4. 6/16/2014 4
WatchGuard is a Best-in-Class Firewall Vendor!
The Info-Tech UTM Vendor Landscape:
“Champions receive high scores for most
evaluation criteria and offer excellent value. They
have a strong market presence and are usually the
trend setters for the industry.”
7. 6/16/2014 7
Best-in-Class AntiVirus: More experience, better technology
Partners focused on
AV for over a decade
Proactive AV technology
More secure AV engines
Much larger staff of
human AV analysts
Streaming Buffered So What?
Fastest Not as Fast Speed at the
sake of security
Supports few
signatures
Supports many
signatures
Buffered
engines catch
more malware.
Basic
Compression
Extended
Compression
Harder to evade
AV
No file/packet
reassembly
Full reassembly Harder to evade
AV
13. 6/16/2014 13
Best-in-Class URL Filtering: Partnering with the #1 Provider
Websense is the #1 stand-
alone web security company
Earned the most web security
revenue four years in a row - IDC
Has provided URL filtering
for decades
The industry's most accurate,
current and comprehensive URL
master database
14. 6/16/2014 14
Websense is a top leader and
visionary in the Web security market,
according to Gartner.
15. 6/16/2014 15
URL Filtering Accolades
Best-in-Class URL Filtering: Don’t take our word for it!
NONE!
NONE!
NONE!
16. 6/16/2014 16
Who do you suppose Facebook
chose as their URL scanning
and filtering solution?
In October of 2011, Facebook partnered
with Websense for URL scanning.
18. 6/16/2014 18
Best-in-Class AntiSpam: Best OEM Solution Provider
Commtouch is focused on
email security and AntiSpam
Has provided AntiSpam
For decades
Patented Recurrent Pattern
Detection (RPD) technology
99% detection rate with
next to no false positives
Review 4 billion messages
a day
XTM
Vendor AntiSpam
since
1991
In-house
In-house
2009 (CAAS)
2003-ish
19. 6/16/2014 19
Best-in-Class AntiSpam: Don’t take our word for it!
Many big companies trust Commtouch
As their best-in-class email security solution
21. 6/16/2014 21
Best-in-Class IPS: Experienced Intrusion Prevention and DPI partner
Over a decade of IPS
experience
State of the Art
DPI Technology
Patent-Pending Application
Control Technology
Has received well-known
industry awards
24. 6/16/2014 24
Best-in-Class IPS & App Ctrl: Don’t take our word for it!
Many companies leverage Broadweb’s
best-in-class IPS and Application Control
26. 6/16/2014 26
Best-in-Class Reputation Defense: WatchGuard’s Cloud -based Security
Increases both
security & performance
First 3rd-Generation IP
Reputation Authority
Pioneered URL reputation
for UTM appliances
Powered by WatchGuard’s
appliance network
Threat
Prevention
Worldwide
Clients
AnalysisPhishing & URL
Blocklists
27. 6/16/2014 27
Best-in-Class Reputation Defense: Reputation Systems are Not Created Equal
Which vendor’s reputation service do YOU want
protecting you at your network?
50%
75%
98%
Barracuda, Trend
IronPort, ironMail
WatchGuard
1st2nd3rd
Threat Capture Rate
Point of Slide: Even though many competitors claim many of the same checklist of security services, some security controls actually work better than others. (Slide acts as an introduction to the overall topic)
As you research products in the security appliance market, you may notice than many products seem to share a similar checklist of security features and services. Seeing this may make you think to yourself, “Acme, Corp. has the same security controls as Widget, Inc., so it doesn’t really matter which product I chose. They’re both pretty much the same, right?”
[CLICK] However, does having the same “line item” security feature really mean both products are equally as secure or good?
[CLICK] No! At WatchGuard, we don’t think so. [CLICK] We know that some security products work much better than others, and the vendors that make these products are Best-in-Class vendors. [Next Slide]
Point of Slide: An overview of our Best in Class strategy, and why it’s better than doing it all ourselves.
WatchGuard’s XTM appliances are multipurpose security appliances that combine many security controls into one easy to manage package – the [CLICK] Swiss Army Knife, if you will, of security products.
However, there is one potential problem when combining many security services into one easy to use appliance…. [CLICK]
Do you know anyone who is the best at everything? I sure don’t. Most people can get very good at one or two things, but no one can become the best at everything.
At WatchGuard, we believe this concept carries over to the security industry; no one vendor can provide the best of every single security service. That is why, unlike our competitors we have strategically chosen to partner with best in class security vendors in order to provide our customers with the industry’s best multi-layered security services. [Next Slide]
Point of Slide: WatchGuard offers a best-in-class firewall with our proxy policies, which offer deep, application-layer inspection and extra security.
Before I dive in to our specific security services to show you how our partners help us deliver Best-in-Class security, I want to remind you that WatchGuard IS a best-in-class vendor, ourselves – specifically, [CLICK]
a best-in-class firewall vendor!
WatchGuard has been in the appliance firewall business for almost two decades--since 1996. In fact, we pioneered appliance-based firewalls.
We are best known for [CLICK] our proxy-based firewall policies. Other firewall vendors have just started talking about “Deep Packet Inspection” and “Application-Layer Filtering” over the past five or so years. On the other hand, our Proxy policies have given our appliances the ability to do application-layer or layer-seven inspection since we started the company, over 16 years ago. That gives us the most mature application-layer inspection of any other hardware firewall vendor.
Furthermore, our proxy services ship with mature, time-tested default security settings, which we sometimes call Protocol Anomaly Detection (PAD). These default settings allow us to block some zeroday attacks which other devices couldn’t.
Between our long experience in the firewall market, and unique features like our proxy policies, WatchGuard is a best-in-class firewall and VPN vendor, bar none.
Which is why [CLICK] analysts like those at Info-Tech, Gartner, and IDC have consistently placed us as a top Firewall vendor.
[Next Slide]
Let’s get back to our best-in-class security service story….
Every single one of our security services comes from a mature, best-in-class partner, who has focused solely on that particular security service for years, sometimes decades. Meanwhile, many of our competitors are just now trying to develop these services themselves, years behind our best in class partners. Even the ones who do partner with a few good outside experts do not do it for all their services, and sometimes lack features and services we have. Finally, one of them recognizes the benefit of best-in-class service, but only offers the option at an added expense.
In short, if you want a multi-purpose security appliance that offers the best of ALL security controls, WatchGuard is your only option.
Let’s take a closer look at some of our security services to see why they qualify as best in class… [Next Slide]
Point of Slide: This is a just a transition slide.
….starting with Antivirus. [Next Slide]
Point of Slide: Introduce our best-in-class AV partners, and highlight why their detection technology is better
As mentioned, we partner with AVG and Kaspersky to bring best-in-class malware detect to our security appliances. Both of the companies have been in business, focused exclusively on catching malware for well over a decade. This experience means their technology is more mature, and quite frankly better than competitors who have just started looking at AV.
For example, [CLICK] nowadays you can not rely only on signature based detection techniques. Today, new daily malware variants significantly out-pace the amount of signatures even the best AV vendor can generate. Thought signatures are still very important, best-in-class AV vendors must leverage more proactive techniques, such as heuristic analysis and code emulate, to detect new zero day malware without relying only on signatures. Both of our AV partners have very mature proactive malware detection engines, which can do just that.
Also, [CLICK] some AV engine architectures are more secure than others. Generally, there are two types of AV scanning engines, a streaming of flow-based engine that tries to scan real-time, as packets pass through a gateway, and a buffered engine, which first reassembles the traffic and file, before scanning it as a whole. Each engine type has pros and cons… but when it comes to security, the buffered engines wins out. In short, a streaming engine’s primary benefit is speed… but this is speed that may come at the sake of security. Because streaming engines don’t reassemble files of packet streams, and don’t support all compression techniques, attackers can evade them much more easily than they can buffered AV engines. To make matters worse, in order to scan quickly, streaming engines must significantly limit the amount of signature they use, which can greatly affect their efficacy.
Finally, [CLICK] a little common sense, both our AV have exponentially more AV focused staff than our competitors who try to do AV on their own. Each of our partners makes more revenue on AV alone, than some of our competitors do period. For instance, AVG has well over 300 human AV analysts identifying new malware. Sonicwall doesn’t even have that many engineers period, and probably only has 10 or 12 AV analysts. Fortinet has made a little more investment into AV, but even they probably have well under 75 to 50 AV analysts. So who would your rather get your malware detection from? A company with hundreds of analysts, whose been doing it for over a decade, or a new comer to the field, with a small, unfocused staff. At WatchGuard, we prefer Best-in-Class solutions..
[Next Slide]
Point of Slide: Best-in-class antivirus has more on-board signatures than competitors in-house solutions. This translates to us blocking more malware than them.
In the word of antivirus, size does matter… signature size that is. The larger your signature database, the more malware you can catch. Let’s take a look ad the signature database for some of our competitor’s in-house AV solutions.
[CLICK] Here’s Sonicwall… they have a tad over 20,000 signatures.
[CLICK] Here’s Palo Alto… they have a bit more.
[CLICK] Fortinet have a few different sets, depending on how you set them up. Here’s what you get with their default streaming AV, which isn’t as secure as buffered AV
[CLICK] Here’s the default signature set for their buffered AV.
So you may notice we are missing so far. In order to show up, I have to totally change the scale of this graph. [Next Slide]
In this scale, you can barely see the signature lines for our competitors… [CLICK] they are tiny specks. Anyway, let’s keep going.
[CLICK] Here’s Fortinet’s extended signature set, only available with some of their appliances.
Finally, we have two sets too. A small set [CLICK] for our table top appliances, and an extended set [CLICK] for our rack devices. Even our small table top appliances have more AV coverage than our competitors large devices. And, as you can see, our normal AV signature set is exponentially larger than any of the competitors.
In short, this translates to WatchGuard protecting you from more malware than our competitors can. Need more proof? How about some 3rd party validation? [Next Slide]
Point of Slide: Third party antivirus testing organizations have validated our best-in-class partners. Meanwhile, most competitors don’t even rate consideration.
There are a number of 3rd party organizations that test antivirus products of efficacy. Three of the best known include, Virus Bulletin, AV Comparitives and AV-test.org. Let’s see how everyone did…
WatchGuard partners with two best-in-class AV companies, the first is AVG. [CLICK] As you can see, all three of these organizations have passed AVG, who has consistently measured as one of the AV top performers.
We also partner with Kaspersky, [CLICK] who also has passed all three of these organization’s tests. In fact, Kaspersky’s AV was voted as the #1 AV Product of 2011 by AV Comparities, and they also got the top score in the AV-test.org shootouts.
Now, how do our competitors do? Let’s start with Fortinet. [CLICK] Well, the only positive news is Fortinet was in one test, which they passed. However, they were not a top performer, and AVG and Kaspersky both did better. Meanwhile, Fortinet’s AV solutions were not even considered for the other 3rd party tests.
Even worse, [CLICK] none of the other competitor’s AV solutions are even considered for these third party tests. We suspect they simple would not do as well as our best-in-class partners solutions.
But don’t take our word for it…. [Next Slide]
Point of Slide: Best-in-class AV vendors should receive many awards. Bad vendors will not have any.
If you are really good at what you do, you get awarded for it. A best-in-class partner should get awards, certifications, and accolades recognizing that they are the best at what they do. Let’s take a look at our best-in-class AV partners vs. our competitors.
[CLICK] Here’s AVG’s awards and accolades. As you can see, they have plenty.
[CLICK] Kaspersky has many awards too. As I mentioned before, they even scored as the best AV product in 2011.
[CLICK] In comparison, Fortinet only has a measly two certifications.
[OPTIONAL] As an aside, our best-in-class AV partners also help feed our cloud-based reputation services called Reputation Enabled Defense or RED, which makes it one of the most accurate and useful cloud reputation services on the market
[Next Slide]
NOTES:
Some AVG tidbits
Recognized as the #3 most known security brand behind SYMC / McAfee
4th largest global AV vendor
28,000 resellers, partners and distributors
Point of Slide: This is a just a transition slide.
I’ve shown you how our AV partners are the best on the market. Now, let’s move on to URL Filtering. [Next Slide]
Point of Slide: Our Web URL-filtering partner is the #1 vendor in web filtering and security
What’s the best way to get best-in-class URL filtering? Simple. [CLICK] Partner with the #1 vendor in stand-alone web security, which is WebSense.
Most agree, WebSense is the #1 name in stand-alone web security. In fact, according to IDC, [CLICK] they have earned the most stand-alone web security appliance revenue for four years in a row.
[CLICK] They are a very experienced and mature company that has done URL filtering and web security for decades. In fact, they’ve been doing it almost a decade longer than any of our UTM competitors have, who just started with their own in-house solutions.
[CLICK] And they provide the most accurate, timely, and category rich URL Database on the market. [Next Slide]
All this is why, Websense is a top leader and visionary in the Web security market, according to Gartner. [Speaker: Feel free to explain MQ positioning and show Websense’s top spot]
But again, you don’t just have to take our word for it…. [Next Slide]
Point of Slide: Best-in-class URL filter vendors should receive many awards. Bad vendors will not have any.
So let’s take a look at awards and accolades again. Who has received awards for URL filtering and web security?
[CLICK] WebSense, our URL filtering partner, has received plenty of awards. Here’s just a recent sample.
How about our competitors? [CLICK] Nope… None of the competitors who do in-house URL filtering have received any awards for their URL filtering solution. So who do you think is the best-in-class solution? I think it’s fairly obvious. [Next Slide]
However, if you want a little more anecdotal proof… Facebook is the #1, most popular site on the Internet right now. Who do you suppose Facebook chose as they URL scanning and filtering solution? That’s right… our partner WebSense. [Next Slide]
Point of Slide: This is a just a transition slide.
Next up, AntiSpam. [Next Slide]
Point of Slide: Commtouch’s Patented Recurrent Pattern Detection (RPD) technology, offers the top best-in-class antispam for UTM appliances.
For antispam, we also partner with an industry leader in Antispam and email security, Commtouch.
Unlike our competitors who try to do everything themselves, [CLICK] Commtouch is 100% focused on email security and antispam, which means they can do it much better.
[CLICK] They are a very experienced and mature email security company that has done Antispam for decades, which you can see in this chart. Commtouch has blocked spam since 1991, while our UTM competitors have only started in the 21st century. This experience translated to better results. And, of course, some competitors don’t even offer antispam at all.
CLICK] Why is Commtouch so good at blocking spam? They patented the Recurrent Pattern Detection (RPD) antispam engine, which is the only antispam solution that offers extremely quick and accurate detection, while maintaining a very small footprint on the appliances it runs on. In other words, it is a perfect antispam solution for UTM appliances, like ours
[CLICK] In fact, testing has shown Commtouch’s RPD is over 99% affective at blocking spam, while maintaining next to no false positives. What do I mean by, “next to no false positives?” Well how about only 1 false positive in every 1.5 million emails.
They can maintain this accuracy because they [CLICK] scan and review over four billion messages a day.
Yet again, you don’t have to just take our word for it…. [Next Slide]
Point of Slide: Commtouch is best-in-class because many big, well known organizations partner with them for email security
Here’s just a small sample of some of the organizations that uses Commtouch’s best-in-class email security and antispam solutions. You will recognize many of the names in this list. All these well-known companies use Commtouch in their solutions because they know how effective Commtouch’s antispam solution is. [Next Slide]
Point of Slide: This is a just a transition slide.
To round out our security services, let’s quickly talk about IPS & Application Control [Next Slide]
Point of Slide: Broadweb is an experienced, best-in-class IPS partner with unique Application Control technology
Both our IPS and Application Control security services come from Broadweb, a Best-in-Class security partner who has focused diligently on effectively detecting network attacks for years. [CLICK] More specifically, Broadweb has focused on providing one of the industries leading IPS solutions since 2001.
[CLICK] They specialize on deeply analyzing network traffic, both to prevent attacks and to identify different kinds of applications . Their DPI engine leverages both signatures and more advanced pattern-based detection techniques to quickly and accurately identify applications, down to their granular behavior details.
[CLICK] Broadweb has invented patent-pending technologies, such as their unique technique for accurately identifying fully encrypted applications including Skype and Ultrasurf, as well as their SigXel technology to accelerate signature-based traffic identification. They also add around 300 new applications a year, making our application control service one of the most complete options on the market.
[CLICK]
Finally, Broadweb has received many well-known industry awards. They were the first IPS vendor to receive ICSA’s IPS certification and were also among the first IPS vendors who translated their expertise in detecting network attacks, to also detecting well-known network applications.
[Next Slide]
Point of Slide: Our IPS has proven efficacy
Again, one of the best ways to illustrate best-in-class efficacy is to verify with third party tests. To ensure we constantly release the most effective signatures, WatchGuard regularly tests our IPS system with industry standard IPS testing gear, including the Mu-Dynamics suite of security testing appliances and software (which is a best-in-class testing suite).
As you can see from this sample report, [CLICK] our IPS passes those 3rd party tests with high grades, and our efficacy even gets better over time (due to auto-blocking and our proxy technology). Furthermore, our proxy policies also ensure that Mu-Dynamics’ IPS evasion tests do not get past our IPS system.
In short, we constantly test our IPS to ensure that you can rely on its Best-in-Class protection.
[Next Slide]
Point of Slide: Our application control has covers a wide-range of popular apps, and provides great granular controls.
Broadweb also provides our application control engine, which is just as effective as IPS. Our Application Control services can recognize over 1800 applications (using over 2300 signatures), which is more than many other competitors with applications control[CLICK]
Furthermore, Application Control also offers some very fine-tuned controls for many of the most popular applications. For instance, say you want one group of users to have access Facebook, be able to post messages and edit profiles, but not have access to Facebook apps or games. No problem. At the same time, you could also configure it so a different group of users can only view Facebook during a specific time of the day. These granular Facebook options leave the control in your hands… and we offer similar granularity for other applications, such as Instant Messaging too.
Between great application coverage, and granular controls, our Applications Control offers Best-in-Class features that few can match. [Next Slide]
Point of Slide: Many other well-known companies recognize Broadweb’s best-in-class solution.
Again, you don’t have to take our word for it. Many other well-known security companies trust in Broadweb’s best-in-class IPS and Application Control solutions. This is just a small list of some of the organizations that partnered with Broadweb, or OEM’ed their solution.
[Next Slide]
Point of Slide: This is a just a transition slide.
WatchGuard also offers unique cloud-based reputation security services. [Next Slide]
Point of Slide: WatchGuard offers Best-in-Class, 3rd generation reputation-based security services.
When WatchGuard acquired Borderware, we gained their industry-leading, 3rd generation IP reputation authority -- a cloud-based reputation security service that increases your network’s security, while also increasing it’s performance. By aggregating know security feeds and gathering dynamic, real-time intelligence from all WatchGuard’s appliances, our cloud-based authority generates a real-time database of the known malicious IPs and URLs on the internet.
[CLICK] Borderware, and now WatchGuard, was one of the first companies to launch a “3rd-generation” IP Reputation Authority. While most reputation authorities settle for aggregating static blacklists, our 3rd-generation authority combines aggregated lists, with volume, and appliance feedback, to get a much more dynamic and real-time view of malicious sites on the internet. The difference is like comparing an old-school passport check to a full X-ray and bodyscan.
[CLICK] WatchGuard then extended our 3rd-generation IP reputation authority to combat malicious URLs and web threats, pioneering a URL reputation authority for our UTM appliances. This URL reputation authority combines best-in-class URL blacklists, such as those from malwaredomains and phishtank, with AV feedback from our appliances. Since our AV comes from best-in-class partners, our reputation authority is feed with this best-in-class, real-time intelligence.
[CLICK] The “magic” of our reputation authority comes from the thousands and thousands of XTM and XCS appliances we have in the field. All these appliances share real-time feedback with our reputation cloud, ensuring that you are protected from the latest, ever-changing malware sites and IPs.
[Next Slide]
Point of Slide: WatchGuard’s 3rd Generation Reputation Authority is better than competitors.
Some of our competitors are realizing the benefit of cloud-based reputation services, and have launched their own. However, like all other services, some are better than others. As you can see from this chart, our 3rd-generation reputation services can catch more threats than our competitors service, largely due to our appliances feedback loop, and combinations of security intelligences sources. This chart is based on our own internal tests, as well as marketing data from the other vendors. Our appliances in the field consistently catch between 95-99 percent of spam and malicious email using our RED reputation authority alone. Meanwhile, Ironport only claims theirs catches 70 to 80%, and pure blacklists methods fall way behind, only catching around 50%.
[Next Slide]
Point of Slide: WatchGuard offers best-in-class security for all services, in one easy to use appliance.
WatchGuard itself has been a best-in-class firewall and VPN appliance vendor for over a decade, but we realize that one company can’t be the best at everything. That is why we strategically chose to partner with [CLICK] other best-in-class vendors, who focus individually on specific security services. This is how we can deliver an all-in-one device that has [CLICK] best-in-class security – across the board. [Next Slide]
Point of Slide: Thank you.
Thanks for listening, and remember, if you want Best-in-class security in one easy to manage security appliance, choose WatchGuard. [Next Slide]
