How flexible is the Broadcom Web Protection Suite really? – Tec-Bite

About the job

I was told that Broadcom with the Symantec Web Protection Suite has the most flexible licensing model in the web security sector. As an old hand in the security field, I’m not easily fooled, so I took a look myself. And I must say: not bad at all. Broadcom’s solution is especially suitable for customers who still rely on an on-premises proxy solution. However, I would like to mention one drawback upfront: those who want hardware appliances should also consider other solutions, as delivery times are very long and tend to get longer.

Licensing model
One license (WEB-PROTECT-SUB) is usually sufficient to build a state-of-the-art web security environment. Licensing is based on the number of employees (minimum=200), and as long as everything is virtualised or run in the cloud, no investment costs arise. If appliances are necessary, additional costs for the hardware and its maintenance will be incurred. Obtaining the hardware is currently not so easy, as delivery delays of up to several months must be expected.

Not so bad – I would anyway opt for the virtual solution. I think it makes sense for all companies to become "cloud"-ready. In fact, almost no one can escape the cloud anymore. And even with the hybrid approach (i.e. part of the servers/applications run on-premises in the data centre and the rest in various public cloud environments), web security is needed, so it makes sense to also use the cloud "Web Security Suite" solution (WSS).

Corona has accelerated the decentralisation of clients, and it has now become quite common for employees to work from home. Microsoft has positioned itself very well with its M365 solution. However, this leads to users always wanting to connect directly to M365 and not only to M365 but also to other SaaS services – in other words, users always want the fastest direct route to the internet. This is also possible via the Cloud Web Proxy (WSS).

The first step is a simplification of licensing and enabling simultaneous use of on-premises and cloud resources. This is a very important point for many companies. The solution does not dictate the speed; rather, the company can decide how quickly it wants to advance with digital transformation.

Handling high-risk websites
In an earlier blog post, I introduced the individual solutions: www.tec-bite.ch/unter-die-lupe-genommen-die-neue-symantec-web-protection-suite/. However, I would like to emphasise again that the concept of Threat Risk Levels is incredibly useful for dealing with new and uncategorised websites.
Source: Broadcom, https://docs.broadcom.com/doc/need-for-threat-risk-levels-in-secure-web-gateways-en, accessed 30.03.2022

Even with 85 URL categories, of which 14 are generally considered risky, it is not possible to cover the entire internet. Broadcom always refers to the Global Intelligence Network (GIN) and claims that this is the largest civilian threat intelligence network, as it merges endpoint, proxy, email, and cloud information. No, real-time categorisation or, even better, real-time risk analysis is needed. Only in this way can it be decided whether the user is allowed to access this website and also download or upload data or enter information. This is where web isolation comes into play. Without running a large Citrix environment locally, potentially risky websites (Risk Level ≥ 5) can be accessed safely via the cloud web isolation environment.

If the user still wants to download a file, Symantec Whitelisting, Symantec Machine Learning, Symantec Anti-Virus Scanner, and now also ClamAV are used. If the file is still not clearly safe, automatic sandboxing in the cloud can also be performed. All this is included in the WPS license.

Another very important point is central management, as well as logging and reporting for all proxy instances. Whether these run on-premises or in the cloud, one policy applies everywhere and logs are collected centrally.

A real novelty: no limits on performance or licenses
Until now, on-premises solutions were always limited. Either the appliance’s performance was the problem, or the license, which defined the number of usable CPU cores. Broadcom is now taking a new approach and sets no limits. Neither the number of appliances, virtual appliances, nor the number of CPUs used are restricted. Everyone can decide for themselves whether to run a VM with 2 or 200 CPU cores. With the WPS license, they have the right to do so. Thus, additional test environments are no longer a problem. Simultaneous use of local proxies and the cloud WSS environment is also possible.

By the way, the WSS runs on Google Cloud, which is very performant and is constantly being expanded. I would like to introduce an interesting feature here: egress IP addresses from countries that do not have their own compute region can be used. For example, you can connect via Zurich and receive a Pakistani IP address and thus access resources in Pakistan.

More information here: knowledge.broadcom.com/external/article/167174/web-security-service-wss-ingress-and-egr.html

Why has Broadcom combined all their top solutions into one license?
Many existing customers face replacing their ageing web proxy infrastructure, and thus Broadcom enables a slow transition to the cloud. The WPS license is actually just the beginning for the Broadcom/Symantec SASE framework.
Source: Broadcom, https://docs.broadcom.com/docs/symantec-sase-framework-infographic, accessed 30.03.2022

The Secure Access Service Edge (SASE) architecture enables securing users via cloud security solutions. Whether the user is in the company or working from home, access is always secured via the cloud and always up to date. More about SASE can be found here in an earlier blog post: www.tec-bite.ch/wohin-die-it-security-reise-geht-teil3-sase/

Broadcom also wants to offer its customers a comprehensive SASE solution, and WPS is the first step towards this. With the simple, user-based pricing model, future solutions can be easily added. For example, the bundle license for Cloud DLP/CASB is already available. Later, there will probably also be a ZTNA bundle license.

Additional licenses for WPS
Today, there are only a few extension licenses for the WPS license, as most is already included. Here are the most important additional licenses from my point of view:

Additional license / SKU Description
CLD-CFSS-SUB Standard Cloud Firewall Service
CLD-CFSA-SUB Advanced Cloud Firewall Service
CLD-MAAS-SUB Advanced Cloud Malware Analysis
WI-SUB Full Cloud Web Isolation
CLD-RPT-SUB Hosted Reporting
SSP-S210-10 S210 Hardware Platform
SSP-S410-10 /-20/-30/-40 S410 Hardware Platform
MC-S400-20-100 Management Center Hardware Appliance
RP-S500-20 Reporter Hardware Appliance

My conclusion
Those who cannot or do not want to move fully to the cloud today have a very good alternative with Broadcom WPS offering maximum flexibility. For a very fair price, you get state-of-the-art security solutions in the web security sector. The Broadcom SASE framework is constantly being expanded, and future requirements can thus also be covered.

Further information
Broadcom/Symantec Web Protection Suite Blog: symantec-enterprise-blogs.security.com/blogs/product-insights/symantec-web-protection-suite-single-gateway-web-and-cloud-applications
Broadcom/Symantec Web Protection Suite: www.broadcom.com/products/cyber-security/network/web-protection
AVANTEC Web Protection Suite solution page: www.avantec.ch/loesungen/symantec/symantec-web-gateway/

The article How flexible is the Broadcom Web Protection Suite really? first appeared on Tec-Bite.