I am the biggest defense-in-depth supporter there is, but deep defenses don't obviate the need to protect the perimeter. This year, we're going to see a lot of action from security vendors trying to provide better and stronger defenses at the border from the growing plagues of viruses, spyware, malware and phishing attacks.

The firewall gang has jumped on the idea of stronger perimeter defenses with their own fairly meaningless buzzword, unified threat management (UTM). The core is that firewall protection can go beyond allowing or blocking particular services. Instead, firewalls can scan traffic for viruses, handle content filtering, do basic intrusion prevention and watch for signs of spyware.

Every firewall vendor has a different idea of what goes in UTM, but there is a common thread: application-layer inspection. If you move up the communications stack from the most basic features of a firewall, you'll see that application-layer inspection is the last word in perimeter protection. The concept is to not merely look for signatures or protocol anomalies but actually understand what is happening at the application layer and use that knowledge as part of a protection policy.

Firewalls aren't the only place where perimeter defenses are being bulked up. Intrusion-prevention systems, typically placed at the perimeter, often reach up into the application layer. Web proxy servers also will see a lot of action in 2006, especially following Blue Coat Systems' success. Expect to see a big push from firewall vendors for their UTM features and from other security vendors for application-aware perimeter defenses. When evaluating these high-pressure marketing pitches, keep three guidelines in mind:

UTM is a buzzword. You can't compare UTM products side by side, because no two do the same thing. Even when the labels look the same, you'll find differences. Gateway anti-virus is a common feature of perimeter devices, but products vary wildly in the protocols they examine and how deeply they look into each one. For example, you may find that an anti-virus product scans HTTP traffic on Port 80 but not on Port 8080, or that it cannot find viruses that enter via Webmail services, such as Yahoo, MSN and Hotmail, because of the way the browser views messages.