Security is not simple, because there are many points of weakness, hundreds of forms of attack and a bewildering range of solutions. The problem is particularly acute for small to medium-sized businesses with limited budgets and often no expertise at tackling the problem. Not surprisingly, some manufacturers think they have the solution - the all-in-one security appliance, sometimes dubbed the "God Box" thanks to its all-seeing capability.
Visitors to the InfoSec conference at London's Olympia, which ends today, will have noticed there are more security appliances than ever on show - around a quarter of the 250 exhibitors showed appliances, including vendors such as Cisco, Symantec, Trend Micro, Nokia and dedicated appliance vendor NetScreen (part of Juniper Networks).
A few years ago, security appliances just combined firewall and anti-virus functions but, today, vendors are increasingly adding more functions: virtual private networking (VPN) to provide secure remote working; intrusion detection; web content filtering to control web usage; spam filtering; instant message filters that monitor chat services; and monitors to detect downloading of music and games via peer-to-peer file sharing services. For example, the 5400 series from Symantec combines seven functions in one box, while 3Com's Security Switch 6200 combines a firewall, VPN, intrusion detection, anti-virus scanning and content filtering capabilities.
Some appliance vendors are particularly keen to target spam. Mirapoint's Razorgate offers anti-spam, anti-virus and email content filtering for up to 1,500 users. The anti-spam and anti-virus functions are subscription-based with automatic updating.
The increase in appliances reflects a number of trends: targeting enterprise class security at smaller firms; ease of use; and the desire by security software vendors to sell a device that is attractive and cheap enough for firms with little or no security expertise. Proponents claim a multifunction device is ideal for coping with the increase in "blended threats", which attack IT systems using more than one technique.
But some warn it is dangerous for firms to be lulled into thinking one box will solve the problem. "The appliance is as much a marketing phenomenon as a technical solution," says James Governor, principal analyst with the Red Monk consultancy, "It sounds like a silver bullet but, in reality, it still needs configuration."
It is early days. According to IDC researchers, 85% of the appliances sold only include firewall and VPN facilities. But it predicts significant growth in multifunction devices, particularly those that include intrusion detection - normally the preserve of larger firms. But IDC predicts that by 2007, 80% of all security solutions will be appliance-based.
Cisco, which has the lion's share of the market thanks to its Pix firewall appliance, is downbeat on all-in-one appliances. "Most of our customers are more interested in using a router with intrusion detection," says Paul King, a Cisco senior security consultant. "We wouldn't try to solve the problem by putting so many functions in one box as we prefer to look at developing security as a network is installed. There is a danger of think ing that security can be solved by a single box."
But Cisco is under attack from dedicated security vendors such as NetScreen, which hardwires its software on to a dedicated chip in the box. "Using application specific integrated circuits (Asics) gives a better price/performance ratio," says NetScreen's Peter Crowcombe.
Observers believe the SME market is wide open for vendors because most companies are eager for a simpler solution. "One big box is better than a lot of boxes, and the vendors will support all the functions on one box, which means you have one point of contact when there are problems," says Ovum's principal analyst Graham Titterington. "The move from pure software to hardware is significant, and it's partly because security vendors are trying to distance themselves from Microsoft, which is developing security solutions it may bundle into future versions of Windows."
Ironically, the success of the appliance may rest on the fact that it allows the security industry to set up relationships with new customers. Many appliances require automatic updates paid for monthly. "Appliances are great for resellers," said one distributor. "They allow them to go back to the customer every three months to sell them new functions."
Appliances are also being promoted to internet service providers so they can offer managed services - a form of outsourcing of the problem. Typically, the service provider buys a top-of-the-range appliance, which can bring economies of scale based on a fixed-cost management fee for a range of security functions.
Keen to counter criticism that appliances are less upgradeable than dedicated software solutions, vendors are manufacturing boxes that have growth built in. For example, the Firebox X from Watchguard provides customers with software keys to unlock new functions when they want to scale up the box.
Appliances pose an interesting question for the IT security industry. Who can be the best at delivering security at the lowest price? Will networking vendors such as Cisco become the hub around which software vendors provide suitable products? Or will the software industry move to a mix of software and appliance-based products?
"We are seeing significant changes in the way security products are delivered," concludes Bob Tarzey, service director at analysts Quorcirca.
