions are engineered to work together, making it easier for our customers to achieve higher levels of security and user experience,” commented Pamela Cyr, Palo Alto Networks’ VP of technical partnerships.

“These new integrations, from securing application access with Prisma Access Browser to providing unified protection against identity threats through our Cortex platform, empower organizations with comprehensive, AI-driven defense."

MORE FROM CHANNELPRO

• MSPs are burned out and overworked as tool sprawl and IT complexity grows
• Brother UK revamps inkjet lineup to drive partner opportunities
• Effective Data and Cleo expand partnership to drive supply chain integration capabilities

If you need another reason to hate printers, you can add 'security risk' to the list.

A new study from HP Wolf Security reveals that printer security is routinely neglected, with businesses failing to carry out firmware upgrades.

Only 36% of IT and security decision-makers apply printer firmware updates promptly, even though IT teams spend an average of 3.5 hours per printer, per month managing security issues.

Steve Inch, global senior print security strategist at HP, said an often overlooked aspect of printer security is the fact they’re no longer just “harmless office fixtures”.

“They’re smart, connected devices storing sensitive data,” he said. “With multi-year refresh cycles, unsecured printers create long-term vulnerabilities.”

"If compromised, attackers can harvest confidential information for extortion or sale,” Inch added. “The wrong choice can leave organizations blind to firmware attacks, tampering or intrusions, effectively laying out the welcome mat for attackers to access the wider network.”

Printer security is becoming a nightmare

Security gaps are appearing at every stage of the product lifecycle, researchers found, with only 38% of respondents saying procurement, IT, and security teams collaborate to define printer security standards.

Six-in-ten believe this lack of cross-functional collaboration puts their organization at risk.

Meanwhile, 42% said they don't involve IT or security teams in vendor presentations, with 54% failing to request technical documentation to validate security claims, and 55% failing to submit vendor responses to security teams for review.

Nor do they check the printer’s integrity, with more than half saying they can't confirm whether the printer has been tampered with in the factory or in transit.

Moreover, once the printer does arrive, only 35% of IT decision makers said they could identify whether it was vulnerable based on newly published hardware or firmware vulnerabilities.

Only 34% can track unauthorized hardware changes made by users or support teams while just 32% can detect security events linked to hardware-level attacks.

Another key security risk highlighted by the study centers around when printers reach end of life. A majority (86%) of respondents said data security is a barrier to reuse, resale, or recycling.

More than a third said they were uncertain whether printers can be fully and safely wiped.

Notably, a quarter of respondents said they play it safe by physically destroying printer storage drives, and one-in-ten destroy both the storage drives and the device itself.

Enterprises need to get their act in order

HP Wolf Security said organisations need to foster closer collaborative ties between IT, security, and procurement teams on this front to bolster security and resilience.

This includes making sure they get security certificates for products and supply chain processes, the report noted.

Similarly, they should apply firmware updates promptly, use tools to streamline printer policy-based configuration compliance, and select printers with built-in secure erasure capabilities to enable safe recycling.

"By considering security at each stage of a printer’s lifecycle, organizations will not only improve the security and resilience of their endpoint infrastructure, but also benefit from better reliability, performance, and cost-efficiency over the lifetime of their fleets,” said Boris Balacheff, chief technologist for security research and innovation at HP.

MORE FROM ITPRO

• The best compact printers for your business in 2025
• HP's AI printer push continues with new edge capabilities and security features
• The best all-in-one printers for your business in 2025

Don’t be deceived by its modest dimensions: the Sophos XGS 116 is a security powerhouse. Aimed at busy SMBs and branch offices, this desktop appliance boasts a raw firewall throughput of 7,700Mbits/sec, and even with full threat protection enabled it keeps up a creditable 685Mbits/sec.

That’s largely thanks to Sophos’ dual-processor architecture. The Xstream Flow Processor provides a hardware acceleration layer that’s optimised for specific network tasks, ensuring the main AMD CPU doesn’t get bogged down.

Connection options abound. The rear panel presents eight Gigabit Ethernet ports – with PoE+ on the last one – plus one fibre port. While there’s no built-in modem, an expansion bay lets you add VDSL2 or 3G/4G modules, although Sophos’ Flexi network cards only work with larger rackmount models like the XGS 3300.

The flexible licensing model allows you to choose which features you want, and there are plenty on offer. We’ve shown the price of a three-year Xstream subscription above, which enables the base firewall licence along with Xstream TLS 1.3 SSL inspection, deep packet inspection, network, web and zero-day protection modules, central orchestration and enhanced 24/7 support. The email and web server protection modules are optional extras, each costing around £142 for a three-year licence.

Deployment is easy thanks to the appliance’s web console wizard, which guides you through the steps required to get secure internet access up and running. We chose routed mode as we wanted the appliance to provide all security functions; protection starts immediately, with the wizard enabling a standard set of firewall security policies including web filtering and anti-malware.

Henceforth, the Control Center dashboard provides everything you need to know about network activity and security issues. Graphs provide a clear visual overview of web traffic and network attacks, plus blocked and allowed applications and web categories. The User and Device Insights section keeps track of activity in modules such as SSL inspection, advanced threat protection and zero-day protection, and clicking on an icon takes you directly to a more detailed report.

Remote management comes into play too, via the Sophos Central portal. After we’d registered the appliance with our account, we were able to bring up live reports in a web browser, and to access the appliance’s Control Center console remotely for full configuration.

Businesses with home workers will love the Synchronised Security feature, which extends firewall protection to remote systems running the Sophos Intercept X endpoint agent. A heartbeat service monitors and automatically isolates any that are compromised, while the application control feature detects unknown applications running on endpoints and pushes out firewall policies to secure them.

All of this is controlled via policies that bring together firewall rules, service filters, schedules and specific settings for intrusion detection, email, applications and web filtering. That last feature is particularly impressive: the appliance comes with predefined settings to get you started, but you can choose to block or allow sites in over 90 categories. Application controls are equally extensive, with more than 3,500 predefined filters supplied, including 12 for Twitter and 73 for Facebook, so you can finely control social networking in the workplace.

A new filtering feature in the latest firmware also makes it easy to find specific rules within complex policies, and lets you reset traffic counters to zero with a click – a big improvement on the previous release, which required a reboot.

All told, the XGS 116 delivers strong gateway security measures at a great price. It has the power to cope with high demand, and the integration with Sophos’ endpoint security software will appeal to businesses that want to extend their protection to home workers.

Sophos XGS 116 specifications

WatchGuard’s latest M-series rackmount security appliances have a sharp focus on value and are designed to offer SMBs and mid-sized companies affordable enterprise-level gateway security. Stepping up as the entry point of the family, the Firebox M290 on review certainly hits this target: the price we’ve shown includes the appliance and a 3-year Total Security Suite (TSS) subscription which enables every feature WatchGuard has to offer.

Clothed in Watchguard’s customary fire engine-red chassis, this 1U rack appliance targets businesses with up to 75 users and boasts a high raw firewall throughput of 5.8Gbits/sec, dropping to 1.18Gbits/sec with all UTM services enabled. With the bulk of malware now being delivered over HTTPS-encrypted connections, the M290 has the horsepower to handle these inspection overheads, as it’s powered by a quad-core NXP LX1046A CPU partnered by 4GB of DDR4 system memory.

Network connections look good too, and the M290 presents eight Gigabit ports which can be used for WAN, LAN or DMZ duties. There’s room for even more via the expansion slot at the front, which supports an optional module with four copper or fibre Gigabit ports, or dual 10GbE SFP+.

On top of this, WatchGuard also offers a 4-port multi-Gigabit module with PoE+, but while you can use it in the M290, this appliance doesn’t support the required optional 54V power supply, so its PoE+ services will be disabled. If you want this functionality, you’ll have to opt for the M590 or the M690, as these are the only ones which fully support this module.

WatchGuard Firebox M290 review: Security features

WatchGuard offers two Firebox licence schemes so you could save some cash with the Basic Security Suite subscription. Available for one or three year periods and costing £2,077 exc VAT for the latter, this activates gateway antivirus (GAV), antispam, web filtering, HTTPS inspection, IPS, application controls, WatchGuard’s RED (reputation enabled defence) cloud-based URL filtering and secure software defined WAN (SD-WAN) services.

A TSS subscription includes all these features, but additionally augments them with WatchGuard’s advanced persistent threat (APT) blocker, plus its Threat Detection and Response (TDR) service with a 75 host sensor licence included. Malware protection is beefed up with IntelligentAV which uses the Cylance AI-based engine to scan files such as Office documents, Windows portable executables and PDFs after they’ve passed through the GAV scanner.

WatchGuard’s DNSWatch service also monitors client DNS requests and blocks access to known malicious domains. Remote monitoring and management via the WatchGuard Cloud portal is enabled across all subscriptions and TSS increases the log retention to 30 days.

WatchGuard Firebox M290 review: Management choices

Management choices are impressive - you can monitor and configure the M290 using its local web console and run WatchGuard’s free System Manager (WSM) suite on a separate Windows host to provide central management, logging and reporting services.

Next up is WatchGuard’s free Dimension software which is virtualized on a Hyper-V or VMware host. This provides a separate web console for viewing appliance utilisation, an executive dashboard, policy activity graphs and a global threat map, and enabling the optional Dimension Command feature brings Firebox management into play.

We think WatchGuard’s Cloud is a better choice than Dimension, as it provides all the same features without the need for a host system. You have two choices: you can keep local management enabled and set the appliance to send its logs to the cloud for monitoring and reporting, or disable local management and move it all into the cloud.

WatchGuard Firebox M290 review: Cloud deployment

Initial deployment is swift, as the appliance’s web console provides a quick start wizard which runs through enabling firewall-protected internet access and applying a base set of security policies. We had already registered the serial number of the M290 with our cloud support account so it grabbed our TSS feature key and applied it for us.

From our WatchGuard Cloud portal, we could see the appliance was available for allocation and selecting this offered two options: local management with cloud reporting and full cloud management. Initially, we chose the former and after a few minutes, a wealth of information from the M290’s activity logs started appearing in our portal including detailed views of traffic, web and application activity, all security services and the most active clients.

Swapping to full cloud management required the M290 to be deallocated, returned to our inventory and reallocated with this option selected. After running through WAN port setup and applying a new administrative password, the M290 disabled local management and only provided options to view its status, upgrade the OS and load the cloud portal.

WatchGuard Firebox M290 review: Cloud security settings

Configuring the M290 from the cloud portal is even easier than using its local web interface, as all security settings are accessed from a single web page. For content scanning, we could enable GAV and choose an action when a virus is detected, activate IntelligentAV with one click and set APT to drop traffic for high, medium and low threat levels.

Antispam uses policies for incoming SMTP, IMAP or POP3 traffic with options to allow, deny or tag suspect messages. The content filtering section provides access to the WebBlocker service which offers 130 URL categories that can be allowed, blocked or set to display a warning page to users.

WebBlocker actions are applied with firewall rules and are also used to manage the application control service. This presents nearly 1,300 predefined app signatures, including 12 sub-categories for all Facebook activities, making it easy to block or control its use in the workplace.

WatchGuard Firebox M290 review: Verdict

The Firebox M290 is an attractive choice for SMBs; it combines a superb range of security measures and delivers them at a sensible price. We found it easy to deploy and configure, with WatchGuard’s Cloud portal providing excellent remote management and monitoring features.

WatchGuard Firebox M290 specifications

The XGS family of security appliances represent a radical shift in direction for Sophos as they take over from the older XG models and deliver a new dual processor architecture. Built around Xstream flow processors, they provide a hardware acceleration layer which Sophos reckons can realise a minimum two-fold performance boost over equivalent XG models by removing much of the workload from the main CPU.

This is no idle claim: the XGS 3300 we have on review boasts a massive firewall IMIX (internet mix) throughput of 24.5Gbits/sec, dropping to 13.4Gbits/sec with IPS enabled. By contrast, the XG 330 it replaces could only muster equivalent throughputs of 12.5Gbits/sec and 8.5Gbits/sec respectively.

Intel gets the elbow too, as the Xeon E3 v5 CPUs in the XG range have been replaced by AMD’s Ryzen Embedded V1000 series, sporting a 3.35GHz quad-core V1780B SoC (System on Chip). This is partnered by 16GB of DDR4 memory while firmware, log and report storage is handled by an internal 240GB SATA SSD.

Sophos XGS 3300 review: Licensing and deployment

Aimed at distributed edge deployments in large SMBs and mid-sized organisations, this 1U rack appliance presents eight copper and two SFP fibre Gigabit, plus dual SFP+ fibre 10GbE ports. It offers one Flexi expansion slot which accepts two-, four- and eight-port Gigabit and 10GbE modules, but be aware that it doesn’t support those from the older XG range.

Licensing has changed quite a bit too and you can customize features by choosing which protection modules you want. The Xstream bundle enables base firewall features including Xstream Network Flow FastPath along with TLS 1.3 and deep packet inspection, and adds the network, web and zero-day protection modules, central orchestration and enhanced 24/7 support. This doesn’t include the email and web server protection modules though, which are available as optional extras.

A dedicated management port is provided and we found initial deployment via the browser-based quick-start wizard swift. After insisting we secured administrative access, it helped set up LAN and WAN port address assignments plus DHCP services and provide an email address for alerting.

We chose routed mode, as we wanted the appliance to provide all security functions including firewalling. Protection starts immediately, with a base set of firewall security policies created for you which enable web filtering and anti-malware.

Sophos XGS 3300 review: Management services

The local web console opens with a very informative Control Center dashboard presenting a detailed overview of network activity, security issues, web traffic, detected network attacks plus blocked and allowed applications and web categories. The User and device Insights section is particularly useful as it provides active icons for functions such as zero-day protection. Clicking on these shows downloaded files that have been sent to the Sophos cloud sandbox for detonation and analysis to see whether they are safe to release.

If you have a Sophos Central account, you can manage the firewall remotely as well. It’s dead easy, too; after registering the XGS 3300 with our cloud account, we were able to view live reports from the portal and configure it using exactly the same console as the local one.

Sophos Central has another trick up its sleeve, and its endpoint agents can be brought under the firewall’s control with the Synchronized Security feature. This uses a heartbeat service to monitor endpoints running the Intercept X agent and if any are compromised, a firewall policy with a minimum heartbeat setting isolates all systems in the same zone.

The SAC (synchronized application control) feature also works with this service, as it detects unknown applications and pushes out firewall policies to control them. Cloud apps get the same tough love: the dashboard insights section lists all those detected and you can classify each one as sanctioned or unsanctioned and apply a traffic shaping policy to control their use.

Sophos XGS 3300 review: Security and reporting

The XGS 3300 is highly versatile, and you can place its ports in different zones and apply custom security policies to each one. Policies contain firewall rules for sources and destinations, service filters, blocking actions and time schedules and you can apply custom policies for web filtering, IPS and application controls.

The new filtering option makes it easy to find a specific rule in the list and firewall rule traffic counters for selected policies can now be reset back to zero from the web console without having to reboot the appliance. You don’t need to change rule priorities in policies with drag and drop either, as they can be reordered directly from the policy drop down menu.

There are plenty more security features to play with; web filtering offers 86 URL categories to block or allow while application controls currently provide 3,532 predefined apps. If you want Facebook gone from the workplace, you’ll be pleased to know Sophos provides 73 app categories covering every possible social activity.

Reporting is a standard feature on all XGS models with the web console providing a wealth of information on all things security related. The reports option in the web console’s side menu loads a variety of dashboards and graphs showing detected threats, malware and web content filtering activities, offers reports for key compliance standards, and all their content can be exported in PDF, HTML and CSV formats.

Sophos XGS 3300 review: Verdict

The XGS 3300 is easy to deploy, although the sheer range of security features may present new users with a steep learning curve for ongoing configuration. Sophos does provide copious online documentation and videos but it’s a lot to wade through and it still refers to the XG firewalls.

Overall though, the XGS 3300 is clearly a very powerful and well-endowed firewall appliance. The network ports and zones make it very versatile, the latest SFOS 18.5 software adds many features designed to ease management, and integration with Sophos Central allows it to extend its protection umbrella to remote workers.

Sophos XGS 3300 specifications

As an all-in-one security gateway, Ubiquiti’s UniFi Dream Machine Pro takes some beating. This sleek 1U rack appliance provides gateway, routing, VPN and firewall services, plus threat protection, deep packet inspection and wireless network management too, courtesy of the integrated UniFi Controller. Slot a hard disk into the front-facing bay and the appliance can even be used as a recording vault for UniFi IP surveillance cameras.

Connectivity is well covered, as the appliance incorporates a managed eight-port Gigabit Ethernet switch, alongside a Gigabit WAN port and two 10GbE SFP+ high-performance fibre ports for LAN and WAN duties. And the UDM Pro is no lightweight when it comes to performance: Ubiquiti claims a high firewall throughput of 3.5Gbits/sec with IDP/IPS enabled – quite remarkable at this price point. It’s achieved thanks to a speedy 1.7GHz quad-core ARM CPU, partnered with a generous 4GB of DDR4 RAM and 16GB of flash storage.

The one thing that’s notably missing is a built-in wireless access point: the desktop Dream Machine includes its own AP, but that wouldn’t make a lot of sense in a metal rack cabinet. Power over Ethernet isn’t supported either, but you can combine the appliance with one of Ubiquiti’s affordable PoE switches; we used its USW-Pro-24-PoE model for testing.

Gateway installation is a cinch. After connecting the appliance’s WAN port to an internet line, we used the UniFi Network iOS app on an iPad to discover the Dream Machine over Bluetooth. The app’s quick-start wizard then linked it to our Ubiquiti cloud account and automatically installed the latest firmware.

From here on, you can use the UniFi web portal to access the Network and Protect apps. The Network page opens with a smart dashboard of graphs showing measured internet speeds, most active clients and applications, client device types and wireless experience scores. Everything you need to know about your networks is on hand, with a detailed topology view, lists of all managed UniFi devices and connected clients, plus a complete breakdown of all traffic. The latter includes pie charts for web, media streaming, file sharing, network protocols and more, along with breakdowns of upstream and downstream traffic.

As for protection, deep packet inspection is enabled by default; you can either activate passive IDS to alert you to intrusions, or use IDP to block them, choosing a detection sensitivity level and selecting the types of threats you want to be protected against. URL content filtering can be applied too, with separate settings for work or home environments.

We were also able to use the iOS app to add the USW PoE switch to our account, and were blown away by its clever augmented reality (AR) feature: point your device camera at the ports and a live overlay immediately pops up, showing which ones are active and what’s connected to them.

For wireless testing we connected a set of UniFi nanoHD access points to the PoE switch and added them to our cloud account. Once online, they started broadcasting our predefined SSIDs and guest networks, with details automatically appearing in the portal’s wireless experience graph.

Video surveillance is just as easy to set up. The appliance accepted our Seagate 10TB SATA drive without a murmur and instantly made it available for recording incoming video. After we’d added a UVC G4 Bullet IP camera to our account, we were able to view its live feed from the portal, enable smart detection and set up custom motion-detection events and recording actions.

The UniFi Dream Machine Pro is an impressive piece of kit to say the least, delivering an incredible range of easily managed features at an unbelievably low price. There are some great UTM appliances on the market, but the Ubiquiti simply does it all.

Ubiquiti Networks UniFi Dream Machine Pro specifications

Security researchers have said that a zero-day flaw in a security appliance from Palo Alto Networks could affect around 10,000 servers running the product.

Researchers at cyber security firm Randori said that flaw, tracked as CVE-2021-3064, affected PAN firewalls using the GlobalProtect Portal VPN and allowed for unauthenticated remote code execution on vulnerable product installations.

They added that the problem affected multiple versions of PAN-OS 8.1 before 8.1.17. Researchers found numerous vulnerable instances exposed on internet-facing assets, more than 10,000 assets.

“Our team was able to gain a shell on the affected target, access sensitive configuration data, extract credentials, and more. Once an attacker has control over the firewall, they will have visibility into the internal network and can proceed to move laterally,” said researchers.

Researchers developed a reliable working exploit and leveraged the capability as part of their red team products. The flaw was discovered over a year ago.

The bug is a buffer overflow that occurs while parsing user-supplied input into a fixed-length location on the stack. The problematic code is not reachable externally without using an HTTP-smuggling technique, according to researchers.

They added that the exploitation of these together yields remote code execution under the privileges of the affected component on the firewall device. “The smuggling capability was not designated a CVE identifier as it is not considered a security boundary by the affected vendor,” added researchers.

An attacker must have network access to the device on the GlobalProtect service port (default port 443) to exploit this vulnerability. As the affected product is a VPN portal, this port is often accessible over the internet, said researchers.

Exploitation is difficult but possible on devices with ASLR enabled, which is the case in most hardware devices. On virtualized devices — VM-series firewalls — exploitation is significantly easier due to lack of ASLR and Randori expects public exploits will surface.

“Randori researchers have not exploited the buffer overflow to result in controlled code execution on certain hardware device versions with MIPS-based management plane CPUs due to their big-endian architecture, though the overflow is reachable on these devices and can be exploited to limit availability of services,” they added.

The company said to avoid enabling misuse of the flaw, it will withhold the technical details related to CVE-2021-3064 from public dissemination for 30 days after the publication of the blog post on the subject.

Cyber security company SonicWall has urged customers to patch its enterprise secure VPN hardware to thwart an “imminent ransomware campaign using stolen credentials.”

This week, the company issued a notice saying customers who do not take appropriate actions to mitigate these vulnerabilities on their SRA and SMA 100 series products could be at risk of an attack.

The products in question are those running unpatched and end-of-life (EOL) 8.x firmware. SonicWall said researchers at security firm Mandiant informed SonicWall that threat actors were actively targeting models that are no longer supported.

“SonicWall PSIRT strongly suggests that organizations still using 8.x firmware review the information below and take immediate action,” said the company.

Since at least June, the attacks have been happening when cyber security firm Crowdstrike had warned that attacks against devices were ongoing.

“CrowdStrike Services incident response teams identified eCrime actors leveraging an older SonicWall VPN vulnerability, CVE-2019-7481, that affects Secure Remote Access (SRA) 4600 devices; the ability to leverage the vulnerability to affect SRA devices was previously undisclosed by SonicWall,” it said.

“CrowdStrike Intelligence researchers confirmed that CVE-2019-7481 affects SRA devices running the latest versions of 8.x and 9.x firmware, and that the latest versions of Secure Mobile Access (SMA) firmware do not mitigate the CVE for SRA devices.”

SonicWall told customers with end-of-life SMA and SRA devices running firmware 8.x to either update their firmware or disconnect their appliances.

“If your organization is using a legacy SRA appliance that is past end-of-life status and cannot update to 9.x firmware, continued use may result in ransomware exploitation,” the company warned.

Andy Norton, European cyber risk officer at Armis, told ITPro that the immediate requirement for SonicWall customers is to profile their asset estate for SMA and SRA 100 devices and take appropriate isolation action until the patch can be applied or the devices can be retired from service.

“The Cybersecurity Infrastructure Agency, CISA, under the new "StopRansomware" campaign has just announced guidance to stop two bad practices that aid the spread of ransomware,” he said.

“The first of which highlights that the use of unsupported (or end-of-life) software in service of Critical Infrastructure and National Critical Functions is dangerous and significantly elevates risk to national security, national economic security, and national public health and safety. This dangerous practice is especially egregious in internet-accessible technologies. This SonicWall announcement ticks the CISA box for 75% of the models that are under attack."

Not all businesses require a complete UTM solution, and Zyxel’s USG Flex 100 is perfect for those that only want to pay for the security services they need. That makes it a good starting point for small organisations – and it’s also a natural upgrade for users of Zyxel’s older USG40 appliance, as you can transfer your licences across.

Performance-wise, it’s a decent step up from the USG40. The USG Flex 100 claims a raw firewall throughput rate of 900Mbits/sec and 360Mbits/sec with all UTM features active, representing speed boosts of 125% and 500% over the USG40.

The cost of entry is very low: the hardware on its own costs £309, and no subscription is needed for firewall and VPN services. The price we’ve shown above includes a year’s subscription to the full UTM security pack, which activates web filtering, application and email security, IPS, antivirus, and Zyxel’s SecuReporter web-based analytics and reporting service. After the first year, you can license features individually or renew the full UTM licence for £160 per year.

The appliance is easy to set up: a web-based wizard guides you through changing the default admin password, enabling internet access, upgrading the firmware, registering the appliance to your myZyxel account, activating your security services, and enabling a default firewall policy. The SecuReporter service is also turned on at this point; since it stores data in the cloud, you’re prompted to decide whether to include personal information such as email addresses and usernames.

Once you’re all set up, logging into the USG Flex 100 presents a highly informative web console, showing an overview of appliance usage and port statistics. The advanced threat-protection dashboard reports on any detected issues, with multiple views for the past seven days showing what each security service is up to, the top apps and detected threats.

As usual, policies bring together settings for the Flex 100’s various modules. By default, all the LAN ports are subject to the same policies, but it’s the work of a moment to move a port into its own zone, with its own security settings.

There’s plenty to configure: Zyxel’s Application Patrol service works with over 3,600 apps, which come tidily sorted into 32 categories for easier management. It’s particularly capable when it comes to managing Facebook usage in the workplace, with specific controls for a range of activities including logins, likes, follows, posts, and games.

Web filtering is another strong feature, allowing you to browse 104 categories of site and decide whether to allow, block, or log access. Email security is similarly simple to enforce, with options to drop spam messages or tag their subject line for ongoing processing.

The one feature that’s glaringly absent is cloud management: while Zyxel appliances can normally be managed from the company’s Nebula web portal, USG Flex models aren’t supported. That shouldn’t be a permanent limitation, though: Zyxel says it plans to add Nebula integration in the ZLD 5 firmware release.

Until then, the SecuReporter cloud portal is the next best thing, allowing you to access reports from multiple Flex firewalls via a single account. Its dashboards provide a wealth of information about web, app, and threat activity, while the Analyser page offers deeper insights into security issues and custom reports can be regularly generated and sent to multiple recipients.

Businesses that have an immediate need to extend protection to remote offices and homeworkers might need to look elsewhere. However, for single-site organisations, the Zyxel USG Flex 100 is a great choice, giving you plenty of control over costs and features, plus classy reporting services.

Zyxel USG Flex 100 specifications

This whitepaper provides a technical overview of Veritas Access Appliance as a secondary storage solution with IBM Spectrum Protect for backup, archival and long-term retention. It highlights the overall solution architecture components, integration flow, best practices, sizing guidance, and deployment of Access Appliance with IBM Spectrum Protect.

Zoom has started rolling out end-to-end encryption (E2EE) to both free and paying users.

E2EE is now available in technical preview on the Zoom desktop client version for macOS and Windows, the Zoom Android app and Zoom Rooms, with the Zoom iOS app currently pending App Store approval.

Zoom’s E2EE uses the same 256-bit AES-GCM encryption that secures Zoom meetings by default. Account administrators can enable the feature in the web dashboard at an account, group, and user level, and participants must also enable the feature to join a meeting with end-to-end encryption.

When E2EE is enabled, nobody except each participant - not even Zoom’s meeting servers - has access to the encryption keys that are used to secure the meeting.

However, the company has warned that at least in the first stage of the four-phase rollout, E2EE will block certain Zoom functions, including cloud recording, streaming, live transcription, Breakout Rooms, polling, 1:1 private chat, and meeting reactions.

“End-to-end encryption is another stride toward making Zoom the most secure communications platform in the world,” said Zoom CEO Eric S. Yuan.

“This phase of our E2EE offering provides the same security as existing end-to-end-encrypted messaging platforms, but with the video quality and scale that has made Zoom the communications solution of choice for hundreds of millions of people and the world’s largest enterprises.”

Phase 2 of the E2EE rollout is "tentatively roadmapped" for 2021, according to Zoom.

The rollout of end-to-end encryption comes five months after Zoom initially announced plans to add support for the security standard. However, at the time it said it would only be available for businesses and institutions that pay for a premium Zoom subscription. Following backlash from users and privacy activists, Zoom backtracked two week's later and announced that it would make E2EE available to both free and paying users.

This unit may look like a regular router, but don’t be fooled - DrayTek’s Vigor 2862 is a bona fide security gateway, with optional remote management via the cloud-hosted VigorACS 2 service.

To be sure, it’s not as feature-packed as some chunkier, more expensive options. Notably, the Vigor 2862 doesn’t offer antivirus services, nor any sort of spam filtering. You do, however, get a 400Mbits/sec SPI firewall, plus a good range of web-filtering and app-control options.

The Vigor 2862 will also make your day if you’re looking to provide secure connections for remote staff, as it supports up to 32 concurrent IPsec VPN tunnels and 16 simultaneous SSL connections, via DrayTek’s free Smart VPN client for Windows, macOS, iOS and Android.

And while the appliance doesn’t have built-in wireless services, it does include DrayTek’s Central AP Management (CAM) feature for discovering and provisioning up to 20 DrayTek wireless APs – and it can discover and centrally manage up to ten DrayTek VigorSwitch devices.

We found installation was easy. The web console provides a quick-start wizard for changing the default admin password and configuring internet access, and additional wizards are provided for enabling DrayTek’s free DDNS service and setting up VPNs. This latter task is a cinch, and VPN performance isn’t bad: testing with an external Windows 10 PC running the Smart VPN client, we saw file copies to a LAN system complete at a respectable 2.3MB/sec. Don’t get carried away with multiple SSL VPN connections, though, as during our tests we saw appliance CPU utilisation occasionally peaking as high as 88%.

Configuring the firewall isn’t too complicated, either. It’s all based on filters, which manage your incoming and outgoing traffic. Each filter comprises up to seven rules, defining specific traffic types and directions, along with a load-balancing policy and QoS priorities.

Filters can also define behaviours for the app-control service – a free extra that we activated from our MyVigor account after registering the router. You can manage various protocols and decide what to do with remote-control, tunnelling, streaming and web connections, as well as setting policies for IM and P2P apps and social media sites. As a test, we created an enforcement rule for Facebook and added it to the firewall filter – after which users on our network instantly found they were unable to log into their accounts.

The Vigor 2862’s standard web-filtering provision is a rudimentary thing, based solely on keywords, but for just £38 a year you can upgrade to DrayTek’s much more powerful GlobalView service. This employs the Cyren web filter, which lets you decide whether to block or allow 64 different categories of site, and shows a warning message if users attempt to access a blocked page.

One last strength of the Vigor 2862 is its degree of WAN redundancy. Alongside a built-in ADSL2+/VDSL2 interface, the router features a pair of USB 2 ports that can both accept 3G/4G LTE USB modems, and one of its five Gigabit Ethernet ports can be used for a WAN link as well, for a total of four separate connections. It’s up to you whether you have these all active at the same time – in which case the router will perform load balancing across them – or whether you set specific ones as failover provisions. The new high-availability feature even allows you to deploy two routers in parallel, sharing a single virtual IP address, in either hot-standby or active-standby failover modes.

For the price, the DrayTek Vigor 2862 offers a remarkable range of security features. It might not have the grunt to cope with lots of simultaneous VPN connections, but its multitude of filtering and WAN options make it ideal for budget-conscious SMBs that need a secure and stable internet connection.

Draytek Vigor 2862 specifications

Sophos’ newest SMB security appliance comes straight in at the top of the range. Taking performance to new heights, the XG 135w Rev. 3 quotes a huge raw firewall throughput of 8Gbits/sec, and a decent 1.2Gbits/sec with all security services enabled.

It’s not just fast, but versatile too. In addition to eight copper Gigabit Ethernet ports and one SFP fibre port, it presents dual-band 802.11ac wireless services, while an expansion slot allows you to add optional DSL, 3G/4G or Gigabit SFP cards – or a second Wi-Fi module.

Another strength is the price. The figure we’ve shown above includes a one-year TotalProtect Plus subscription, which covers the network, web, email and web server protection modules, along with Sophos’ Sandstorm cloud sandbox and a FullGuard Plus support subscription. You don’t necessarily have to keep paying that, though: the cost of the base appliance includes a perpetual licence for firewall, VPN, authentication and secure wireless management services.

The browser-based installation wizard helps you hit the ground running, stepping you through the business of securing admin access, sorting out the LAN and WAN ports, creating main and guest wireless networks, installing the latest firmware and setting a base security policy so your users are protected from the outset.

You’re then taken to the main dashboard, which presents an informative overview of network activity and security issues, with graphs and charts detailing traffic statistics and blocked applications. Reporting options are excellent: Sophos’ iView platform provides a wealth of graphical information about security services, app and web activity, threats, mail usage and more.

If you need to divide your users into different security groups, that’s no problem. The appliance’s ports can be assigned to different zones, each with its own firewall rules and policies for web filtering, IPS and application controls. These are easy to set up, as the appliance comes with 91 predefined website categories and over 3,400 predefined app profiles, including 73 solely relating to Facebook activities.

For finer control, it’s also possible to apply identity-based rules to specific users and groups, including daily bandwidth restrictions and limits on daily, weekly, monthly and even yearly internet usage. Sophos provides a free Client Authentication Agent (CAA) for Windows, although you have to download the certificate from the appliance and import it on all workstations.

A third way to segment your protection is by using more than one wireless network: the appliance can broadcast up to eight SSIDs, each with its own encryption scheme, DHCP, client isolation and masking settings. Placing these SSIDs in separate network zones lets you provision guest wireless access and apply firewall rules and security policies.

One last strength of the XG 135w Rev. 3 is that it’s fully manageable via the cloud. After we’d registered the appliance with the Sophos Central web portal, it presented exactly the same interface as the local console. It’s even possible to manage endpoints outside of your local network through Sophos’ Synchronised Security service. The dashboard shows all remote devices running the endpoint agent, and if any get compromised, you can automatically quarantine the network zone they’re located in.

The XG 135w Rev.3 impressed us mightily. It offers a good breadth of security features, yet is easy to set up, and to manage remotely – and it delivers great performance at a reasonable price.

Sophos XG 135w Rev. 3 specifications

Gateway security often involves a performance trade-off, but WatchGuard’s Firebox T70 is designed for SMBs who aren’t willing to compromise. It’s the vendor’s first appliance built on an Intel CPU, which enables it to deliver high-speed deep packet inspection of HTTPS traffic – something many rival appliances struggle with.

Indeed, the T70’s numbers are impressive across the board. It claims a raw firewall throughput of 4Gbits/sec, and a remarkable 1.1Gbits/sec with all UTM services enabled. You don’t have to pay a steep premium for this performance either: the appliance costs a competitive £2,366 exc VAT, including a one-year subscription to WatchGuard’s Total Security Suite.

That subscription unleashes a wealth of security measures. Along with the aforementioned DPI, you get gateway antivirus, anti-spam, web-content filtering, application controls, network discovery, IPS, data-loss prevention and an advanced persistent threat (APT) blocker. Web security is bolstered by WatchGuard’s Reputation Enabled Defense service, and the included Gold Support provides a free remote setup session with a WatchGuard engineer.

To be honest, though, we had no problem getting set up on our own. The appliance’s web console took us through the initial setup procedure, which involved securing admin access, enabling firewall-protected internet access and applying a base set of security policies.

Additional wizards are then on hand to help you set up the various proxies that manage HTTP, HTTPS, FTP, SIP, POP3 and SMTP traffic. It’s notably easy to set up web-content filtering: WatchGuard offers 130 URL categories to choose from, and you can simply pick those you want to block. Similarly, the T70’s application control module can manage access to hundreds of predefined apps, so it’s a piece of cake to control what’s allowed in the workplace.

Gateway AV scanning is enabled on selected proxies too, and alongside basic malware detection, the IntelligentAV feature uses the Cylance AI-based engine to analyse files such as Office documents and PDFs. For anti-spam services, all you need to do is select whether you want to inspect SMTP, IMAP or POP3 traffic, and whether spam messages should be blocked or merely tagged. The APT service, meanwhile, generates hashes of inbound files and checks them with the Lastline cloud service to see if they match the signatures of any known threats.

Finally, that fast deep packet inspection feature we mentioned is enabled within the HTTPS proxy action. Here you just need to choose the domain names and WebBlocker categories you want it to inspect, then import the predefined proxy authority certificate to your computers.

One feature the T70 lacks is Wi-Fi services, but it can centrally manage other WatchGuard APs, pushing out wireless settings and applying security policies to their traffic. It can even power your APs, as PoE+ is provided on the sixth and seventh Ethernet ports.

And the T70 is ideal for those who like the idea of multiple-choice management, as you can use either its local web console or WatchGuard’s Dimension management platform (which we run in a Hyper-V VM in our lab). It’s also possible to link the T70 to a WatchGuard Cloud account, allowing you to remotely check on security services, detected threats and appliance performance; proper cloud-based configuration isn’t supported, but it’s promised soon.

If you’re seeking tough perimeter security that won’t slow down your network, the Firebox T70 is a superb choice. It’s easy to deploy and manage, it’s loaded with features and it’s powerful enough to cope with high demand.

WatchGuard Firebox T70 specifications

Zyxel’s security appliances divide into two families: the USG models are designed for local administration, while the NSG range can be managed from anywhere in the world using Zyxel’s Nebula Control Center (NCC) cloud platform.

The model we tested this month is the NSG200, which is aimed at small offices, and the price shown includes your first year’s subscription to Zyxel’s Nebula Security Pack. This enables IDP, application control, content filtering and antivirus security services on the appliance, and also upgrades your access to the NCC console. The basic free service has limited features, including a logging limit of just seven days, but your Security Pack licence enables Nebula Professional, which gives you a full year’s worth of logging and adds other worthwhile features such as email alerts and auditing.

The web portal is easy to use, although you might find yourself wishing the main dashboard were more customisable; it provides an overview of your security and network status, but also dedicates space to details of Nebula-enabled wireless APs and switches – even if you don’t have any. Still, the new NCC console is already in beta, and this will let you choose which widgets you want to display on the dashboard, while also ditching the dark look in favour of a brighter colour scheme.

One big benefit of the NSG200’s cloud-based design is that it enables zero-touch deployment. Before you even unbox the appliance you can set up a top-level organisation in NCC, add sites below it and configure a security profile to be pushed to the device as soon as it’s added to a site. This can include antivirus and IDP services, and settings for the application control service – which Zyxel cutely calls “application patrol” – to manage access to over 3,000 apps, including Facebook and Twitter. There’s a web-content filtering service too, which lets you block access to any of 64 site categories.

All of this makes the NSG200 ideal for businesses with remote offices, as it means you can simply send the appliance to the desired location and it will automatically pick up all the appropriate settings as soon as it’s plugged in. The self-configuration process takes around five minutes, and once it’s up and running the NSG200 will also regularly check for firmware updates, and apply them either in the background or at nominated times.

In fact, the most inconvenient part of setting up the NSG200 might be registering the appliance, as the web portal asks you to manually type in the unit’s MAC address and serial number. There’s an easier option, though: we simply used Zyxel’s iOS app to scan the QR code printed on the NSG200’s box. This captured the MAC address and all other required details, enabling us to add the appliance to an active site with a single tap.

As well as setting up security services, the NCC portal lets you configure the appliance’s two Gigabit WAN and five Gigabit LAN ports. If you have two internet connections, you can have both WAN ports active at the same time, and apply load balancing across them; the LAN sockets, meanwhile, can be divided into two groups, each with its own IP address and DHCP settings, and optional bandwidth limits applied to client IP address ranges and destinations.

Custom firewall rules can be set too, including sources, destinations, protocols, actions and a time schedule, and captive portals can be presented to guest users, complete with custom logos and AUPs.

In short, the Nebula console offers all the management options you’re likely to need, and the NSG200 itself is temptingly priced. It works best when partnered with Zyxel’s Nebula-enabled wireless APs and switches, but even on its own it provides a fine spread of security features for SMBs seeking a cloud-based gateway security solution.

Zyxel NSG200 specifications

Stepping in to the middle of WatchGuard's desktop security appliance family, the Firebox T55-W is equally at home protecting SMEs, remote workers or branch offices. Clothed in the classic bright red Firebox chassis, this desktop box delivers an impressive range of security measures and amalgamates them with integral 11ac dual-band wireless.

It may be small but it's no lightweight for performance, with WatchGuard recommending it for up to 30 users and claiming a 1Gbits/sec raw firewall throughput and 523Mbits/sec with all UTM services enabled. It has five Gigabit ports for WAN, LAN and DMZ duties with PoE+ presented on the fourth LAN port.

The appliance doesn't give the wireless game away as its aerials are tucked away inside the chassis. Another useful wireless feature present on all Firebox appliances is their integral gateway controller which can centrally manage and provision WatchGuard's own APs.

WatchGuard Firebox T55-W: Security features

Prices starting at 960 for the hardware, plus a one-year 24/7 support contract and all software updates. Where you go from here is up to you; suffice to say that WatchGuard offers plenty of choice.

A one-year Basic Security Suite subscription pushes the price to 1,293 and activates anti-virus, anti-spam, web filtering, HTTPS inspection, IPS, application controls and WatchGuard's reputation enabled defence. The price we've shown is for a three-year Total Security Suite subscription which adds WatchGuard's data leak prevention (DLP) and advanced persistent threat (APT) blocker service.

Along with a Gold 24/7 support contract, Total Security includes WatchGuard's RED (reputation enabled defence) service. Web access requests send the URL to WatchGuard's RED cloud servers where they assign a score and instruct the appliance to either allow or block it.

VPN services are extensive as the T55-W supports site-to-site IPsec tunnels plus mobile IPsec, PPTP and L2TP clients along with SSL VPNs. Note that the new Access Portal feature which provisions secure, client-free VPN connections, is not supported on the Firebox 'T' models.

WatchGuard Firebox T55-W: Installation and management

The T55-W is easy to deploy: the web console runs a wizard to secure the appliance and get Internet access running on an external port along with DHCP services on the first trusted LAN interface. Large distributed businesses will like WatchGuard's RapidDeploy cloud service as they can send new appliances to remote offices and have them receive a configuration file as soon as they are powered up.

The wizard defaults to the flexible mixed-mode routing which allows wired and wireless ports to be defined as separate interfaces. Configuring the remaining ports is a cinch as we defined them as external, trusted, optional or custom and added DHCP services on selected trusted ports.

WatchGuard's browser interface is well-designed and standard across all Firebox appliances. It opens with a tidy dashboard showing a breakdown of traffic for the top clients, web destinations, policies and applications with options to drill down for more detail on each entry.

Management choices are extensive, and you can load the WatchGuard System Manager (WSM) suite on a separate Windows host to provide central management, logging and reporting services. We run WatchGuard's Dimension as a VMware VM in the lab and after linking it to the T55-W, used it for viewing appliance utilisation plus an executive dashboard, global threat map and policy activity graphs.

WatchGuard Firebox T55-W: Rules and proxies

The T55-W uses proxies for all security services and there are plenty to choose as you have ones for HTTP, HTTPS, FTP, SIP, H.323, POP3 and SMTP. Firewall rules are created for each proxy which define the interfaces they apply to and their actions - and WatchGuard provides wizards for all of them.

Highly granular web content filtering policies are possible where you choose from 130 Websense URL categories, enable blocking actions on the HTTP and HTTPS proxies, add exceptions and enable alerting. Anti-spam measures are just as easy to configure; you can select incoming SMTP, IMAP or POP3 traffic and block or tag spam messages.

Gateway AV scanning can be enabled on selected proxies, which you'll need running if you want to enable the APT service. This scans inbound files, creates MD5 hashes and checks them with the LastLine cloud service to see if they're known malware.

We noticed that Dimension was reporting a total appliance memory usage of between 65-90% and WatchGuard advised us this is due to the demands of the new BitDefender AV engine. It can get close to the edge although we didn't encounter any performance issues during testing.

WatchGuard Firebox T55-W: Wireless features

The T55-W can present up to three separate APs that act as DHCP relays or provide their own DHCP services. Along with all key encryption schemes, their SSIDs can be broadcast or hidden and you can apply client isolation so users on the same wireless network can't see each other.

Global wireless settings include 2.4GHz and 5GHz radio modes, a choice of channel widths and protection against the WPA/WPA2 KRACK vulnerability for unpatched wireless clients. Rogue AP detection can be enabled - but be careful when you schedule it as it will temporarily disable the appliance's APs while it's running.

If you want more APs, you can add any of WatchGuards's four available models and pair them with the appliance's wireless gateway controller. Once paired, you can assign SSIDs to their dual radios, enforce wireless security and apply custom firewall policies to the ports they are connected to.

WatchGuard Firebox T55-W: Verdict

The T55-W is a versatile security appliance that's well-suited to deployments in SMEs and enterprise branch or remote offices. For the price, it's offering a remarkable range of easily configured security features, all management components are inclusive and the icing on the on the cake is its integral wireless network services.

Verdict

SMEs that want tough gateway security, a good range of wireless services and a low price will find WatchGuard’s T55-W ticks all their boxes

Chassis: Desktop

Memory: 2GB RAM

Network: 5 x Gigabit (Port 4 with PoE)

Wireless: 2.4/5GHz 802.11ac

Other ports: 2 x USB 2, RJ-45 serial

Power: External PSU

Management: Web browser, WatchGuard Dimension/Command

Warranty: 3-year Gold 24/7 support

Sophos has been busy expanding its security appliance offerings and its latest XG Firewall family now has a solution for every business environment, ranging from the smallest of offices right up to enterprises. On review we have the new XG 450 Rev. 2 which sits at the top of Sophos' mid-sized office portfolio and looks to offer an impressive range of security measures for a comparatively modest outlay.

Features have been improved with Sophos' SAC (synchronized application control) designed to catch those apps that other solutions leave behind. All the 1U rack models now have two fail-safe bypass ports and also support Sophos' FleXi port expansion modules.

The XG 450 comes with eight Gigabit and two 10GbE SFP+ ports as standard and has two expansion bays. Sophos offers optional FleXi modules with eight copper or fibre Gigabit, quad 10GbE copper or fibre and dual 40GbE QSFP+ ports.

There's plenty of power on tap too, with the XG 450 claiming a raw firewall throughput of 50Gbits/sec. Enable the IPS features and this drops to 10Gbits/sec - still very respectable as this price point.

Sophos XG 450 review: Options and deployment

The base appliance has firewall, VPN, authentication and secure wireless management services enabled with a perpetual license, to which you can add a selection of subscription-based security features. The price we've shown is for a 3-year Enterprise Protect Plus and Enhanced Support agreement which costs 9,686 per year.

Along with the network and web protection modules, this activates the Sandstorm feature which uses cloud sandbox technology to mitigate zero-day threats such as ransomware. Go for the Enterprise Protect Full subscription and you'll get everything activated including email and web server protection.

Deployment is swift; we pointed a web browser at the appliance and followed the quick start wizard. This helped secure administrative access, set up LAN and WAN port address assignments and DHCP services, add an email address for alerting and choose the operation mode.

We plumped for routed mode, as we wanted the XG 450 to provide all security functions including firewalling. The appliance starts protection immediately, and the wizard created base security policies which activated web filtering for common unwanted categories and anti-malware scanning.

Sophos XG 450 review: Security policies

The web console dashboard offers an overview of all network activity and security issues, web traffic graphs and bar charts for blocked and allowed applications, plus detected network attacks. Our only issue is the Traffic Insight section frequently failed to update itself, requiring the page to be regularly refreshed.

After grouping the appliance's ports into zones, we applied firewall rules to source and destination zones along with associated networks and hosts. Other network objects include service filters, blocking actions and time schedules which can be applied within each rule.

It's worth setting up policies for web filtering, IPS and application controls first as these are referenced in your firewall rules. They are easy to create from the Protect section of the web console with web filtering offering over 90 categories and application controls providing over 3,000 predefined apps.

Sophos' identity-based security allows you to apply more versatile policies to users and groups which include data transfer limitations on uploads and downloads, and limits on daily, weekly, monthly and yearly usage. Clients authenticating to an external directory server will be automatically logged in while others can use the free Client Authentication Agent (CAA).

The appliance stores versions for Windows, Linux and Macs while free mobile apps are available for Android and iOS devices. We had no problems with the Windows CAA as it automatically found the appliance and once users had logged in, they appeared in the web console as live.

Sophos XG 450 review: Heartbeat and RED

The Heartbeat features extends the firewall's reach into the cloud as it interacts with the Sophos Central Endpoint Protection service. It requires an Advanced license and after logging the XG 450 into our cloud account, all endpoint activity data was sent to the appliance which showed status icons in its home page.

Heartbeat alert conditions can be linked to firewall policies so if any endpoints detect threats, you can isolate all systems in the same zone. The SAC feature works in tandem with Heartbeat where it detects unknown applications running on Sophos Central endpoints and applies firewall policies to control them.

Business with lots of remote sites will like the RED (remote Ethernet device) option. Sophos offers three RED appliances (including one with wireless) and once you've entered the firewall's details, just ship them to the remote sites and they'll automatically create an encrypted connection with it and extend its protection.

Sophos XG 450 review: Reporting

Value looks even better as the appliance has an embedded syslog server which collects all logs and provides an impressive range of reports. Don't forget to enable firewall traffic logging in your rules; with this enabled, we could keep a close eye on firewall, virus, web content filtering and spam activity.

From the security dashboard, we could monitor all threats or select displays for web filtering, spam activity, intrusion attacks and much more. You can click on any graph to drill down for more detailed traffic information and Sophos includes compliance reports for all key data protection regulations.

Sophos XG 450 review: Verdict

Along with its remarkably swift deployment, we were impressed with the depth of security features offered by the XG 450. Sophos has succeeded in seamlessly integrating everything together in a well-specified appliance that offers great performance at a sensible price.

Verdict

A good choice for larger businesses, the XG 450 is a high-performing security appliance that’s packed with features and has plenty of room to grow with demand

Chassis: 1U rack

CPU: 3.6GHz E3-1275 v5 Xeon

Memory: 16GB DDR4

Storage: 2 x 250GB Adata SFF SATA SSDs (mirrored)

Network: 8 x Gigabit, 2 x 10-Gigabit SFP+

Expansion: 2 x FleXi module slots

Power: Hot-plug 300W PSU (max 2)

Local ports: USB 3, HDMI, RJ-45 console

Management: Web browser

2017 has been an excellent year for technology and hardware. Consumers have been wowed by the likes of the Samsung Galaxy S8 and a list of redesigned Apple products, while businesses have been able to take advantage of unparalleled processing power thanks to servers from companies like HPE and Dell.

With such a wealth to choose from, it's hard to pick which products have been most impressive, but with some careful thought, we've sifted through the year's launches to bring you IT Pro's top products of the year.

Best laptop

Winner - Apple MacBook Pro

Apple's top-end MacBook models are widely regarded as the gold standard in business-class notebooks, and with good reason. Combining a sleek and stylish design with nigh-unbeatable performance thanks to 2017's upgraded Kaby Lake model, the MacBook Pro is an absolute powerhouse for everyone from developers to designers.

It's not entirely without problems - we wish Apple had included a couple of ports besides Thunderbolt 3, for example, and the Touch Bar version has some battery life problems - but features like the ultra-shallow keyboard and mammoth trackpad set it apart from its competition.

Highly commended - Lenovo ThinkPad X1 Carbon

Another heavyweight in the enterprise hardware space, Lenovo's venerable ThinkPad range has a sterling pedigree. The ThinkPad X1 Carbon is sturdy, reliable and well-suited to tasks of all stripes, with a truly excellent keyboard and finely-tuned features for businesses.

Best tablet

Winner - Apple iPad Pro

Apple has thoroughly dominated the tablet computing category this year - and not just because it's been one of the only companies to release a premium tablet. The company's devices have been sophisticated, powerful and portable, and the iPad Pro is the perfect combination of all three.

The Apple Pencil support made it an excellent choice for designers and artists, but now that Apple has introduced a file manager and a suite of proper multi-tasking capabilities, the iPad Pro can genuinely be considered as a laptop replacement. Showcasing the very best of Apple's design abilities, both the 10.5in and 12.9in iPad Pro models are the pinnacle of tablet design.

Highly commended - Apple iPad

If you can't quite bear to part with the 620 starting price of the iPad Pro, Apple's entry-level iPad makes a handy compromise. While it doesn't have the full range of productivity features seen on the Pro range, the basic iPad is still sleek and speedy enough for day-to-day use.

Best 2-in-1

Winner - Microsoft Surface Pro

One look at how many companies have aped the design of Microsoft's flagship convertible should give you a good indication of how popular the Surface Pro is. The kickstand design is elegant and intuitive, and the keyboard is one of the most satisfying typing experiences we've had, whilst also being amazingly thin and light.

There's no compromise on components, either; the 12.3in screen is pin-sharp and absolutely gorgeous to boot, and one of Intel's seventh-generation processors provides a serious amount of oomph. Forget compromise; this 2-in-1 does everything a laptop can, and then some.

Highly commended - HP Elite X2 Folio

While it's definitely borrowing some design inspiration from the Surface Pro, the HP Elite X2 Folio brings a few things to the table that Microsoft's device doesn't. It's user-upgradeable, for example, which could end up saving corporate IT departments a whole heap of time and money in the long term.

Best Chromebook

Winner - Google Pixelbook

Chromebooks aren't just cheap and cheerful laptops for schools, and Google's out to prove it with the Pixelbook. A razor-thin body and eye-catching design is backed up by surprisingly powerful internal hardware and all the AI-powered software features you'd expect from a flagship Google product.

What's more, improvements to Chrome OS and the ability to run Android apps mean that the Pixelbook is (very nearly) as versatile and capable as a standard Windows laptop. It's expensive, but it's liable to inspire serious notebook envy wherever you go.

Highly commended - HP Chromebook 13

At around 600, the HP Chromebook 13 is much more affordable than the pricey Pixelbook, without making too much of a compromise on design or performance. Like most Chromebooks, it'll struggle with seriously heavy-duty workloads, but for general tasks, this lightweight machine should perform very well indeed.

Best smartphone

Winner - Samsung Galaxy S8

2017 has been a truly excellent year for smartphones, and the Samsung Galaxy S8 has been firmly leading the charge. The first major smartphone out of the gate with an edge-to-edge OLED display, the S8 set an example followed by companies like OnePlus, Honor and even Apple.

Combine this with one of the best smartphone cameras we've ever seen, super-quick internals and a very capable battery life, and it all adds up to a device that's very attractive indeed. Move over, iPhone; there's a new king in town.

Highly commended - Google Pixel 2

The follow up to last year's surprise hit, the Google Pixel 2 is a deeply impressive piece of technology powered by intelligent AI features and smart UI design. Its real selling-point is an absolutely world-class camera, which has yet to be beaten by any other smartphone. Were it not for a slightly underwhelming screen, the Pixel 2 would be topping our list this year.

Best 1U server

Winner - Dell EMC PowerEdge R640

The Dell EMC PowerEdge R640 is part of the company's recently-launched 14th generation of servers, and Dell has pulled out all the stops to cram this space-efficient 1U rack server full of storage and power. Not only does it have full support for Intel's Xeon Scalable processors, it's also got some mightily impressive storage options.

On top of that, Dell's iDRAC9 management console is a smash hit, offering a comprehensive overview of operational information, security-centric features and outstanding remote management and administration capabilities. It's every bit the equal of HPE's superb iLO5 controller.

Highly commended - Lenovo ThinkSystem SR630

Expansion potential is the name of the game here, with Lenovo's ThinkSystem SR630 offering plenty of internal space for further upgrades, despite a compact 1U form factor, and Xeon Scalable processor support for improved performance. More importantly, the XClarity Controller will make remote management a breeze.

Best 2U server

Winner - Dell EMC PowerEdge R740xd

The first server in Dell EMC's 14th-generation PowerEdge line, the PowerEdge R740xd is an excellent example of what customers can expect from the company now that the merger between Dell and EMC has been completed. Remote management capabilities have been improved, and EMC's expertise has been put to use with a superb array of storage features.

It's also a powerful showcase of Intel's relatively new enterprise-grade Skylake-SP Xeon processors. The R740xd supports the whole family, all the way up to Intel's 28-core Platinum Xeon monster, and its sheer processing power is tough to beat. Blue-chip vendors, take note: this is how it's done.

Highly commended - HPE ProLiant DL380 Gen10

Like the PowerEdge, HPE's tenth-generation flagship 2U server features Xeon Scalable processor support and extensive storage options. It's an improvement over the previous iteration in just about every way, and it's got the huge room for expansion too, making it a great option for growing businesses.

Best tower server

Winner - HPE ProLiant ML110 Gen10

Smaller businesses on a tighter budget may think that cutting-edge Xeon Scalable servers are out of their reach, but not anymore. The 10th-generation update to HPE's ProLiant ML110 tower server brings SMBs excellent performance coupled with generous expansion options.

It also comes with HPE's outstanding iLO5 management controller, providing plenty of remote management, monitoring, and security features. For smaller organisations that want a heavyweight server without the top-end price tag, this is an excellent choice.

Highly commended - Fujitsu Server Primergy TX1320 M3

If you're tight on space, Fujitsu's smallest-ever tower server will be right up your street. Not only that, but it's also great value. Combine that with beefy Xeon processors and heaps of clever design features to make the most of the limited internal space, and you've got a very capable package.

Best security appliance

Winner - WatchGuard Firebox T70

The biggest thing that the WatchGuard Firebox T70 has going for it is its virtually unbeatable price. Not only is it extremely competitive, it's also one of the highest-performing desktop appliances we've ever seen, with 4GBits/sec firewall throughput.

It's bundled with a year's subscription to WatchGuard's enterprise-class software suite too, including anti-spam, anti-virus and web-content filtering, as well as a Gold-level support subscription. Lastly, it has top-notch monitoring features for ultimate peace of mind.

Highly commended - Kerio Control NG300W

The Kerio Control NG300W is one sturdy UTM appliance, with four Gigabit Ethernet ports, a 2.4GHz Intel Atom CPU, and an inbuilt heatsink. It doesn't fall down on security features either, offering a comprehensive and well-rounded package. The only absence is anti-spam features, but otherwise, it's an excellent security appliance.

Best storage array

Winner - HPE MSA 2052 Storage

HPE has raised the bar with its 5th-gen MSA 2052 storage appliance, doubling the performance of an already-excellent array whilst keeping it at the same wallet-friendly price as its predecessor.

Performance is accordingly excellent, and it's twinned with a load of powerful features to make virtualisation, deployment, and recovery as easy as possible. Considering that it includes HPE's full suite of data tiering capabilities as well, it's a steal.

Highly commended - Broadberry CyberStore 224S-WSS rack

Despite going up against titans like HPE, Dell EMC, and Fujitsu, Broadberry was first out of the gate with a Windows Storage Server 2016 appliance - and for a very attractive price, too. On top of that, the Broadberry CyberServe 224S-WSS comes with 26 hot-swap SFF drive bays, heaps of network connection options, twin Intel Xeon E5-2620 v4 processors and 64GB of RAM.

Best NAS drive

Winner - Qnap TS-1685 desktop

For those that want high-volume desktop storage capabilities, it's hard to beat Qnap's TS-1685. Not only does it feature 16 hot-swap drive bays, it's also got blazing network performance thanks to its four 10GbE Ethernet ports, and support for expansion via additional PCIe cards.

You'll be hard-pressed to match its performance in terms of disk read and write speeds as well. Add in a whole heap of backup and storage features, and the TS-1685 is a superb addition to any small office setup.

Highly commended - Netgear ReadyNAS RN426

Data protection is top of the priority list for this SMB-friendly NAS drive. Backup performance is excellent, with cloud sharing, disaster recovery and snapshot features aplenty. It's also nice and hardy, thanks to its rock-solid steel construction.

Best printer

Winner - Xerox VersaLink C400DN

The first thing that's likely to attract SMBs Xerox's VersaLink C400DN is the low price, but one of the most useful features is the large variety of onboard apps available for it, including heaps of cloud and network printing tools. It's also one of the rare printers that supports wired and wireless networking simultaneously.

Print quality is absolutely superb, delivering razor-sharp and detail-packed pictures and documents at exceptional speeds. As if that wasn't enough Xerox offers a lifetime on-site warranty - all you have to do is buy a toner pack in the last 60 days of your warranty period, and the company will renew it for another year. Can't say fairer than that.

Highly commended - Brother MFC-L8900CDW MFP

Although its initial purchase price isn't as attractive as some of its rivals, this A4 laser printer makes up for it with a battery of excellent cloud and security features, combined with speedy, high-quality prints. Running costs are reasonable, too, so TCO shouldn't be a problem later down the line.

Mittesh Das, an IT contractor, has been found guilty by a jury in North Carolina for planting a "logic bomb" within the US military system with the intent to cause damage to a computer used for facilitating national security in November 2014.

Das, who used to control part of the US Army Database that managed the payroll systems, was replaced in 2014 when the contract was given to another company. It was after this incident that he initiated the destructive coding which was scheduled to go off just days after he left.

His "bomb" affected almost 200,000 US Army reservists as it delayed paychecks for an average 17 days and prevented the mobilisation of the US Army in December 2014.

The US Army Criminal Investigation Command (CID) investigated servers in Fort Bragg shortly after the incident which lead to his arrest in April 2016. Although the extensive damage was eventually fixed, according to the US Department of Justice, the labour costs for the US Army totalled $2.6 million.

The court document states that Das "knowingly caused the transmission of a program, information, code, and command" and that in doing so, "intentionally caused damage without authorisation to protected computers, which would and did cause damage affecting a computer used by and for an entity of the United States Government in furtherance of national defence and national security".

Daniel Andrews, director of the CID, warns against these cyber crimes, stating that they "will do everything in our power to help bring to justice those who attempt to sabotage or disrupt US Army operations in the defense of our nation".

Das will be sentenced on January 9 and faces up to 10 years in prison and fines up to $250,000.

SMEs that want an on-premises network security solution will find WatchGuard's Firebox T30-W a great choice that won't be beaten for features and value. This tomato-red desktop box delivers every gateway security service they could possibly need and the icing on the cake is its integral wireless 11ac dual-band AP and wireless gateway controller for WatchGuard's own APs.

Prices start at only 942 which gets you the appliance and a one-year Security Suite subscription. This activates anti-virus, anti-spam, web content filtering, IPS, HTTPS inspection, application controls and WatchGuard's reputation enabled defence.

A one-year Total Security Suite subscription costs 1,323 and adds Watchguard's data leak prevention (DLP) and advanced persistent threat (APT) blocker services. Don't worry about deployment either as both suites includes a free remote setup and configuration session with a WatchGuard in-house engineer.

There's more, as WatchGuard's latest FireWare software adds geolocation, which allows traffic to or from specific countries to be blocked. The new threat detection and response (TDR) cloud subscription service uses locally installed host sensors to collect forensics data and provide policy-based endpoint protection for Windows servers and desktops.

The T30-W has five Gigabit ports for LAN, WAN and DMZ duties with the fourth LAN port PoE enabled. Performance looks good too, as the appliance claims top firewall and UTM throughputs of 620Mbits/sec and 135Mbits/sec.

Installation is swift, as the appliance's web browser wizard handed us secure internet access in five minutes. It also enabled the mixed routing mode where all ports appear as separate interfaces allowing different security policies to be applied to network segments.

WatchGuard uses proxies to control various traffic types and includes ones for HTTP, HTTPS, FTP, DNS, SIP, H.323, POP3 and SMTP. These are also much easier to set up now, as wizards guided us through configuring each proxy and applying actions.

For web content filtering, we chose from over 120 URL categories, added blocking actions for HTTP and HTTPS traffic and let the wizard create a firewall rule for our new policy. Gateway anti-virus is enforced simply by enabling it on selected proxies while the spamBlocker anti-spam measures use POP3 proxy actions to transparently scan traffic and tag qualifying emails as spam, suspect and bulk.

The spamBlocker service doesn't provide quarantining services so we needed to create email client rules to decide how to handle tagged messages. We could also scan traffic inbound to an internal mail server with an SMTP proxy action set to use the server's IP address.

The geolocation feature provides a global real-time map showing where traffic is emanating from or going to and blocking it is swift as you just click on the country area to turn it red. Controlling app usage doesn't get any easier either as the appliance has entries for over 1,800 including all popular social networks.

VPN services are excellent as the T30-W supports site-to-site IPsec tunnels plus mobile IPsec, PPTP and L2TP clients along with SSL VPNs. For mobile IPsec VPNs, the appliance creates a configuration file which provides quick setup of Watchguard's Windows, iOS and Android clients as well as the Shrew Soft VPN client.

Value gets even better as, unlike some appliance vendors, WatchGuard doesn't sting you for reporting software. On-appliance reporting includes the handy FireWatch feature and we use WatchGuard's free Dimension software on our VMware host to monitor and report on multiple Fireboxes.

Small and medium-sized businesses looking for seriously strong network protection at an affordable price will find WatchGuard's Firebox T30-W ticks all the boxes. It has all the best security features, can be customized to suit and is very easy to deploy.

Verdict

Small and medium-sized businesses looking for seriously strong network protection at an affordable price will find WatchGuard’s Firebox T30-W ticks all the boxes. It has all the best security features, can be customized to suit and is very easy to deploy.

Desktop chassis; 1GB RAM; 5 x Gigabit (PoE on LAN port 4); 2 x USB 2, RJ-45 serial port, external PSU; web browser and Dimension management

WatchGuard's Firebox T70 could be the perfect security solution for bandwidth-hungry workforces, thanks to the highest performance we've seen in a desktop appliance. This desktop box claims a remarkable 4Gbits/sec raw firewall throughput; even with all UTM services enabled, it can still handle more than 1Gbit/sec.

Even better, this exceptional performance comes at a very reasonable price: the appliance costs only 2,178 exc VAT, with a one-year subscription to WatchGuard's Total Security Suite. That compares favourably to the competition: SonicWALL's NSA 3600, for example, has a lower 3.4Gbits/sec raw firewall throughput, and the hardware alone costs over three grand.

The Total Security Suite lives up to its name, too. It activates WatchGuard's web-content filtering features, plus application controls, anti-spam, gateway antivirus, network discovery, IPS, reputation-enabled defence, data loss prevention (DLP) and an advanced persistent threat (APT) blocker. A Gold Support subscription is included as well.

The T70 isn't lacking in the hardware department, either. It sports eight Gigabit ports for LAN, WAN and DMZ duties - and the sixth and seventh LAN ports are PoE-enabled, so you can easily add wireless APs or IP cameras.

When it came to deployment, the network discovery tool automatically scanned our lab network, and after around 30 minutes presented us with a list of all systems. Any new systems that we subsequently placed on the network appeared in the list after a few seconds. Our only niggle is that the OS identification isn't perfect: a Windows Server 2012 R2 system was wrongly identified as running Windows 8 or 8.1.

Setting up firewall-protected internet access took less than five minutes, thanks to a helpful wizard. Traffic is handled by a variety of different dedicated proxies - including HTTP, HTTPS, FTP, SIP, POP3 and SMTP - and these too can be configured with wizards. Web content filtering is thus reduced to a three-step process: we were able to choose from over 120 URL categories and applied HTTP and HTTPS filtering, and on completion a new firewall rule was generated for us.

Gateway antivirus and WatchGuard's spamBlocker services are just as easy to set up. For the latter, you can apply actions to tag dodgy emails as spam, suspect or bulk. Once gateway AV is enabled, you can use the APT blocker service that transparently scans incoming files, creates MD5 hashes and compares them with the Lastline cloud service to see if they're known malware.

A nice touch in the web console is the padlock symbol at the top of each screen to prevent accidental changes. This must be unlocked by clicking on it before the appliance will accept any configuration changes.

The T70 doesn't have integral wireless services, but it can manage WatchGuard's own APs. We paired an AP200 with the T70 and were able to assign SSIDs to its dual radios, enforce client isolation for guest networks, and choose which security services to apply to wireless traffic.

The T70 can also help maintain mobile security by querying the OS of connected Android and iOS devices and blocking access if they don't meet a minimum requirement. We tested this using an iPad loaded with the FireClient app: initially, the T70 blocked it for non-compliance, but we quickly realised that this was because only iOS 8 and 9 are accepted by default. As soon as we added iOS 10 in the policy, we were good to go.

One final feature worth noting is the Dimension monitoring system. This provides a wealth of information, including an executive dashboard, global threat maps and security service graphs. Businesses with multiple Fireboxes can take advantage of the Dimension Command feature - included in the Total Security Suite - which centralises appliance management in one place, as well as adding tabs for mobile devices and wireless APs.

High-performing UTM appliances usually come with a price premium, so the Firebox T70 stands well apart from the crowd. It offers SMBs a wealth of security measures, teamed with a super set of remote-management tools, at an extremely competitive price.

This review originally appeared in PC Pro issue 268.

Verdict

High-performing UTM appliances usually come with a price premium, so the Firebox T70 stands well apart from the crowd. It offers SMBs a wealth of security measures, teamed with a super set of remote-management tools, at an extremely competitive price.

Desktop chassis

2GB RAM

8 x Gigabit Ethernet (PoE on ports 6 & 7)

2 x USB 2

RJ-45 serial port

External PSU

Web browser management

Options: Appliance with 3yr Total Security Suite, £3,977 exc VAT

Kaspersky has accused Microsoft of promoting its own antivirus products over those belonging to rivals.

Russia's Federal Antimonopoly Service (FAS) is currently investigating the claim, with Kaspersky complaining that Microsoft is "using its dominating position in the market of operating systems to create competitive advantages for its own product."

The product in question is Microsoft's Windows Defender antivirus, which competes with some products offered by Kaspersky Labs.

In a blog post, Kaspersky CEO Eugene Kaspersky said he'd "had enough", accusing the Windows 10 operating system of uninstalling incompatible antivirus apps and replacing them with Microsoft ones.

He wrote: "When you upgrade to Windows 10, Microsoft automatically and without any warning deactivates all 'incompatible' security software and in its place installs... you guessed it - its own Defender antivirus. But what did it expect when independent developers were given all of one week before the release of the new version of the OS to make their software compatible?

"Even if software did manage to be compatible according to the initial check before the upgrade, weird things tended to happen and Defender would still take over."

Kaspersky also said that when users have compatible protection already installed, Defender shoots an "alarming window", stating that it is switched off as the user has another antivirus installed.

"There's a big juicy Defender 'Turn on' button too. Of course, many users will be inclined to press this button: 'well, it's from Microsoft - the people who make the OS; must be good; no harm in turning it on for sure'," reads the blog post.

However, clicking on this button would also deactivate a user's existing antivirus, without any direct notification.

In addition to this, Kaspersky claims Microsoft limited the possibility for independent security developers to warn users about a product's expiring licence by burying such notifications.

According to the CEO, Windows 10 would only be allowed to have one or two antiviruses installed (two only in the case in which one of these is Defender).

Kaspersky said: "The trend is clear: Microsoft is gradually squeezing independent developers out of the Windows ecosystem if it has its own application for this or that purpose."

In September, Russia had also announced it would start replacing some Microsoft products with local software.

Russia's deputy head of the FAS, Anatoly Golomolzin, said in a statement: "Since Microsoft itself develops antivirus software - Windows Defender that switches on automatically if third-party software fails to adapt to Windows 10 in due time, such actions lead to unreasonable advantages for Microsoft on the software market. Our task is to ensure equal conditions for all participants on this market."

A Microsoft spokesperson commented: "Microsoft Russia and Kaspersky Lab have a long history of cooperation in different areas. Microsoft is committed to work in full compliance with Russian law. The company hasn't received an official notification from FAS. As soon as we get it, we will review it carefully."

This article was originally published at 11.55am on 14 November. It was subsequently updated with Microsoft's comment at 2pm the same day.

An EU-funded to project to identify and end students cheating in exams and coursework will make use of new identity validation software capable of telling the difference between users based on their typing habits.

Watchful Software, headquartered in New York, is providing its TypeWatch keystroke dynamics technology to the Adaptive Trust-based e-assessment System for Learning (TeSLA) project.

"What we've developed is a way to do keystroke dynamics as a way to understand who the user interacting with the computer is, anywhere, just by the way that user types. It's kind of like a biometrics, but without the hardware, or a need to have an analysis of the face or even a fingerprint," Rui Melo Biscaia, founder and director of Watchful Software told IT Pro.

Watchful's software uses an algorithm to discern who a user is based on behavioural biometrics, and requires less than Twitter's 140-character limit in order to verify the user.

The technology is not dependent on language, meaning it can be used by cultures that use non-English characters. And its maker told IT Pro that does not store data inputted by users.

"The reason we were brought into the TeSLA consortium is because of just [this]: the technology, the know-how, that we've used to develop our own brand product that we're now going to use in this learning management system," said Melo Biscaia.

Earlier this year, a The Times investigation of 129 UK universities found that more than 50,000 university students were caught cheating in the last three years, including a high number of foreign students.

The aim of the TeSLA project is to develop a free-of-charge e-assessment system capable of detecting when someone other than the registered student is attempting to complete an online exams or assessment to be used in schools, higher education institutions and vocational training centres across Europe.

The 7 million project is being led by Universitat Oberta de Catalunya (UOC), and a consortium of 17 other organisations from across Europe. The three-year pilot project will be tested on over 14,000 students and teachers across the continent from 10 different universities, including the Open University in the UK.

The advanced identity validation systems it uses will in include Watchful's TypeWatch, as well a mix of voice and facial recognition biometrics from other technology vendors.

If the trial is success, a commercial version of the TeSLA e-assessment system to be sold globally.

Melo Biscaia admitted that Watchful's software, which is still in its early stage of development, is not 100 per cent "bulletproof" for instance, broken or faulty keyboards can skew the initial typing samples the algorithm takes. But he did say it has many practical commercial applications, particularly in bolstering security systems.

"TypeWatch, or the keystroke dynamics that we've developed, is not a replacement for multifactor authentication. The way we see it is an identity validation mechanism that works on top, and after, multifactor authentication," Melo Biscaia added.

Check Point has launched a new range of security appliances that it claims can offer SMBs enterprise-grade protection against sophisticated cyber attacks.

The Check Point 700 Series includes two appliance models, the 730 and 750, that come with a firewall, VPN, anti-bot, intrusion prevention, anti-virus, anti-spam, application control, URL filtering, and the ability to enable security monitoring out of the box.

There is also the option to equip them with 802.11ac Wi-Fi, with VDSL connectivity coming later in the year.

The company claims that while 90 per cent of businesses globally are SMBs, they "have typically seen limited options for affordable, robust security solutions".

The built-in features of the 700 Series, the company said, help provide offices with up to 100 employees with protection against sophisticated, incremental, difficult to detect network attacks while still being easy to run and maintain, thanks to a web-based management platform.

Check Point 730 and 750 also promise to maintain fast internet speeds, with up to 4Gbps firewall throughput traffic and up to 200Mbps when all threat prevention functions are activated.

"Cybercriminals are not only employing increasingly sophisticated means of stealing data - they are also increasingly targeting the entrepreneurial spirit of small-business IT," said Gabi Reish, vice president of product management at Check Point.

"The new Check Point 700 Series appliances provide an enterprise-grade solution that meets the agility and evolving needs of the small business," he added.

The Check Point 730 and 750 appliances cost 350 and 550 respectively before tax or the addition of any additional features.

Dell's new SonicWall TZ family of network security appliances aims to deliver the security SMBs and remote offices are crying out for at a price they can afford. This sixth generation model claims a big boost in performance over its predecessors and brings sophisticated wireless management into the fold as well.

The flagship TZ600 on review looks up to the job as this compact desktop box has ten Gigabit ports for LAN, WAN, DMZ and WLAN duties. Recommended for up to 70 users, it comes with 1GB of memory while processing power is served up by a quad-core 1.4GHz MIPS64 Octeon processor.

The appliance costs just over a grand with a one-year TotalSecure subscription increasing this to a still very reasonable 1,499 ex VAT. This enables Dell's Intrusion Prevention System (IPS), gateway anti-virus and anti-spyware, web content filtering and Dell SonicWALL's application intelligence and control.

Anti-spam is optional with a 1-year subscription costing an extra 400. The TZ600 comes with the wireless management feature enabled as standard and can handle up to 24 SonicPoint access points including the latest 802.11ac models.

Port zones makes light work of applying security policies to multiple users

Dell SonicWall TZ600: swift setup

We found deployment simple as the web console's quick start wizard sets up the first LAN port and a WAN port for Internet access and applies a security policy to the default zone. Zoning makes the TZ600 very versatile as you can place selected ports in different zones and apply a single security policy quickly to all the members of a particular zone.

Selecting a security type for each zone also determines what traffic can pass through it. All LAN ports are trusted but the WAN port is untrusted, so no traffic will be allowed to pass from it to another zone unless a firewall rule permits it.

Usefully, as you create zones, the appliance automatically sets up new firewall rules for them. The various security services are applied to zones with a couple of clicks, so we could quickly enable IPS and gateway AV on the WAN zone.

We could keep a close eye on traffic flows with the Real-Time Monitor

Dell SonicWall TZ600: feature details

The TZ600 gets the benefit of Dell SonicWALL's Reassembly-Free Deep Packet Inspection (RFDPI) which is designed to identify and control applications without any significant hits on performance. For web filtering, we enabled the Content Filter Service (CFS) but you can add the optional Websense Enterprise premium cloud service.

We can't see the point in splashing out for Websense Enterprise though, as the CFS performed well with very few web sites slipping past it. We created multiple content filtering profiles from the 60 available URL categories and assigned each policy to different zones.

The TZ600's App Controls are a winner as they manage a wide range of applications such as FTP transfers or HTTP requests and apply actions such as blocking or limiting bandwidth. The Advanced App Controls are even better as these use signature IDs to identify specific activities.

It provides over 1,500 signatures that can spot activities such as Facebook likes, pokes or posts so you can block, log or allow them. Signature action policies can be applied to selected groups of users, IP addresses or even only SonicPoint access points and linked to a daily time schedule.

The TZ600's wireless provisioning features are a cut above the rest

Dell SonicWall TZ600: wireless control

Wireless management features are impressive and we tested these using a SonicPoint ACi dual-band access point. Before connecting it to the TZ600, we created a bunch of wireless provisioning profiles that defined settings for each radio, security and so on.

When we connected the AP, the TZ600 recognised it as an ACi model and automatically applied the correct profile to it. The upshot was we had secure, dual-band wireless services up and available in minutes.

We used a dedicated WLAN port zone so were able to quickly apply custom security policies to it such as web content filtering, IPS and gateway AV. The WLAN zone wireless guest settings include permitting or denying inter-guest communications, redirecting users to an external web site for authentication and blocking wireless traffic deemed to be coming from non-SonicPoint APs.

IxLoad shows performance dropping substantially when we enabled the gateway AV and anti-spyware services

Dell SonicWall TZ600: performance test results

For real world performance testing, we connected the TZ600 to our lab's Ixia Xcellon-Ultra NP load modules via eight of the TZ600's Ethernet ports. Using the IxLoad control software, we created four client/server streams each requesting 1MB web pages.

With no security services enabled on the WAN, we saw IxLoad report a steady HTTP throughput of 1.3Gbits/sec. This was very close to the claimed 1.5Gbits/sec and we're sure with five client/server streams, we'd have achieved this.

With IPS enabled on the WAN zone, throughput dropped to nearly 1Gbits/sec again, very close to the claimed figure. However, we found the gateway AV service very demanding as throughput dropped to 385Mbits/sec and with the anti-spyware enabled as well, speed fell further to a steady 300Mbits/sec 200Mbits/sec less than claimed.

We doubt if we could have achieved any more as the appliance's processor was maxed out during the last test. We could also see from its web console that the TZ600 only uses three of the four processor cores for traffic handling with the other one set aside for management processes.

Dell SonicWall TZ600: conclusions

Apart from the subpar gateway AV performance, our only other moan is that reporting tools aren't included as standard, but as chargeable options. These problems aside, the TZ600 impressed us with its superb range of security measures, top-notch wireless management features and affordable price.

Verdict

For the price, the TZ600 has a superb set of security measures and tops them off with great wireless provisioning tools

Chassis: Desktop

Processor: 1.4GHz quad-core MIPS64 Octeon

Memory: 1GB RAM

Network: 10 x Gigabit Ethernet

Power: External power supply

Ports: 2 x USB, RJ-45 console

Management: Web browser

Options: Anti-spam, £400 per year; Analyzer reporting software, £152 (all ex VAT)

Trade body techUK has published the first industry guidance aimed at helping cyber security firms assess the risks of exporting products and services.

Assessing Cyber Security Export Risks' is designed to help companies identify and manage the risks of exporting, covering due diligence processes, human rights risks and national security dangers.

TechUK warned that such products could end up being bought by criminals who could use them to undermine UK security.

Ruth Davis, head of cyber, justice and emergency services at techUK, said: "We need to prevent them falling into the wrong hands, leading to human rights abuses or the undermining of UK national security.

"Businesses have a responsibility to protect human rights and uphold national security. We want British companies to take the lead on protecting human rights and driving innovation in cyber security.

"The advice in this document is designed to help companies reduce reputational risk and to have confidence in the deals they make."

The Government wants to boost UK exports of cyber security products, after the National Audit Office (NAO) found the National Cyber Security Programme was failing to deliver economic benefits for UK businesses.

A NAO report in September found progress in encouraging more exports of cyber products was slow, yet the Government aims to make it a 2 billion market by 2016.

TechUK has published the guidance with the Institute of Human Rights and Business and on behalf of the Cyber Growth Partnership.

BlackBerry has beefed up the security of its BlackBerry Messenger service in a bid to shore up its enterprise business.

The firm announced its new BBM Protected secure messaging feature, within its eBBM suite, is now available to enterprise customers.

BlackBerry said the first product in the eBBM Suite, which was announced earlier this year, is being delivered ahead of schedule. BBM Protected will work within the standard BBM app.

The mobile messaging app uses FIPS 140-2 cryptographic library-enabled messaging not only between users within the same organisations but also between organisations that also use BBM Protected. They do not need to be on the same BES server and no federation between servers is required.

A Triple DES 168-bit BBM scrambling key encrypts messages on the sender's smartphone, and is used to authenticate and decrypt messages on the recipient's phone.

Jeff Gadway, head of product and brand marketing for BBM, said BBM Protected adds an additional layer of encryption to the existing BBM security model.

"The first time that two BBM Protected users go to establish a chat, they will be required to share a secret passphrase to authenticate their identities and generate the BBM Protected encryption key used to secure their chat," he said.

According to the firm's website, BBM Protected is added as an IT policy through the BES console. "There's no new hardware to purchase, no new servers to install, and no BlackBerry smartphone OS updates required. And with IT policy amalgamation, you can quickly add BBM Protected to existing IT policies," the firm said.

Business users with BlackBerry smartphones running BBOS 6.0 or later or BlackBerry 10 in Regulated mode can use the app now with versions of BBM Protected for BlackBerry 10 smartphones via BlackBerry Balance. Support for iOS and Android devices will come later this year.

Cisco's legal counsel has blasted the US government over accusations the NSA has been tampering with communications equipment.

The spy agency has reportedly been intercepting shipments of routers, switches and servers in order to hide their surveillance equipment.

Writing in a blog post, Cisco's legal counsel Mark Chandler said that the actions of the US government have overreached, "undermining the goals of free communication".

"Confidence in the open, global internet has brought enormous economic benefits to the United States and to billions around the world," said Chandler.

"This confidence has been eroded by revelations of government surveillance, by efforts of the US government to force US companies to provide access to communications of non-US citizens even when that violates the privacy laws of countries where US companies do business, and allegations that governments exploit rather than report security vulnerabilities in products."

Chandler said that it was Cisco's policy and practice not to work with any government, the US included, to weaken its products.

"When we learn of a security vulnerability, we respond by validating it, informing our customers, and fixing it.

"We react the same when we find that a customer's security has been impacted by external forces, regardless of what country or form of government or how that security breach occurred. We offer customers robust tools to defend their environments against attack, and detect attacks when they are happening. By doing these things, we have built and maintained our customers' trust.

"We expect our government to value and respect this trust."

Last December, eight technology companies expressed concern to US President Barack Obama and Congress that the US government's surveillance efforts as revealed by Snowden were harmful.

Chandler said that the revelations over hardware tampering were damaging and his firm should not expect the government to act in this manner.

"We comply with US laws, like those of many other countries, which limit exports to certain customers and destinations," said Chandler.

"We ought to be able to count on the government to then not interfere with the lawful delivery of our products in the form in which we have manufactured them. To do otherwise, and to violate legitimate privacy rights of individuals and institutions around the world, undermines confidence in our industry."

Research In Motion (RIM) has bagged US government security clearance for its yet-to-be launched BlackBerry 10 platform that is expected to hit stores in the first quarter of 2013.

The company said its BlackBerry 10 platform has received the FIPS 140-2 certification, which would allow government agencies to deploy the devices, along with the new enterprise management platform to run them, as soon as the new smartphones are launched.

Achieving FIPS certification for a new platform, before launch, is quite remarkable.

RIM, a one-time pioneer in the smartphone industry, has seen its fortunes fade in recent years as rivals Apple and Samsung have eaten into its market share with faster and snazzier devices.

RIM's fate now depends almost entirely on the long-awaited line of so-called BB 10 devices.

Last month, the company said it had begun carrier tests on the new line of devices, which the company hopes will help turn its fortunes around.

The Waterloo, Ontario-based company said this is the first time BlackBerry products have been FIPS certified ahead of launch.

"Achieving FIPS certification for an entirely new platform in a very short period of time, and before launch, is quite remarkable," RIM's head of security certifications, David MacFarlane, said in a statement.

FIPS certification, which is given by the National Institute of Standards and Technology, is one of the minimum criteria that is required for products used by US government agencies and regulated industries that collect, store, transfer, and share sensitive information.

The stamp of approval gives confidence to security-conscious organisations - including some of RIM's top clients like US and Canadian government agencies - that the data stored on smartphones running BlackBerry 10 can be properly secured and encrypted.

RIM promises that BlackBerry 10 will deliver a better user experience, along with the ability to separately manage both corporate and personal data on the same device.

IBM has issued the first major update of the security information and event management (SIEM) software it bought in its Q1 Labs acquisition, claiming it is blowing the competition out of the water with the amount of data feeds it has collated.

Big Blue said the QRadar Security Intelligence Platform, built mainly of Q1 Labs sauce rather than IBM's own code, draws together 400 sources on threats giving IT pros a wider knowledge of dangers facing their networks.

IBM has hooked up its own X-Force threat feed to the SIEM offering, which monitors 13 billion security events per day.

A host of other Big Blue offerings have been integrated into QRadar, including IBM Security Identity Manager and IBM Security Access Manager to mitigate the insider threat.

There are no vendors that can cover that breadth and that's really the value we bring.

Future integration modules are also being released for non-IBM products, including Symantec DLP, Websense Triton, Stonesoft, Stonegate and others.

"Essentially we support Symantec and McAfee and can extend to others. We don't support HP Arcsight," IBM told IT Pro.

Martin Borrett, director of the Institute of Advanced Security at IBM, said there had been a "wealth of excitement" around what Big Blue could do with Q1 Labs technology.

"We've been trying to figure out how IBM can take it to the next level, integrating our research and existing product line," Borrett told IT Pro.

"At this stage, apart from driving more scalability into the platform itself with new appliances, it's really about those flows in and out. We had all the insight from the X-Force but it just wasn't plugged into the platform in the way that it will be now. It's really about that crucial integration."

The release also marks another major moment for IBM in establishing itself as a major security services player.

However, it faces strong competition in the SIEM space, with Symantec already offering a well-respected product, HP running its Arcsight-based offerings and McAfee set to boost its presence in the market after acquiring Nitro Security.

Borrett said IBM had "significant differentiation" in the market, thanks to the large number of sources QRadar can access and the insight it can get from the data.

"There are no vendors that can cover that breadth and that's really the value we bring," he claimed.

"The depth of the analytics we can get out of the Q1 platform I think is significantly stronger and better than our competition. Because of the context we can do it in... and the real-time capability [QRadar] is significantly better than the competition."

As for the SIEM market in general, with major players coming in and swamping the market, Borrett claimed there was still room for smaller players to partner with bigger vendors to supply more insight for bigger offerings.

"The important thing is that those capabilities integrate into these other platforms and into our platforms in particular," he added.

Symantec is telling IT departments to disable its remote access software solution pcAnywhere after a source code leak meant the product faced an "increased security risk."

The security giant said it was reaching out to customers to warn them of additional dangers, after it admitted source code relating to various products was stolen.

Hacktivist group Anonymous had threatened to release Symantec source code earlier this month, leading the Norton provider to admit a breach in 2006 had compromised information.

Symantec recommends disabling the product until we release a final set of software updates.

Prior to today's revelation, Symantec had simply asked IT departments to ensure best practices with pcAnywhere use. The reviewed advice indicates the 2006 hack exposed more than initially thought.

"Symantec has taken an aggressive position to ensure pcAnywhere customers are protected. At this time, Symantec recommends disabling the product until we release a final set of software updates that resolve currently known vulnerability risks," a spokesperson said.

"For customers that require pcAnywhere for business critical purposes, it is recommended that customers understand the current risks, ensure pcAnywhere 12.5 is installed, apply all relevant patches as they are released, and follow general security best practices."

From the 2006 hack, affected products include old versions of Norton Antivirus Corporate Edition, Norton Internet Security, Norton SystemWorks (Norton Utilities and Norton GoBack), as well as pcAnywhere. Symantec Endpoint Protection (SEP) 11.0 and Symantec AntiVirus 10.2 also inherited a very small amount of exposed code.

Barracuda's flagship products have always been its Spam and Virus Firewall appliances, and the latest 900 model reviewed here is aimed firmly at the enterprise sector. It has impressive credentials too, as along with a high claimed spam detection rate, it's designed to handle between 15,000 and 30,000 email users and up to 5,000 mail domains.

Considering the price, the 900 appliance isn't that physically impressive, since this Supermicro-based 2U rack server sports a pair of 2.6GHz 6-core Opteron 2435 processors teamed up with a modest 8GB of DDR2 RAM. For storage, there are quartets of 150GB WD Enterprise and 500GB Seagate SATA II drives in hot-swap carriers.

These drives are linked to a simple Areca PCI-X RAID controller and each group is preconfigured as RAID-10 striped mirrors. The WD drives look after the OS and message log storage, while the Seagate array provides a quarantine store.

The appliance is best located in a server room, since its cooling fans are remarkably noisy. This does show its age, as Supermicro addressed overall noise levels on its entire server range some time ago and so more recent models are much quieter.

Prices start at 31,449 and for this you get the appliance and a one-year basic replacement warranty. Barracuda's Energize Updates service for anti-spam, anti-virus and other security updates adds a further 27,749 for a three-year subscription, while a three-year instant-replacement (next business day) warranty adds another 17,649. This brings the total price to a hefty 76,847.

Despite its size and performance credentials though, the 900 is just as easy to deploy as Barracuda's small business models. The process starts with a local monitor and keyboard configuration used to complete a simple setup routine that asks for an IP address, a gateway and DNS settings.

All further configuration is via the appliance's web interface, which opens with an informative status screen showing tables and graphs of hourly and daily inbound and outbound mail traffic. It's all colour-coded, so it's easy to see what mail is being allowed, blocked, tagged or quarantined.

Barracuda's web interface provides easy access to all security features and opens with a detailed graphical overview of inbound and outbound message activity.

Next, mail recipient domains and the addresses of the mail servers the appliance will be routing mail for are added. Incoming mail must also be routed to the appliance and this can be achieved with a firewall port-forwarding rule, or by changing the DNS MX record.

For inbound mail, Barracuda uses an impressive arsenal of spam detection tools which include Bayesian algorithms, real-time blacklists, reverse DNS lookups, IP reputation analysis, fingerprinting, content filtering, keyword blocking and intent analysis. These are used to derive a score for each message and determine whether suspect messages are blocked, quarantined or tagged.

The Energize Update subscription seems high, but this does also include free access to Barracuda's Cloud Protection Layer (CPL). This can reduce local traffic by applying pre-filters to incoming mail, so spam and mail-borne viruses are stopped before they even get to the local network.

You can tweak the spam detection scoring system but we found it worked very well on the default values.

Rather than use bogus or old samples of harvested spam to test detection rates, we opted to set up the appliance to scan incoming mail in a totally live environment. This is a far more realistic test of the appliance's detection techniques, since it has to handle new and emerging threats in real time.

We left the spam scores and actions at their default settings and configured our Outlook clients to move any tagged messages into a separate folder. The appliance's message log was monitored during the test and, on completion, was exported into a spreadsheet for further analysis.

We left the appliance filtering live mail for nearly three weeks, where it handled over 6,250 inbound messages 1,447 of which were spam or carried an infected payload. Only 13 spam messages were missed, which equates to an impressive detection rate of 99.1%. The Barracuda returned a very low false positive detection rate too, with only four messages incorrectly identified as spam and seven out of 22 incorrectly labeled as possible spam.

The Energize Update subscription gives you free access to Barracuda's cloud based spam filtering service and the portal can be used to manage multiple systems.

Plenty more filtering features are provided, and custom content filters can be applied to inbound and outbound mail. A list of keywords and patterns can also be created and, if detected in the body, header, subject or attachment of a message, it can be blocked, tagged, whitelisted or quarantined.

For outbound mail, the filters can also be used to look out for business sensitive keywords and the appliance can then automatically encrypt the message before it leaves the building. Further checks can be applied to attachments, with options to look out for executable files, Microsoft Office documents and PDFs.

Keyword and pattern searches can be applied to the message body, subject and header for inbound and outbound mail.

It's also possible to automatically block or quarantine messages with password-protected archived file attachments, but the pattern matching lists for credit card and social security numbers are of limited use in the UK, since they're US-specific.

Anti-virus protection can also be extended to Microsoft Exchange servers, as Barracuda offers the necessary free agent, along with an Outlook plug-in that allows users to classify messages from their Desktop and request that selected outbound mail be encrypted.

Given the high total cost for three years' use, Barracuda's Spam and Virus Firewall 900 hardly represents fantastic value, but this does need to be balanced against the facts that it is very easy to deploy, offers an impressive range of message security functions and, above all else, delivers an impeccable real-world performance.

Verdict

Barracuda’s anti-spam appliances have always impressed us with their top-notch detection rates and the 900 model is no exception. It delivered a very high score out of the box in our real-world tests, and it was easy to deploy and configure. The hardware itself could be more up to date considering the price, but its performance and features can’t be faulted.

Chassis: 2U rack

CPU: 2x 2.6GHz AMD Opteron 2435

Memory: 8GB DDR2

Storage: 4x 150GB WD Enterprise SATA II SFF, 4x 500GB Seagate Barracuda SATA II LFF

RAID controller: Areca ARC-1120 PCI-X card with 256MB cache/BBU

Array support: Two RAID-10 arrays preconfigured

Network: 2x Gigabit

Ports: 2x USB, VGA

Management: Web browser

Warranty: One-year standard replacement

Options: Three-year Energize updates, £27,749; 3-year instant replacement, £17,649 (all ex VAT)

Symantec has backtracked on how source code relating to its products was leaked, revealing its own network was hacked in 2006.

The revelation came after hacktivist group Anonymous claimed it was going to release the full source code of Symantec's flagship Norton anti-virus software.

The security giant said it believed the data acquired by hackers came after a hack in 2006, although it could not confirm to IT Pro how the break-in took place.

Symantec customers - including those running Norton products - should not be in any increased danger of cyber attacks.

Earlier this month, Symantec confirmed some source code relating to older enterprise products had been stolen. At the time, it claimed Norton products were unaffected and its own network had not been breached.

Hackers calling themselves The Lords of Dharmaraja threatened to publish the information online, saying they acquired the information from the Indian military.

From the 2006 hack, affected products include old versions of Norton Antivirus Corporate Edition, Norton Internet Security, Norton SystemWorks (Norton Utilities and Norton GoBack) and its remote access software solution pcAnywhere.

Symantec Endpoint Protection (SEP) 11.0 and Symantec AntiVirus 10.2 inherited a very small amount of exposed code, the company said. There are no indications customers data has been stolen, it added.

"Due to the age of the exposed source code, except as specifically noted below, Symantec customers - including those running Norton products - should not be in any increased danger of cyber attacks resulting from this incident," a spokesperson said.

"Customers of Symantec's pcAnywhere product may face a slightly increased security risk as a result of this exposure if they do not follow general best practices. Symantec is currently in the process of reaching out to our pcAnywhere customers to make them aware of the situation and to provide remediation steps to maintain the protection of their devices and information. Since 2006, Symantec has instituted a number of policies and procedures to prevent a similar incident from occurring."

Symantec said businesses do not need to take any additional steps to protect themselves as a result of the hack. The company recommended customers ensure their software is up to date.

For any IT departments still concerned about the source code leak, Symantec has set up an advice page here.

Symantec did not disclose the 2006 hack publicly at the time, meaning it has taken between five and six years for the breach for the security firm to reveal what happened, or that the company did not know source code had gone missing back then.

RSA was heavily criticised for not immediately publicly disclosing a breach last year, when information relating to its SecurID product was compromised.

Pieces of fresh Mac malware increased significantly in 2011, further debunking the myth that cyber criminals are not turning their attention to Apple machines.

There were 58 new Mac threats between April and December 2011, F-Secure analysis found.

"That's nothing when compared to Windows malware - but it's definitely something when compared to the number of Mac threats seen prior to 2011," F-Secure said in a blog post.

Most of the new Mac threats were Trojan-downloaders, with 29 appearing over the nine month period.

Backdoors came in second on 15, with Trojans and rogue AV taking seven each.

"Mac malware has not scaled continuously due to market share, but rather, is more the result of opportunist 'bubble economies' that have produced new threats in fits and starts," F-Secure added.

"We expect more of the same for 2012."

Security professionals believe Mac malware will increase again this year, as awareness amongst users is growing.

"Fortunately enough, it seems that Mac users are now more aware that Mac is not immune to malware attacks and they are increasingly using antivirus programs, hindering cyber-crooks," said Luis Corrons, technical director of PandaLabs, in a blog post.

"The number of malware specimens for Mac will continue to grow in 2012, although much less than for PCs."

Amazon-owned clothing retailer Zappos.com has been hacked, with up to 24 million customers affected.

The company has been forced to reset customer passwords after names, email addresses, billing and shipping addresses as well as the last four digits of credit card numbers were compromised.

Password hashes were also taken in what appears to be the biggest public data breach of 2012 thus far.

We have made the hard decision to temporarily turn off our phones...

The database storing customers' critical credit card data has not been accessed, however.

Non-US customers are currently blocked from accessing Zappos.com's statement on the company blog, but an email explaining the breach is circulating the web.

"We were recently the victim of a cyber attack by a criminal who gained access to parts of our internal network and systems through one of our servers in Kentucky," said Tony Hsieh, CEO of Zappos.com, in an email to employees.

"We are cooperating with law enforcement to undergo an exhaustive investigation.

"We have made the hard decision to temporarily turn off our phones and direct customers to contact us by email because our phone systems simply aren't capable of handling so much volume."

The email sent to users outlined what data may have been stolen, alongside details about how to gain a new password.

"We also recommend that you change your password on any other web site where you use the same or a similar password. As always, please remember that Zappos.com will never ask you for personal or account information in an e-mail," the email read.

Graham Cluley, senior technology consultant at Sophos, said it was an "ugly situation" for Zappos.com.

"One imagines that the decision to block access to the blog entry is to prevent it becoming overloaded with traffic - but, seriously, how hard is it to host an important message like this on another trusted site?" he added, in a blog post.

Protecting the contents of a lost or stolen iPhone is all well and good, but it's obviously better not to part company with it the first place

Apple beefed up security in the last major release of iOS to make the iPhone more appealing to business users who deal with sensitive data, but strong passwords and secure encryption are only one line of defence.

Protecting the contents of a lost or stolen iPhone is all well and good, but it's obviously better not to part company with the device in the first place and that's just what the Kensington BungeeAir Power Wireless Security Tether is designed to ensure.

The BungeeAir Power Wireless Security Tether is a two-part set-up that consists of an iPhone 4 case and an electronic fob, which attaches to a keying.

Wireless proximity alerts

The two are wirelessly paired and if the fob is taken beyond a certain range of the encased iPhone or vice versa an alarm sounds and the iPhone screen is locked. The idea is that this prevents an iPhone being left behind or from being moved without the owner's knowledge assuming the owner has remembered to bring the fob with them in the first place, of course.

The case component is matte black and clips around the iPhone, covering all four sides and the back. External volume buttons press through to the ones on the iPhone itself, but there's a cut-out to access the ringer silence switch and a microUSB port in the base rather than a Dock connector. So, this isn't a case that's suitable for use with certain iPhone accessories.

The BungeeAir Power Wireless Security Tether fob is powered by two long-lasting watch batteries, but the case doesn't draw power from the iPhone itself it has a built-in battery of its own.

This does make the case rather bulky at its bottom end and it adds 70g to its weight, but it does serve a handy extra purpose - press the button on its back and it packs sufficient juice to recharge an empty iPhone battery by about 50 per cent.

Kensington provides a free app (via the iTunes App Store) for configuring the wireless tether and this includes a short video to explain its operation, but set-up is sufficiently simple to make this unnecessary.

Simple app-based configuration

The app has a simple arm/disarm' toggle for setting the proximity alarm, but this must be set in conjunction with the physical activation switch on the fob. There's also a "Find my key" option that manually triggers the fob's alert, which is useful for people who tend to lose their keys more often than their smartphone.

Conversely, the fob also has a button that manually triggers the app's alert, which is useful for finding an iPhone when it isn't where you thought it was. Both the fob and app will also sound an alert if someone tries to remove the BungeeAir Power Wireless Security Tether case, while a silence' switch on the fob is handy when nipping out of tether range for a moment although leaving the iPhone unattended and unsecured defeats the object somewhat.

It works well too, although the credit card-size stand that clips to the back of the case to act as a desktop prop seems a little pointless not least since it's just one more thing to remember to carry.

Watch the video below to see the Kensington BungeeAir Power Wireless Security Tether in action.

Verdict

Kensington’s Bungee Air Power Wireless Security Tether is a simple way to add an extra layer of security to an iPhone 4, whether it’s for people seriously concerned about who might have their hands on their smartphone, or just for forgetful types. The extra bulk added by the case will cause problems for some accessories and anyone who prefers to see the sleek lines of the naked gadget, but the extra battery power it provides should make it tolerable.

Dimensions: 133.3 x 64.3 x 17.1mm Weight: 70g

Both Microsoft and Adobe have welcomed the new year by announcing some notable patching days for IT departments to be aware of.

Microsoft usually keeps Patch Tuesdays quiet in January, but has issued seven security bulletins for eight vulnerabilities.

One of those is a critical remote code execution vulnerability in Media Player, although for users of Windows 7 and Windows 2008 R2 its severity is downgraded to 'important.'

The remaining bulletins are ranked as important. One of those covers the BEAST SSL flaw highlighted by researchers last year.

Next Tuesday it will be interesting to see, which exact Windows features are involved and how this vulnerability can be used by attackers.

Researchers found a way to exploit a long-known flaw in TLS (Transport Layer Security) that could have undermined the security credentials of the SSL cryptographic protocol and affected millions of sites. However, little emerged from the discovery.

"Bulletins three and five, while rated 'important' both involve Remote Code Execution, most likely through a specifically crafted input file to one of the Windows standard programs and should also be high on your list of bulletins to look at," recommended Wolfgang Kandek, CTO of Qualys.

"Bulletin two stands out as it is tagged as 'Security Feature Bypass,' which is a new category. Next Tuesday it will be interesting to see which exact Windows features are involved and how this vulnerability can be used by attackers."

Adobe will join Microsoft in issuing updates tomorrow (10 January). It will address critical flaws in Reader and Acrobat.

"These updates will include fixes for CVE-2011-2462 and CVE-2011-4369, previously addressed in Adobe Reader and Acrobat 9.x for Windows," Adobe said in its advisory.

Oracle is also due to issue its quarterly security update on 17 January, making it a busy month of patching for IT managers.

Check Point's new 2200 Appliances combined enterprise level network security with an SMB price tag. Its software blades provide a wealth of features, but do they complicate deployment? Read this exclusive review to find out.

Aimed at SMBs and remote office deployments, the new 2200 family of security appliances stand out as they are available with all the same software blades as Check Point's enterprise appliances. This makes them very easy to customise as you just pick the blade package that suits your current needs and upgrade as your needs change.

In this exclusive review we look at the 2210 model which comes with all ten security software blades. The list starts with Check Point's well respected SPI firewall and includes IPsec VPNs, clustering, identity awareness and mobile access security plus a one year subscription to IPS, application control, URL filtering, anti-virus and anti-spam.

Two extra blades are included as standard with all 2200 appliances - security policy management and logging. If you don't want all these features you can start with the entry-level 2205 model which costs around 2,300 and comes with the firewall, IPsec VPN, clustering, identity awareness and mobile access security blades.

This compact appliance has six Gigabit Ethernet ports that can be configured for LAN, WAN or DMZ duties as required. It uses a small internal fan but, unlike Fortinet's noisy 111C appliance, it's virtually silent.

Your first port of call is the appliance's web console which provides a handy wizard that runs through network configuration, setting up your internal and external ports and securing administrative access. The appliance has a 250GB hard disk and this can be used to store system images for backing up and restoring various configurations.

For all further security policy and blade management you download the SmartConsole software directly from the appliance. This installs a heap of management and monitoring utilities which includes the SmartDashboard for creating and deploying security policies.

A row of tabbed folders provides easy access to all the components. A network object is automatically created for the appliance and selecting it loads a properties window where you can activate each software blade.

All traffic is blocked by default so you need to create firewall rules which comprise source and destination objects, services, time schedules and logging options. Plenty of rule actions are possible as you can permit, deny or drop traffic and enforce user authentication.

Check Point has augmented its URL filtering services with a new AppWiki feature, so it doesn't just rely on traditional category databases. AppWiki makes the web filtering blade far more versatile as it provides a database of over 4,500 Web 2.0 apps, options for controlling specific Facebook activities and a list of nearly 250,000 social network widgets.

During testing we found this blade performed extremely well with very few web sites slipping past our filtering policies. For each policy you can block or allow access, request authentication and present warning web pages, redirect users or display a page informing them that an AUP is in place.

The anti-spam blade also performed well during testing with live mail as it returned a high detection rate of 98 per cent over a two week period. However, we had to tweak the confidence score for suspected spam as it was initially throwing up too many false positives.

The mobile access blade is a new feature and is designed to provide secure access for remote workers using PCs, laptops or mobile devices that want to access corporate resources. A wizard takes you through the process of creating SSL VPN portals, choosing which apps and resources are to be made available and picking an authentication method.

The identity awareness blade is also new and is used to link user names to systems, so security policies can be applied to user identities regardless of where they log in from. Setup is also wizard driven and you can define AD authentication and use captive portals for guest workers or visitors.

For monitoring and reporting, Check Point uses a central log server that all other appliances send their data to. For standalone deployments this means the appliance will be handling these duties as well.

The SmartView Monitor provides views of activities in real time with traffic graphs for areas such as the top services, destinations, sources and tunnels. Viewing the system counters allows you to keep an eye on processor and memory usage, firewall activity, packet size distributions and so on.

Policy activity for each security blade can be viewed from SmartEvent. The latest v75.20 version of SmartConsole provides a freshly designed interface which includes real time views, graphs and timelines so you can easily see threat trends and anomalies.

You can't view activity for the anti-spam blade in SmartEvent and will need to use the SmartReporter tool for this. SmartReporter provides an extensive selection of reports which can have a range of filters applied and be scheduled to run regularly and emailed to selected recipients.

We did come across some problems though, as the only available anti-spam report is hidden in the Express report section and can only look back over the previous 14 days. We also found some of the URL filtering reports wouldn't generate any data and suspect they still only work with Check Point's older legacy blade.

Check Point's new 2210 appliance has a lot of sophisticated security features for the price. They're not the easiest to deploy and manage, but Check Point's software blades are a great idea as they allow you to customise the appliance precisely to your requirements.

Verdict

Check Point’s SmartConsole management and monitoring tools are geared up towards handling multiple appliances and this makes the 2210 best suited to remote office deployment or offered as a managed security solution. SMBs will find the appliance offers a very impressive range of features that perform well for the price, but as a standalone product it’s not the easiest to deploy and manage.

Chassis: Desktop Memory: 2GB RAM Network: 6 x Gigabit Ethernet Storage: 250GB SATA hard disk Ports: 2 x USB2, RJ-45 console Management: Web browser, CLI, SmartConsole Software: SmartDashboard, SmartEvent, SmartProvisioning, SmartReporter, SmartUpdate, SmartView Monitor, SmartView Tracker

Netgear's ProSecure UTM appliances have always been affordable gateway security solutions for cash-strapped SMBs. Its latest UTM9S is its first to have a pair of modular expansion slots and integration with the company's ReadyNAS storage appliances.

This desktop box is positioned between the UTM5 and UTM10 appliances and has claimed throughputs of 130Mbit/s for its SPI firewall and 21Mbit/s with anti-virus (AV) scanning enabled. Netgear doesn't apply per-user licenses, but we reckon the UTM9S is good for at least fifteen users.

The UTM9S has the same software features as all the other UTM appliances which include an SPI firewall, IPS and support for IPsec and SSL VPN tunnels. Netgear's security partners need no introduction as you have Mailshell handling anti-spam, Sophos dealing with viruses and malware and Commtouch stepping up for URL category filtering.

The appliance has four Gigabit Ethernet ports for LAN duties and two more for WAN connections which can be placed in load balanced or failover teams. Traffic metering can also be enabled on any of the WAN ports including any expansion cards. This enforces monthly upstream and downstream limits in MB and either blocks all web traffic or allows only email when these thresholds have been breached.

The web browser's wizard had us up and running in minutes.

The UTM9S functions as a transparent gateway so installation is a cinch. For testing we dropped it between the lab network and our Internet link and the web browser's wizard had us up and running in minutes. The appliance is preconfigured with two firewall rules to look after inbound and outbound traffic. You can add custom firewall rules if you wish and apply bandwidth restriction and quality of service (QoS) profiles to selected services.

ReadyNAS integration requires an add-in to be installed on the storage appliance after which it can be used as a quarantine area and remote log store. Previously, if you powered off a UTM appliance all its logs and Flash-based graphs and statistics tables were lost.

Once powered back up, it checked the NVX and restored all graphs and tables to their current state. ProSecure UTM appliances can't quarantine mail and malware locally, but this new feature solves this problem neatly by offloading this task onto the NAS appliance.

The UTM9S can be upgraded using the optional wireless and VDSL/ADSL2+ modules.

The wireless module costs just 33 which is good value. It 802.11n in either the 2.4GHz or 5GHz bands. It doesn't support multiple SSIDs, but you can create a single profile with your chosen security and encryption settings, including MAC address filters.

The VDSL/ADSL2+ module is configured from the same tab in the web interface as the two Gigabit Ethernet WAN ports. Setup is simple as an auto-detect function sorts out most of the settings and you can use it as your primary WAN interface or link it with the Gigabit Ethernet ports for auto-rollover or load balancing.

Sophos' virus scanning can be applied to SMTP, POP3 and IMAP accounts and all updates are automated with checks as often as every fifteen minutes. HTTP, FTP and HTTPS traffic are also scanned and adding the latter as a standard feature makes the UTM9S even better value.

Anti-spam options include black and white lists and RBLs plus Mailshell's distributed spam analysis which has five sensitivity levels. For anti-spam testing, we left the appliance on its default setting filtering live mail for two weeks.

We configured the appliance to tag the subject line of suspect messages, but pass them through to our Outlook clients. Using rules to move tagged messages to separate folders we saw a decent spam detection rate of 97.2 percent with no false positives.

Negear provides basic IM and P2P app controls and these have been augmented with five extra services for blocking the iTunes Store, Rhapsody, QuickTime Player, RealPlayer and Winamp. You also get options for blocking other services including GoToMyPC remote control sessions.

The appliance supports a wide range of authentication methods and you can force users to login to the appliance before being allowed Internet access. A global web access policy is enforced, but this can be customised using exception rules assigned to selected domains on the appliance. Rules allow you to either block or allow specific web categories, applications or file extensions for a domain.

The monitoring section's Dashboard includes counters for all the new services as well as Flash-based real time threat and network traffic graphs.

The monitoring section's Dashboard includes counters for all the new services as well as Flash-based real time threat and network traffic graphs. These include counters showing the top detected threats for all security modules and you can generate HTML reports from the web interface and email them out.

The ProSecure UTM9S is excellent value thanks to its useful range of security features which performed well. The UTM9S is available with a one-year subscription for a very reasonable 307 ex VAT with a full three year subscription only pushing this up to 517 ex VAT.

So what's our verdict?

Verdict

The ProSecure UTM9S is a good choice for small businesses that want a low-cost UTM appliance that doesn’t skimp on features. You will need a ReadyNAS appliance for the new logging and quarantining features, but the extra expansion modules make it very versatile and our lab tests show that its anti-spam performance is good.

Chassis: Desktop Memory: 512MB RAM Flash storage: 2GB Network: 6 x Gigabit Ethernet (4 x LAN, 2 x WAN) Expansion slots: two Anti-virus: Sophos Anti-spam: Mailshell URL filtering: Commtouch Management: Web browser Options: Wireless-N module, £33; VDSL/ADLS2+ module; £61 (all ex VAT)

The European maritime sector has next to no idea about cyber security, according to a report released by the European Network and Information Security Agency (ENISA).

The shipping industry, which carried 52 per cent of goods traffic in 2010, has "currently low to non-existent" awareness of cyber security needs and challenges, the report said.

This overall low awareness represents a concern as there is an increased dependency on ICT of all key players.

ENISA claimed the lack of understanding was evident at every layer of the industry, from government bodies to port authorities and maritime companies.

"This overall low awareness represents a concern as there is an increased dependency on ICT of all key players, processes and activities within the maritime sector," the report continued.

"Indicators of this dependency are the increasing number of ICT systems implementations in ports worldwide, and the continuous increase of volume and complexity of information and data exchanged."

ENISA considered the maritime sector to be one of Europe's critical infrastructure industries, saying the continent was " critically dependent" on the movement of cargo and passengers over sea.

Given critical infrastructure is a key target for cyber criminals, the body recommended European nations to boost awareness

"Member States should consider developing and implementing awareness raising campaigns targeting the maritime actors. In particular the provision of appropriate cyber security training to relevant actors (e.g. shipping companies, port authorities, etc.) would be highly recommended," ENISA's report read.

"Such awareness campaigns and training initiatives should target all relevant actors involved in the maritime sector, while their provision could be coordinated by relevant cyber security organisations."

Security and WAN optimisation provider Blue Coat Systems has agreed to be acquired for $1.3 billion (836 million).

The vendor's board has apporoved the acquisition by an investor group led by San Francisco-based private equity investment firm Thoma Bravo.

Blue Coat confirmed it would focus on its core areas of internet security and WAN optimisation.

"After an extensive evaluation of strategic alternatives with our independent advisors, the board has determined that the definitive agreement with Thoma Bravo provides an attractive all-cash valuation to our shareholders," said David Hanna, chairman of the board at Blue Coat.

"We look forward to completing the transaction under the terms of the agreement as expeditiously as possible."

Blue Coat has suffered from declining sales this year, as well as a stock drop of 41 per cent, Reuters reported.

The company is also being probed by the US Commerce Department to see whether Blue Coat provided internet-blocking equipment to Syria something which would break a US trade embargo to the troubled nation.

Blue Coat said it was working with the US Government, claiming it believed its equipment had been transferred illegally to Syria.

WikiLeaks has also claimed Blue Coat technology was sold to Governments and subsequently used to prevent dissidents from organising protests online.

Blue Coat said its technologies were "being cast with all these things and that's not what our products do."

The company also replaced its CEO in August during a turbulent year.

Who's Thoma Bravo?

Thoma Bravo is one of the owners of Attachmate, the company that was bought from Novell last year for $2.2 billion.

The company has some major investments in the tech sector. It claimed to have a strong interest in the security industry too.

"Blue Coat marks the continuation of Thoma Bravo's investment efforts in the security technology industry, and is the firm's fifth security technology platform investment," said Seth Boro, partner at Thoma Bravo .

The deal is expected to close in the first quarter of 2012.

The biggest issue preventing companies from moving to the cloud has always been security, yet there are many complications IT departments have to consider.

When IT Pro and sister title Cloud Pro brought together experts from across the field at our Cloud Summit to discuss the complexities of cloud security, we got some solid answers.

One major contemporary concern is around the Patriot Act, which could allow US Government to go into cloud data centres to gain information, even if they're not on US soil.

You have to approach cloud providers as if they're insecure.

According to HP's UK & Ireland storage and server chief technology officer David Chalmers, however, HP will not open its doors in the UK to any US body enforcing the Patriot Act.

This was something that was echoed by Rackspace's vice president of technology Nigel Beighton, who said its UK datacentres would do the same.

So those relying on UK-based cloudy datacentres can fear not. But should people be worried about security of the providers' themselves?

"You have to approach cloud providers as if they're insecure," recommended Beighton, who quickly pointed out that didn't mean Rackspace was insecure.

He said it would be wiser to assume cloud solutions can't be trusted in order to ensure the information that businesses are putting up in the cloud is as secure as possible. Due to the risks involved, such an approach would also mean hybrid services are considered where necessary, according to Beighton.

Rik Ferguson, Trend Micro's director for security research, said businesses should approach vendors as if they were estate agents. He urged people to look into all the different options and pick the one that suits the customer's cloudy plans.

Businesses should be wary of complacency too, Ferguson said.

"Don't forget about the perimeter. The perimeter is still there, you just have to find where it is... To break through the cloud's perimeter, all you need is a credit card," he added, noting the importance of making cloud-based apps as secure as possible.

But what about when cloud providers' services are being used for malicious activity? Ferguson said it was certainly a possibility that users' services could be disrupted if law enforcement have to enter cloud datacentres and remove the hardware.

The providers themselves were a little stumped, but Beighton said they do checks on who is using their services. This includes checks on what kinds of credit cards are being used to buy cloud infrastructure and monitoring for spam. It was unclear, however, how vendors would comply with warrants to remove servers from datacentres and still ensure customers were unaffected.

There is a clear need for definite processes and standards for cloud security. Once these come into place, adoption will surely skyrocket.

Look out for the rest of our coverage from our Cloud Summit and the inaugural IT Pro awards this week.

COMMENT Revolution has been a big theme of 2011. Not just in the political sphere, but in the tech world as well.

Indeed, the two became intertwined during the Arab spring, when social media was used as a key communications tool for the revolutionaries.

An insurrection of sorts looks set to take place in the security industry too. The two overlords of the market - Symantec and McAfee - are under attack.

Anti-virus is a hoax. The engines are not working.

The minnows of the industry are starting to get aggressive, especially in their comments about the old guard.

Over the past few months, a refrain has repeatedly crept up in conversations with these young up-starts: the old systems don't protect against new threats.

The mighty minnows

According to Nir Zuk, founder of Palo Alto Networks, traditional vendors are still selling the same engine used to detect threats that was created nearly two decades ago.

"Anti-virus is a hoax. The engines are not working," Zuk told IT Pro.

He believes traditional AV vendors are even wasting money on ensuring their products are the default choice on PCs sold directly to consumers. What's more, they don't even seem to be gaining any financial benefit from it, he claimed.

"That's something you will not see in their results," Zuk added. "The consensus is that they will never see their money back."

Another consensus amongst these security companies is that the old database, or signature-based system does not work as highlighted by M86 Security recently.

They make a valid point you can't detect zero-day threats by referring back to a database of known malware. It's just not possible. For real protection, you need systems that can identify dodgy traffic or dangerous code in real-time, or close to real-time at least.

As attacks become more targeted and are able to bypass standard AV, it becomes clear the old systems do little to prevent serious breaches.

Of course, there are some histrionics on the behalf of these feisty new security companies. They need to make a name for themselves and lambasting the security giants of today's world won't do them much harm. Having said that, Zuk's firm is partnered with Symantec so take his comments with a punch of salt. On top of that, Palo Alto uses a database itself behind its appliances is a Webroot database. Make of that what you will.

Regardless, their comments about the flaws within the old systems are hard to deny.

The Symantec way

So what does Symantec have to say about others openly trashing the way it detects threats? Greg Day, who recently moved from McAfee to Symantec (saying his new role as EMEA CTO was "a breath of fresh air"), was convinced the claims against the number one security player were rubbish.

"The first thing is, Symantec is not purely signature dependent. We have in there signatures that we put to the client and we also make use of the cloud to gather real-time intelligence and apply smart controls in much the same kind of mentality that M86 do," Day said.

He pointed to Insight, which uses a wealth of information to determine whether a file is safe or not, such as looking at its provenance or whether it has a digital signature. That's still not a real-time model is it? Does it not still require old information to detect a potential threat?

"I agree it's not quite real-time because it's comparing with others in the cloud but I would say that it's probably real-time plus a few seconds," was Day's response.

"In many ways the thing you probably want to be most concerned about is something that is new and no one else has seen but I don't think you've got the time and effort involved to do that," Day added.

"At the end of the day, when you get the world's smartest threat and somebody has spent a lot of time and effort on it, even if it is picked up by anybody, what are they [the malware creators] going to do? They will keep tweaking and tweaking it until they think it will get through."

We need to start taking a more balanced view of accepting that people make mistakes, targeted attackers will at some point get in.

He admitted targeted attackers will be able to pierce defences and cause havoc. To deal with this, Day called for a focus on what to do after a break-in.

"The underlying trend here is that we spent decades building up great defensive techniques and actually I think we need to start taking a more balanced view of accepting that people make mistakes, targeted attackers will at some point get in and I think we have to start thinking about how we make security more bi-directional," Day added.

"If the user does click on the wrong thing, how do I put the controls in place that mean I have at least the forensics or the auditing to know what left and preferentially I can stop it going out of the door to start with."

Symantec doubters would have leapt on those comments, claiming security companies should be improving how they defend companies from attacks, not how to protect the information following a compromise.

Whatever you think of Symantec's DLP-focused approach though, it's clear the company recognises a shift in the threat landscape. It's just taking its own path towards change.

Yet Zuk is convinced such big companies can't adapt to the shift occurring in the sector, where targeted threats present the most significant problem. "Big companies cannot change to new markets," he continued. "There is no way they will adapt."

Of course, Zuk can't possibly be sure about that. Symantec, and others like McAfee, Trend Micro and Kaspersky, all have the financial clout to invest in either R&D or in an acquisition. They can adapt, they just need the foresight and willingness to do so.

In reality, the old guard will remain in the upper echelons of the industry for some time, whether they change their protection technologies to block zero-days outright, or they move to post-attack strategies and the DLP market.

The new guard

What's really exciting is the innovation and sheer gall of the new generation of security companies. They have potentially disruptive new pieces of technology at their disposal which really could upset the big players.

Furthermore, these minnows don't look like they will cave to pressure from their more powerful rivals. Like any company which wants to get big, Palo Alto is one of those that scoffs at acquisition attempts.

With that kind of attitude, and the fact that in only four years it is already supplying major banks across the world, Palo Alto is a company that looks sure to succeed. Contemporaries like M86 and cloud-based security firm Zscaler look on the path to becoming bigger players as well.

And as for the IT guy, greater competition only means better products. In turn, that means a safer business. It's a win-win for them.

The Netgear UTM 150 is a unified threat management device: an internet gateway, with a built-in stateful firewall and subscription web and email filtering. It sits between your broadband connection, or connections, and the internal network.

Set up is instantaneous; simply plug in your broadband device. The UTM150 has four WAN ports: so if one internet connection goes down, it switches immediately to a backup. Alternatively, you can configure it to load balance across all available bandwidth, helping to get the highest speeds and best return on investment from your broadband.

The firewall's basic configuration is to allow all outgoing connections, but only let incoming connections that have been requested by a client behind the firewall. You can easily customise this using the web interface, allowing or blocking specific services. We tried blocking and allowing a range of services, for the whole network, for certain device groups on the network and by schedule with perfect results every time.

Web- and email- and spam-filtering only works when you subscribe to the online filter services bundled with the product. A year's free subscription is included with the UTM, after that you pay $1062 (approximately 660) for a 1-year account and $2710 (approximately 1,685) for a 3-year account.

Content filtering worked well, but sometimes threw up false positives. It's easy enough to remedy using whitelists though.

URL filtering worked all the time, without any exception. Content filtering worked well, but sometimes threw up false positives. For instance, it classified an online human resources booking system as a "computers and technology" site, which was therefore blocked under the filtering scheme we had set up. Overall, however, the number of false positives was low, and it's easy to put a site on a whitelist if you want to make an exception for it but still keep your general rule.

Email antivirus filtering efficiently stripped out .exe and other suspicious files, as we'd specified, and scanned all outgoing messages without noticeably delaying their being sent. We did, however, have to remove the [MALWARE FREE] notice that the device, by default, adds to all outgoing mails it scans.

As well as being a switch, internet gateway and a security appliance, the UTM150 is also a VPN gateway, with support for both IPSEC and browser-based SSL VPNs. Setup is relatively easy, using the built-in VPN wizard. The SSL VPN is particularly useful, allowing users to access the local network from any computer with an internet connection and a browser, no client software required. We used the VPN to remotely access our network over the course of a week, working remotely with all the machines on our server accessing files and taking over some of the systems using Remote Desktop Connection. The VPN connection was reliable throughout.

By segmenting devices on the LAN into groups, by IP address, it's easy to apply different settings to different users, or groups of users, on your network.

One of the things we liked most about the UTM150 was its flexibility. With it, you can block or allow access to content for everyone on your network or for certain groups only. In the Network Configuration screen, you simply arrange devices by IP address into groups. Then apply to each group the appropriate level of content filtering. You can also apply different schedules to different groups, for instance allowing a group of machines restricted access to the internet during the week. but unrestricted at the weekend. This level of specificity was very useful, making it possible to prevent some users on our network gaming and using certain websites except at the weekends.

We did have trouble with the appliance's handling of SSL certificates. Even when we had installed the UTM's root certificate in our client browsers and told the UTM to trust some of our test sites' certificates, we still had problems accessing the sites, with some content not displaying properly. There was no reason we could see for this and we couldn't find a way around it.

Managing access to SSL sites can be time consuming.

Thankfully, the web interface itself is fairly well organised, so even when you can't remember where something is, you tend to find it fairly quickly because it's in the place you'd logically expect it to be. For larger networks there's also LDAP integration particularly useful for creating VPN users. You can also use the device's own database, but you need to make sure that you don't try and associate the same account with more than one function. For instance, if you have an IT admin who's also a VPN user, that person will need two user accounts.

Compared to a conventional router, the UTM150 is expensive. But for that price, you get the built-in switch, the firewall and the web and email filtering capabilities. Of course, you don't get integrated wireless. We used a Netgear WNAP320 wireless access point during our test. Given, however, the free bundling of the filtering services for the first year and the good price thereafter (a subscription to the Spamhaus spam blacklist alone costs around $370 a year) the UTM150 is still good value.

So what's our verdict?

Verdict

It's not perfect, but the Netgear ProSecure UTM150 provides comprehensive cover against the security threats faced by most small business networks, giving you the tools you need to manage both your users and the risk that comes with exposing your systems to the internet.

Chassis: Desktop Performance: 400Mb/s firewall; 130Mb/s UTM Memory: 1GB RAM Network: 8 x Gigabit Ethernet (4 x WAN, 4 x LAN) Wireless: None Ports: 1 x USB2 Management: Web browser

Cisco has announced two new appliance-based email services that could help businesses handle compliance, management and security issues.

IronPort Outbreak Filters uses a combination of a malware-signature database and on-the-fly analytics to scan incoming emails to determine if any are spam or link to malicious payloads. Cisco claims the Filters can analyse not only text, but images, attachments, hidden code and scripts too.

If a user clicks on a link leading to a malware-infested webpage, the user will be redirected to a warning page instead.

Meanwhile, IronPort Business Class Email apparently includes extensive email security controls, such as recalling messages, message expiration and deciding who can forward an email and to whom. Depending on what other infrastructure their company has in place and what other services they use, Business Class Email users may also be able to use their email account user name and password to log into other services.

Administrators will also be able to enforce minimum levels of password complexity.

According to Soni Jiandani, Cisco's senior vice president of the Server Access and Virtualisation Technology Group, the IronPort services are examples of the benefits of proactive network-based security that customers can reply on instead of having to install and manage their own endpoint security checks.

Both Outbreak Filters and Business Class Email run on top of Cisco's existing range of C-series email security appliances which are available now.

The NHS has signed a deal with Zscaler a cloud-based security and bandwidth management company.

A document seen by IT Pro detailed a Zscaler webinar stating the NHS was a customer, even though no formal announcement has been made.

Zscaler's product offering sends all customer traffic through the cloud, analyses it and then allows organisations to add policies on both security and bandwidth management.

No further details on the contract have been officially released.

The service could feasibly run through the NHS N3 broadband network, which is provided by BT. The telecoms giant confirmed a deal was in place.

At the time of publication, however, neither Zscaler nor BT had provided further details on the NHS agreement or whether it would go through the N3 network.

N3 is one of the biggest virtual private networks in Europe. It is used to manage the NHS electronic booking service and the electronic transmission of prescriptions. Essentially, it handles plenty of important data, which evidently needs protection.

To date, 180 million prescription messages and 14 million bookings have been sent over N3.

The NHS contract represents a big win for Zscaler, which looks set to provide protection for 1.3 million users operating over N3. The company provides software-as-a-service (SaaS) security, running customers' traffic through over 40 of its data centres to protect against threats.

Its key protection areas include email, web security and data loss prevention. The last area will be important for the NHS, which has seen data leave its premises and go missing numerous times.

The deal also instantiates the UK public sector shift to the cloud something the Coalition Government is keen to push, despite its reservations to talk specifically about the G-Cloud project.

Hacking group LulzSec sent an email to the NHS this week warning the public body about flaws in its IT infrastructure.

LulzSec, which claimed to be behind a recent hit on Sony, said it had obtained passwords of IT administrators and emailed the NHS about what it took "months ago."

"While you aren't considered an enemy, your work is of course brilliant we did stumble upon several of your admin passwords," LulzSec said in the email.

"We mean you no harm and only want to help you fix your tech issues."

The Department of Health (DoH) said the issue only affected "a very small number of website administrators," noting no patient information had been compromised.

"No national NHS information systems have been affected," a Department of Health spokesperson told the BBC.

"The Department has issued guidance to the local NHS about how to protect and secure all their information assets."

LulzSec, which calls itself a group of "pirate ninjas," has upset a number of corporations recently, in particular Sony, Nintendo and FBI affiliate Infragard.

In the latter case, LulzSec targeted one Infragard user in particular Karim Hijazi, chief executive of private botnet monitoring service Unveillance.

LulzSec claimed Hijazi offered to pay the hacking collective "to eliminate his competitors through illegal hacking means" in return for its silence.

Hijazi said he had been threatened by LulzSec and asked to provide money and botnet information to the collective.

In a back and forth exchange between the two parties, LulzSec claimed it was attempting to do good, while Hijazi alleged the group was in it for extortion.

ANALYSIS Given the lukewarm response to panicky reports surrounding the need to switch from IPv4 to IPv6, it would come as no surprise if people didn't go mad for World IPv6 Day.

Today, however, could make a big impact and rightly so. Just the fact the likes of Google and Facebook are supporting the event should be enough to inspire most aspiring businesses.

The fact is, there is more to the situation than simply IPv4 addresses running out. If companies don't prepare themselves, they could be shooting themselves in the foot, leaving a wound which won't heal.

Security worries

One big worry is security and the central issue here is detection.

Cyber criminals could use IPv6 traffic to bypass firewalls and security appliances, some of which will not have been configured to pick up on IPv6.

Hackers have picked up on this already, preparing attacks on firms who haven't equipped their networks for the switch, according to Qing Li, chief scientist at Blue Coat Systems.

"One of the biggest problems today is attackers are leveraging IPv6 to circumvent security protections and security policies," Li told IT PRO.

"You really have to have the intelligent, security orientated appliances and solutions to be able to have the visibility and control to secure traffic."

Li recommended creating secure user policies and accelerating or optimising IPv6-enabled web content to deal with transitional problems.

The move to IPv6 could also cause problems for malware authors themselves.

Another annoyance for IT with IPv6 will be down to consumerisation. Each modern device entering a corporate network will come with a separate IPv6 address, rather than sharing one IPv4 address. This means IT departments will have to keep a closer eye on what those devices are doing.

Despite the concerns, however, the move to IPv6 could also cause problems for malware authors themselves.

"With the introduction of IPv6, the massive amount of possible addresses in a default subnet and additional software tweaks has created new challenges for malware authors and cyber criminals," Symantec said in a blog post.

"It is now unfeasible to perform brute force IPv6 address scans in order to profile a network or identify a possible attack vector in this way. IPv6 also mitigates a number of existing IPv4 attacks by design."

IPv6 comes with an added security protocol known as IPsec, which authenticates and encrypts data sent across an IP enabled network, Symantec noted.

Outside of this security boost with IPv6, companies stand to benefit from IPv6 in other ways.

When talking about the move to IPv6, the big message from tech giants has been around the need to support the growth of the internet. Of course, businesses should care about this if they want to continue making money out of customers across the internet.

"Ignoring the move from IPv4 to IPv6 will seriously hinder the growth of the internet, something companies of this stature should be only too aware of," said Melvyn Wray, senior vice president of product marketing in EMEA at global networking infrastructure provider Allied Telesis.

"A reluctance to accept the switchover could prevent UK businesses from benefiting from enhanced security features and communicating with their customers around the world, holding back the development of a new wave of connected devices something that is economically unviable in today's business environment."

Piers Daniell, managing director of business ISP Fluidata, urged companies to ensure their websites are compatible with both IPv4 and IPv6 to make sure they don't miss out on contact with customers. Daniell called on ISPs to help firms in enabling dual-stack capability.

"Even today most hardware shipped by ISPs to providers still doesn't cater for IPv6 or will only once a software patch is applied," he added.

"I am a great believer that if ISPs can assist adoption, it will speed up the development of new services, which would only be possible with IPv6. This will increase the UK's competitiveness on a global scale."

Another benefit of shifting over to IPv6 is the greater visibility of individual IP addresses something marketers could harness.

"With IPv6, for instance, organisations and marketers can immediately develop a more personal and direct relationship with the connected-device user - as all devices using IPv6 have unique publicly-visible IP addresses," noted Jeff Burdette, director of research and development at IP intelligence expert Digital Element.

"This differs from IPv4, which in a common deployment, can't necessarily distinguish whether one device or one hundred devices is accessing the website from a single IP address at any given moment."

So from security to marketing, there are clearly plenty of business benefits from the move over to IPv6.

Don't panic!

Whilst all of this may seem a little scary, a key message here is not to panic if you haven't started adapting your network already.

Even if you're not taking part in today's testing, use the event to kick-start processes on working out what needs to be done with IPv6. Then implement changes where necessary.

As we've seen with Google and Facebook, many tech firms have moved to support IPv6, so when it comes to relying on providers and other vendors, businesses shouldn't have too much to worry about.

"The internet is maturing and the protocols need to change to enable this," said Matt McCloskey, head of applications and services at Virgin Media Business.

"However, there's no need to panic; we've been expecting this for a long time and the necessary precautions have been taken to ensure a smooth switchover."

Whatever you do, don't leave it too late. Otherwise your network will be left as leaky as a sieve and as out of date as a floppy disk.

RSA - the security arm of EMC - has admitted to having a number of its servers hacked, as data on its two-factor authentication product SecurID was compromised.

The firm warned the data could be used to "reduce the effectiveness of a current two-factor authentication implementation as part of a broader attack," and RSA urged customers to take immediate remedial action.

RSA executive chairman Art Coviello said the firm's security systems had been targeted by an "extremely sophisticated cyber attack."

It is believed the attack was in the Advanced Persistent Threat (APT) category, which may indicate a well-funded group of individuals were responsible.

APTs involve significant intelligence research and the use of numerous techniques to hack targets. They need serious investment to be carried out.

RSA is now in the process of informing customers about the dangers and how to strengthen SecurID implementations.

"We have no evidence that customer security related to other RSA products has been similarly impacted," Coviello said in an open letter to customers.

"We are also confident that no other EMC products were impacted by this attack. It is important to note that we do not believe that either customer or employee personally identifiable information was compromised as a result of this incident."

In an advice note to customers, RSA listed a number of recommendations for customers to follow, with the first point being to increase focus on security for social media applications and the use of them by anyone with access to critical networks.

RSA has a wide range of customers, ranging from high profile private companies to government bodies.

A sad day'

The breach will be damaging for RSA and it could take some time for the EMC division to recover, said SecurEnvoy co-founder Steve Watts.

Watts said it was a "sad day" to see a company with the reputation of RSA being hit by such a significant attack.

"Anyone with an RSA token doesn't know if they're going to be compromised. The industry is a bit concerned," Watts told IT PRO.

"This isn't just a bit of a marketing booboo, this is a major strategic issue. The problem is that it will take quite a long time to get over it."

If RSA has to initiate a recall of a large chunk of its tokens, then this would lump the firm with a costly logistical nightmare, Watts added.

"Is it going to be as extreme as changing every token that is sent out into the marketplace? Is it as far as to send out replacement tokens for every user? That's just beyond measure," Watts added.

Earlier this week, Jim Fulton, vice president at DigitalPersona, told IT PRO many companies were struggling with token deployments as it was.

"I've heard people say that if they could, they'd throw them underneath a lorry and crush them because they hate them so much," Fulton said.

The majority of IT security administrators in the UK claimed workers had little understanding of data protection policies, according to a new report.

Over half of respondents to a Check Point and Ponemon Institute poll doubted the knowledge of employees in their companies when it came to corporate security policy.

Most respondents said managing policies by user, rather than ruling with an all-encompassing approach, was vital to improving security.

Of the 450 IT security administrators surveyed, 52 per cent said identity awareness efforts by organisations would help with such a strategy.

"Employees can play a big role in being a first line of defence, helping their company enforce stronger security measures and promoting more user awareness within the organisation," said Dr Larry Ponemon, chairman and founder of the Ponemon Institute.

"Companies are constantly facing new and costly security risks from both internal and external sources that can jeopardise the business."

The recent hijacking of a Vodafone website, where a blogger handed their password to a group campaigning against the communications giant, again highlighted the dangers of the insider threat.

Complexity

Another major issue amongst respondents was complexity, with 35 per cent naming it the most challenging issue they faced.

UK firms used security solutions from five or more different vendors, according to Check Point.

"To improve security in this day and age, organisations need to get a better understanding of their current environments and prioritise their short and long term initiatives," added Nick Lowe, head of Western Europe sales at Check Point.