아리아카 스마트시큐어 NGFW-SWG, 안티멀웨어 및 IPS 데이터시트

Enterprises have moved away from traditional hub-and-spoke architectures where network security was focused on safeguarding the network perimeter—the boundary between the trusted internal network and the untrusted external network.
In today’s landscape, enterprise users and workloads are highly distributed due to a surge in cloud adoption, SaaS usage, and a hybrid workforce model.
Enterprises must also cope with an increasing number of sophisticated cyberattacks.
Threat actors are constantly finding innovative ways to exploit enterprise IT infrastructure and compromise its data and digital assets.
In this dynamic and distributed environment, it is important to ensure that both remote and branch users experience peak application performance and have secure access to applications, data, and the internet.
To address these networking and security needs, enterprises must rely on multiple-point solutions that increase operational complexity, present management challenges, and raise costs.
Enterprises are looking to transition from conventional product-centric solutions to a cohesive as-a-service model.

싱글 패스 아키텍처를 갖춘 아리아카 통합 SASE

Aryaka Unified SASE combines networking and security into an as-a-service (‘all-in-one’) solution that helps enterprises modernize their infrastructure.
This solution allows an enterprise to configure, manage, and observe its network, security, applications, and users, all through a single management console without having to rely on disaggregated single-point solutions for each function independently.
A defining feature of the Aryaka Unified SASE solution is its single-pass architecture that allows enterprises to perform comprehensive inspections and processing, while examining a given data packet only once.
This approach reduces the attack surface and minimizes latency that would otherwise result from processing individual functions separately.
Aryaka has built an integrated architecture that offers a hybrid deployment solution to meet the needs of the enterprise for both on-premises and remote users.
Security enforcement for workloads and users takes place directly at the edge appliance: either at the Aryaka Network Access Point (ANAP) for site users or at the Aryaka PoP for remote users.
Additionally, enterprises can benefit from our integrated lifecycle management support and managed services that offer a personalized experience for deployments and issue resolution 24/7.
Aryaka plans to incorporate additional capabilities and features in the future, all seamlessly integrated into our single-pass architecture.

사용 사례

The Aryaka SmartSecure NGFW-SWG (Next Generation Firewall- Secure Web Gateway) strategy is to allow enterprises to replace traditional multi-vendor networking and security services with a unified platform from a single vendor.
The primary focus is described in the following two distinct use cases:

1. 타사 온프레미스 방화벽을 아리아카 차세대 방화벽으로 교체합니다.

The first use case is replacing an enterprise’s existing on-premises firewall from a third-party security vendor with our natively built Aryaka solution.
To accomplish this, Aryaka has built a dedicated security stack on top of our Software Defined Wide Area Network (SD-WAN) architecture that applies a common framework to a series of security policy engines.
Many vendors must tunnel traffic to PoPs for security inspections.
Aryaka can inspect traffic on the ANAP itself for on-premises users.
Policy engines perform Next Generation Firewall and Secure Web Gateway (NGFW-SWG) security inspections, ensuring traffic is only sent to its intended destination when required.
Both inbound and outbound traffic undergoes thorough examination for both pre-SSL and post-SSL data flows for the connections initiated from the LAN interface.
In this use case, internet breakout occurs at the ANAP.

2. 클라우드 네이티브 보안 웹 게이트웨이 공급업체 교체

The second use case is replacing an enterprise’s cloud-based Secure Internet Access (SIA) or Secure Web Gateway (SWG) vendors with Aryaka’s natively built security stack on both PoPs and ANAPs.
The Aryaka NGFW-SWG protects web-based and SaaS application users from internet-borne threats.
Using our PoP-centric cloud service delivery, Aryaka offers comprehensive security directly from the PoP to remote users who access enterprise resources and cloud applications using the Aryaka VPNaaS client.
This ensures secure connectivity for direct connections from headquarters and branch offices that do not have an ANAP within a cloud-as-a-service model.
In these scenarios, internet breakout occurs at the PoP.
The ANAP and the PoP both host identical security stacks to secure enterprise users and workloads from modern internet-borne threats.
This ensures a consistent user experience whether the user is on-premises or remote.
User licenses are used to provide NGFW-SWG security services to private access users.
The following graphic depicts distributed policy enforcement on Aryaka PoPs and ANAPs.
Security scanning occurs at the service edges to protect both on-premises and remote users.

주요 특징

• 클라우드 네이티브 통합 플랫폼
• 싱글 패스 아키텍처
• 안전한 브랜치 및 원격 액세스
• 안전한 인터넷 액세스
• 안전한 클라우드 액세스
• 분산 정책 적용
• 운영 간소화
• 통합 관리 및 통합 가시성
• 연중무휴 24시간 라이프사이클 관리 지원 서비스

주요 차별화 요소

싱글 패스 아키텍처

The Aryaka single-pass architecture processes network and security policies in a single pass, without the need for a packet to go through multiple security processing stages that can introduce latency and increase processing requirements.
We process a packet once and only perform one TLS inspection across the entire packet flow.
Our management interface—MyAryaka— provides dashboards, analytics, observability, management, and monitoring for all networking and security services.
Telemetry is collected in near-real time from all security engines and provides insights into security incidents, threat management, and performance.
Using our intuitive interface, enterprises have the flexibility to self-manage security policies and create access controls without having to switch between multiple management consoles.
Our unified control plane combines networking and security capabilities to provide consistent policy enforcement on the ANAP, the PoP, or both.
This protects the enterprise’s users wherever they are.
The distributed data plane allows for policy enforcement at the nearest PoP and at the ANAP edge, allowing security enforcement to happen closer to the source.
For enterprises with site users behind an ANAP, network, security and application processing are performed at the ANAP itself.
For private access users and enterprise sites without an ANAP, traffic is processed at one of our 40+ globally distributed hyperscale PoPs that reach 95% of the world’s business population across six continents (including China).

다중 테이블 정책 관리

The conventional approach to policy management places all security policies into one complex table.
This approach leads to confusing and error-prone configurations, a degraded user experience, cumbersome policy management, and complicated troubleshooting that increases the risk of security breaches.
Our modular, multi-table approach to policy management includes multiple security engines, each with distinct security functions such as threat protection, reputation services, and application- and user-based access controls.
Each security function has its own set of policy configurations, match criteria, and policy actions.
With our approach, enterprises can benefit from ease of maintenance, operational simplicity, and the flexibility to create granular policies for pre-TLS, pre-SSL, and post-SSL traffic.

아리아카 스마트보안 서비스

1. 아리아카 스마트시큐어 NGFW-SWG

The NGFW-SWG is an integral component of the Aryaka SASE solution.
It is a natively built, easy to use, managed solution that combines NextGen Firewall and Secure Web Gateway security services into a single unified service.
The primary objective of the Aryaka SmartSecure NGFW-SWG is to protect users from internet-born threats and evolving cyber threats.
It achieves this by intercepting user traffic and applying various security controls to network traffic.
The Aryaka SmartSecure NGFW-SWG performs deep packet inspection (DPI) that thoroughly examines the actual content of the data payload for inbound and outbound traffic associated with connections originating from LAN interface.

2. 아리아카 스마트시큐어 안티 멀웨어 애드온

The optional Aryaka SmartSecure Anti-Malware service provides an additional layer of defense that enhances enterprise security by detecting known malware, viruses, and file-based threats for inbound and outbound traffic.
The Anti-Malware security engine performs DPI to evaluate network traffic against a database of known malware signatures and patterns.
If a match is found, the event is logged for further forensic analysis.

3. 아리아카 스마트시큐어 침입 방지 시스템(IPS) 애드온

옵션으로 제공되는 아리아카 스마트시큐어 IPS 서비스에는 WAN 인터페이스의 인바운드 트래픽과 LAN 인터페이스의 아웃바운드 트래픽을 검사하는 보안 엔진이 포함되어 있습니다.
이 암호화 및 비암호화 트래픽은 사용자 트래픽을 가로채고 데이터 패킷에 다양한 IPS 정책을 적용하는 시그니처 기반 탐지 메커니즘을 사용하여 악의적인 침입 활동을 지속적으로 모니터링합니다.
지점과 원격 사용자 모두 트로이 목마, 웜, 셸코드 익스플로잇, 애드웨어 등을 포함한 53개 범주에 걸쳐 잠재적인 침입을 보호하고 모니터링합니다.

기능 목록

지점 및 개인 액세스 사용자는 사이트 및 사용자 라이선스를 통해 모든 Aryaka SmartSecure 기능을 사용할 수 있습니다.
아리아카 스마트시큐어 안티멀웨어 및 아리아카 스마트시큐어 IPS는 두 가지 지역에서 애드온 서비스로 제공됩니다: 중국 본토와 기타 지역(ROW)입니다.
기업은 필요에 따라 둘 중 하나 또는 두 가지 옵션을 모두 선택할 수 있습니다.
Aryaka는 보안 서비스가 발전함에 따라 추가 기능을 제공할 계획입니다.

*아리아카 보안 서비스는 더 많은 서비스를 포함하여 계속 발전할 예정입니다.

라이선스

NGFW-SWG, 안티멀웨어 및 IPS 서비스에는 사이트 라이선스와 사용자 라이선스의 두 가지 유형의 라이선스가 있어 다양한 배포 요구 사항을 충족할 수 있습니다.
사이트 라이선스는 특정 위치에서 NGFW-SWG, 안티멀웨어 및 IPS 서비스를 활성화하는 데 사용됩니다.
사용자 라이선스는 원격 사용자에 대한 NGFW-SWG, 안티멀웨어 및 IPS 서비스를 활성화하는 데 사용됩니다.

*NGFW-SWG 사이트 라이선스는 사이트 라이선스와 동일한 티어(XS, S, M, M+, L, XL 및 BYO)로 제공됩니다.

주요 비즈니스 성과 및 혜택

---

아리아카 소개

아리아카는 성능, 민첩성, 단순성, 보안을 타협 없이 제공하도록 설계 및 구축된 유일한 SASE 솔루션인 서비스형 통합 SASE를 최초로 제공한 선도 기업입니다.
아리아카는 고객의 고유한 SASE 여정에 맞춰 고객이 네트워킹 및 보안 환경을 원활하게 현대화, 최적화, 혁신할 수 있도록 지원합니다.
아리아카의 유연한 제공 옵션을 통해 기업은 구현 및 관리를 위해 선호하는 접근 방식을 선택할 수 있습니다.
포춘 100대 기업을 포함한 수백 개의 글로벌 기업이 클라우드 기반 소프트웨어 정의 네트워킹 및 보안 서비스를 위해 Aryaka를 이용하고 있습니다. 아리아카에 대한 자세한 내용은 www.aryaka.com 에서 확인하세요.

데이터시트 다운로드