Were I in the UTM business, I'd be engaging the reality distortion field and speed-dialing my patent attorneys at this point.
Fortinet has recently had some very interesting patent applications granted by the PTO.
Integrated network and application security, together with virtualization technologies, offer a powerful and synergistic approach for defending against an increasingly dangerous cyber-criminal environment. In combination with its extensive patent-pending applications and patents already granted, Fortinet's newest patents address critical technologies that enable comprehensive network protection:
- U.S. Patent #7,333,430 - Systems and Methods for Passing Network Traffic Data - directed to efficiently processing network traffic data to facilitate policy enforcement, including content scanning, source/destination verification, virus scanning, content detection and intrusion detection;
- U.S. Patent #7,340,535 - System and Method for Controlling Routing in a Virtual Router System - directed to controlling the routing of network data, and providing efficient configuration of routing functionality and optimized use of available resources by applying functions to data packets in a virtual environment;
- U.S. Patent #7,376,125 - Service Processing Switch - directed to providing IP services and IP packet processing in a virtual router-based system using IP flow caches, virtual routing engines, virtual services engines and advanced security engines;
- U.S. Patent # 7,389,358 - Distributed Virtual System to Support Managed, Network-based Services - directed to a virtual routing system, which includes processing elements to manage and optimize IP traffic, useful for service provider switching functions at Internet point-of-presence (POP) locations.
These patents could have some potentially profound impact on vendors who offer "integrated security" by allowing for virtualized application of network security policy. These patents could easily be enforced outside of the typically-defined UTM offerings, also.
I'm quite certain Cisco and Juniper are taking note as should be anyone in the business of offering virtualized routing/switching combined with security -- that's certainly a broad swath, eh?
On a wider note, I've actually been quite impressed with the IP portfolio that Fortinet has been assembling over the last couple of years. If you've been paying attention, you will notice (for example) that that they have scooped up much of the remaining CoSine IP as well as recently acquired IPlocks' database security portfolio.
If I were they, the next thing I'd look for (and would have a while ago) is to scoop up a Web Application Firewall/Proxy vendor...
I trust you can figure out why...why not hazard a guess in the comments?
/Hoff
Updated: It occured to me that this may be much more far-reaching than just UTM vendors, that basically this could affect folks like Crossbeam, Check Point, StillSecure, Cisco, Juniper, Secure Computing, f5...basically anyone who sells a product that mixes the application of security policy with virtualized routing/switching capabilities...
How about those ASA's or FWSMs? How about those load balancers with VIPs?
Come to mention it, what of VMware? How about the fact that in combining virtual networking with VMsafe, you've basically got what amounts to coverage by the first two patents:
U.S. Patent #7,333,430 - Systems and Methods for Passing Network Traffic Data - directed to efficiently processing network traffic data to facilitate policy enforcement, including content scanning, source/destination verification, virus scanning, content detection and intrusion detection;
U.S. Patent #7,340,535 - System and Method for Controlling Routing in a Virtual Router System - directed to controlling the routing of network data, and providing efficient configuration of routing functionality and optimized use of available resources by applying functions to data packets in a virtual environment;
Whoopsie.
Now, I'm not a lawyer, I just play one on teh Interwebs.
I'm far from being impartial on many topics -- I don't believe that anyone is truly impartial about anything -- but at the same time, I have an open mind and will gladly listen to points raised in response to anything I say. I may not agree with it, but I'll also tell you why.
What I have zero patience for, however, is when I get twisted semantic marketing spin responses. It makes me grumpy. That's probably why Rothman, Shimmy and I get along so well.
Some of you might remember grudge match #1 between me and Alex Niehaus, the former VP of Marketing for Astaro (coincidence?) This might become grudge match #2. People will undoubtedly roll their eyes and dismiss this as vendors sniping at one another. So be it. Please see paragraphs #1 and 2 above.
My recent interchange with Richard Stiennon is an extension of arguments we've been having for a year or so from when Richard was still an independent analyst. He is now employed as the Chief Marketing Officer at Fortinet.
Our disagreements have intensified for what can only be described as obvious reasons, but I'm starting to get as purturbed as I did with Alex Neihaus when the marketing sewerage obfuscates the real issues with hand-waving and hyperbole.
I called Richard out recently for what I believed to be complete doubletalk on his stance on UTM and he responded here in a comment. Comments get buried so I want to bring this back up to the top of the stack for all to see. Don't mistake this as a personal attack against Richard, but a dissection of what Richard says. I think it's just gobbledygook.
To be honest, I think it took a lot of guts to respond, but his answer makes my head spin as much as Anna Nicole Smith in a cheesecake factory. Yes, I know she's dead, but she loved cheesecake and I'm pressed for an analogy.
The beauty of blogging is that the instant you say something, it becomes a record of "fact." That can be good or bad depending upon what you say.
I will begin to respond to Richard's retort wherein he first summarily states:
I also assume that this means Richard hates the bit buckets that Firewall, IPS, NAC, VA/VM, and Patch Management (as examples) have become, too? This trend is the natural by-product of marketers and strategists scrambling to find a place to hang their hat in a very crowded space. So what.
UTM is about solving applied sets of business problems. You can call it what you like, but the only reason marketeers either love or hate UTM usually depends upon where they sit in the rankings. This intrigues me, Richard, because (as you mention further on) Fortinet pays to be a part of IDC's UTM Tracker, and they rank Fortinet as #1 in at least one of the product price ranges, so someone at Fortinet seems to think UTM is a decent market to hang a shingle on.
Hate it or not, Fortinet is a UTM vendor, just like Crossbeam. Both companies hang their shingles on this market because it's established and tracked.
You're right. Lumping Crossbeam with Fortinet and Astaro is the wrong thing to do. ;)
Arguing the viability of a market which has tremendous coverage and validated presence seems a little odd. Crafting a true strategy of differentiation as to how you're different in that market is a good thing, however.
So what you're saying is that you like the nebulous and ill-defined blob that is Gartner's view, don't like IDC, but you'll gladly pay for their services to declare you #1 in a market you don't respect?
You mean besides when you said:
Just in case you're interested, you can find that quote here. There are many, many other examples of you saying this, by the way. Podcasts, blog entries, etc.
Also, are you suggesting that Fortinet does not consider itself a UTM player? Someone better tell the Marketing department. Look at one of your news pages on your website. Say, this one, for example -- 10 articles have UTM in the title and your own Mr. Akomoto (VP of Fortinet, Japan) says "The UTM market was pioneered by us," says Mr. Okamoto, the vice-president of Fortinet Japan. Mr. Okamoto explains how Fortinet created the UTM category, the initial popularity of UTM solutions with SMBs..."
Yes, I understand how much you dislike IDC. Can you kindly show reference to where you previously commented on how Fortinet was executing on your vision for Secure Network Fabric? I can show you where you did for Crossbeam -- it was at our Sales Meeting two years ago where you presented. I can even upload the slide presentation if you like.
Richard, I'm not really looking for the renewal of your Crossbeam Fan Club membership...really.
Oh, now it's on! I'm fixin' to get "Old Testament" on you!
Just so we're clear, ISV applications that run on Crossbeam such as XML gateways, web-application firewalls, database firewalls and next generation network converged security services such as session border controllers are all UTM "legacy applications!?"
So besides an ASIC for AV, what "new" non-legacy apps does Fortinet bring to the table? I mean now. From the Fortinet homepage, please demonstrate which novel new applications that Firewall, IPS, VPN, Web filtering and Antispam represent?
It must suck to have to craft a story around boat-anchor ASICs that can't extend past AV offload. That means you have to rely on software and innovation in that space. Cobbling together a bunch of "legacy" applications with a nice GUI doesn't necessarily represent innovation and "next generation."
It's clear you have a very
deludedinteresting perspective on security applications. The "innovation" that you're suggesting differentiates what has classically been described as the natrual evolution of converging marketspaces. That over-played Snort analogy is crap. The old "signature" vs. "anomaly detection" argument paired with "deep packet inspection" is tired. Fortinet doesn't really do anything that anyone else can't/doesn't already do. Except for violating GPL, that is.I suppose now that Check Point has acquired NFR, their technology is crap, too? Marcus would be proud.
Oh come on, Richard. First of all, the answer to your question is that many, many large enterprises and service providers utilize a layered defense and place an IPS before or after their firewall. Some have requirements for firewall/IDS/IPS pairs from different vendors. Others require defense in depth and do not trust that the competence in a solutions provider that claims to "do it all."
Best of breed is what the customer defines as best of breed. Just to be clear, would you consider Fortinet to be best of breed?If you use a Crossbeam, by the way, it's not a separate device and you're not limited to just using the firewall or IPS in "front of" or "behind" one another. You can virtualize placement wherever you desire. Also, in many large enterprises, using IPS's and firewalls from separate vendors is not only good practice but also required.
How does Fortinet accomplish that?
Your "payload inspection" is leveraging a bunch of OSS-based functionality paired with an ASIC that is used for AV -- you know, signatures -- with heuristics and a nice GUI. Whilst the Cosine IP Fortinet acquired represents some very interesting technology for provisioning and such, it ain't in your boxes.
You're really trying to pick a fight with me about Check Point when you choose to also ignore the fact that we run up to 15 other applications such as SourceFire and ISS on the same platform? We all know you dislike Check Point. Get over it.
Really? So since you don't have separate products to address these (Fortinet sells UTM, afterall) that means you had nothing to offer them? Convergence is driving UTM adoption. You can call it what you want, but you're whitewashing to prove a flawed theorem.
...and what the heck is the difference between that and UTM, exactly? People don't buy IPS, they buy network level protection to defend against attack. IPS is just the product catagory, as is UTM.
I don't like Scotch, Richard. It leaves a bad taste in my mouth...sort of like your response ;)