Integrated Firewall/VPN/IDS on a PCI Card Protects Desktops and Critical Servers

The SG635 is a cost-effective firewall/VPN/IDS solution packaged on a PCI card. By offloading all firewall, VPN, and IDS processing from the host computer, the SG635 ensures high performance and throughput with the convenience of remote management and simplified installation. Unlike "co-processing" products, the SG635 is an advanced, self-contained multi-tasking stateful firewall, VPN, and IDS appliance. It includes a RISC processor, encryption accelerator for IPsec VPN traffic and two Ethernet interfaces for host and LAN communications. The SG635 packs the power of a firewall, VPN and IDS solution while eliminating the cabling, space and power requirements of an external appliance.

Worms and viruses continually exploit popular desktop operating systems making it impossible to connect an unsecured, un-patched computer to the Internet for any amount of time without risking exposure and infection. Businesses can be infected by these worms before being able to download the necessary security patches from vendors such as Microsoft. The primary issue is that the time to locate download and install critical patches can exceed the infection-free survival time. According to The SANS Institute, survival times of vulnerable Windows XP systems are now as low as 15 to 20 minutes. An SG635 in every computer can alleviate this potentially catastrophic situation.

Fully Integrated IDS Assures Maximum Security

Although all SG firewall/VPN appliances defend against Denial of Service and other common attacks, the SG635 raises the bar by detecting "suspicious" activity before it escalates into a full-blown network intrusion.

Supports a Defense-in-Depth Security Strategy

While perimeter firewalls are effective in stopping incursions from an external network, they cannot prevent attacks that originate within the protected network. Since up to 90% of network attacks are made by disgruntled employees, an effective security policy must include a multi-layered "defense"-in-depth strategy. The SG635 makes this possible by complementing perimeter defenses with "embedded" firewalls that secure critical servers and host systems.

Multiple SG635 adapters can be deployed throughout a network to create a robust distributed firewall that continues to operate when host systems fail or become unresponsive. Like all SG firewalls, these can be configured and managed with the SG Central Management System (CMS).

Administrators can define and implement access rules that restrict desktop users to specific servers or network resources based on their user profiles or group affiliations. For example, a human resources manager may be allowed to access employee records on the HR server, but prevented from changing payroll information stored in the accounting system.

In addition, regulatory initiatives, such as the Gramm-Leach-Bliley Act in the United States, impose significant penalties on businesses that fail to address privacy concerns by permitting unauthorized access to personal information. A defense in depth strategy can mitigate this exposure by demonstrating that the organization has conformed to all regulatory requirements.

Protect Servers on a DMZ and Hosts within the Data Center

In order to permit transparent public access, Web, e-mail and FTP servers are usually placed on an Internet-facing network or DMZ that imposes relatively few access restrictions. The SG635 makes it possible to secure each of these servers while preserving transparent access from the Internet. The SG635 can also protect critical servers in the corporate data center or application service provider environment.