Originally, firewalls only filtered traffic based on ports & IP addresses. They evolved over time to become “stateful,” which means that they keep track of the state of network connections passing through the appliance. However, as cyber threats also evolved and diversified, organizations began to deploy multiple appliances to defend against different classes of attacks. They now needed:
A stateful packet inspection firewall to allow inbound and outbound traffic on the network
A web proxy to scan content and URLS with antivirus services and filter them
A separate Intrusion Prevention System (IPS) to detect and block malicious traffic
An appliance to filter spam such as junk emails and phishing attempts
VPN servers to connect remote offices or allow users to access company resources remotely
As more threats evolved, new types of appliances and services were created to meet the challenge. It was too difficult for the traditional stateful appliance approach to scale along with growing businesses.
An antivirus tool like a firewall just protects PCs and servers. Next-generation firewalls (NGFWs) are more effective than traditional firewalls, but they still lack critical features for detecting and responding to all the latest threats. Therefore, UTM systems are used to protect the entire network, as well as individual users. It does this by scanning all network traffic, filtering any potentially dangerous content, and then blocking intrusions.