topic Re: Can Sandblast replace IPS in Firewall and Security Management

Can Sandblast replace IPS

santosh_sahoo — Mon, 30 Oct 2017 06:46:18 GMT

If we have deployed Sand blaster at the gateway then why there is a need to enable IPS blade ? I want to know whether we need both or not ?

Re: Can Sandblast replace IPS

PhoneBoy — Mon, 30 Oct 2017 15:50:33 GMT

Sandblast and IPS look for different types of threats and it is recommended you deploy both.

IPS is looking at network traffic in general, preventing threats that can occur due to malicious use of known flaws.

For example, there are attacks specifically against the SMB protocol that made the news recently.

With updated signatures and Security Gateways in the proper locations, those sorts of attacks can be prevented.

This is, of course, just one of thousands of examples.

SandBlast is looking at Office and PDF files to see if they are malicious through emulation.

This is not something IPS is designed to handle.

Likewise, Sandblast isn't looking at things like the SMB protocol.

Re: Can Sandblast replace IPS

Victor_MR — Mon, 27 Nov 2017 18:40:02 GMT

Very clear answer

IPS is looking for a wide variety of known network attacks of different kinds. Sandblast is looking for unknown (and of course also known) malware files. I would also add that Sandblast looks for many types of files in addition to Office and PDF. For instance, for Sandblast Threat Emulation exe, swf, jar, archives...

Cheers!

Re: Can Sandblast replace IPS

Ravi_Madhu — Thu, 07 Feb 2019 21:48:56 GMT

Is this still true with R80.10 or R80.20 using sandblast ? I thought this may have changed with everything integrated within Threat cloud, am i wrong in thinking that way ?

Re: Can Sandblast replace IPS

PhoneBoy — Fri, 08 Feb 2019 06:50:41 GMT

The logic I described above hasn't changed in R80.x.

In general, the different Software Blades are meant to work together to provide comprehensive threat prevention.

This is why we sell the majority of them together in a single set versus make them available "a-la carte."

That said, we also offer the flexibility to not enable specific features.