attacks Application flood attack (Slowloris, Port 443 data flood,…) Large volume SYN flood Web application attacks (e.g. XSS, Injections, CSRF) Low & Slow connection DoS attacks Network scan Web application vulnerability scan Conclusions • Attackers use multi-vulnerability attack campaigns making mitigation nearly impossible • DoS & DDoS tools are preferred weapon of mass disruption
businesses: – DoS protection – Network behavioral analysis (NBA) – Intrusion prevention (IPS) – Reputation Engine service – Web application firewall (WAF) • Built-in SEM engine • Emergency Response Team (ERT) – 24x7 Service for immediate response – Neutralize DoS/DDoS attacks and malware outbreaks • Lowest CapEx & OpEx – Multitude of security tools in a single solution – Unified management and reporting Slide 8 “Radware offers low product and maintenance cost, as compared with most competitors.” Greg Young & John Pescatore, Gartner, December 2010
Generate revenue through Internet access – Large number of users – Vulnerable to attacks aiming to deny service and reduce their revenue • Attackers motivation – Financially motivated – extortion, rivalry – Publicity and vandalism – Activists • The business need – Maintain service availability even when under attack – Maintain consistent user response time – Comply with PCI DSS requirements – Reduce OpEx and CapEx Slide 12
for online businesses: – DoS protection – Network behavioral analysis (NBA) – Intrusion prevention (IPS) – Reputation Engine service – Web application firewall (WAF) • Built-in SEM engine – Business wide situational awareness – Other solutions require 3rd party SEM integration • Emergency Response Team (ERT) – 24x7 Service for immediate response – Neutralize DoS/DDoS attacks and malware outbreaks • Lowest CapEx & OpEx – Multitude of security tools in a single solution – Unified management and reporting Slide 15
NSS Certification – IPS criteria – McAfee, Sourcefire and other IPS vendors have NSS certification – What to say: • Radware holds NSS certification for Attack Mitigation criteria, which offers wider coverage for online business threats • NSS certifies only a small part of the overall solution • ICSA / Network IPS certification – HP is the only vendor holding active ICSA certification – What to say: • ICSA is not considered as a real network security testing authority Slide 16
enterprises deploy data centers to deliver services and support operations • The data center is a critical resource • Data center hosts: – Critical infrastructure: DNS, DHCP, SIP – Carrier operations OSS/BSS, Provisioning, Billing, CRM – Web portals – Mail servers • The need – Protect critical applications and servers under attack – Accurate detection and prevention Slide 18
network & application attacks – Network & Application DDoS protection – Server intrusions – DNS service protection – VoIP service protection – Web Application protection • Accurate attack mitigation – Block attacks without blocking legitimate users – Maintain user experience when under attack • Risk Management – Unified threat management and reporting • Mitigation performance – While forwarding legitimate user traffic Slide 19
for online businesses: – DoS protection – Network behavioral analysis (NBA) – Intrusion prevention (IPS) – Reputation Engine service – Web application firewall (WAF) • Built-in SEM engine – Business wide situational awareness – Other solutions require 3rd party SEM integration • Emergency Response Team (ERT) – 24x7 Service for immediate response – Neutralize DoS/DDoS attacks and malware outbreaks • Lowest CapEx & OpEx – Multitude of security tools in a single solution – Unified management and reporting Slide 22
DDoS attacks – Can you effectively detect and protect against emerging DDoS attacks? – Can you detect all type of DDoS attacks, including low and slow attacks? – Can you detect and protect against SSL attacks? • Ensure customer SLA – Can you offer detailed customer centric reporting and alerts to reflect the full value of your service? – Can you detect and start blocking attacks in seconds? Minutes? – Do you avoid penalties? • Operational efficiency – Does your out-of-the-box protections really resolve the majority of cases? – Does the mitigation solution integrates easily with your infrastructure (Customer portal, SEM, OSS, SOC)? Slide 27
Details Radware DP 12412 Arbor TMS 3200 IntruGuard IG2000 Riorey RS10 TopLayer IPS5500-2400ES Attack coverage Network DDoS attack protection Application DDoS attack protection Directed DoS attack protection Monitoring and reporting Built-in SIEM with advanced SLA reports and alerts Time to protect In seconds In minutes In seconds In minutes In seconds Accurate attack mitigation User experience under attack High Medium Low Low Low Techniques Selective challenge actions, action escalation Collective actions (challenge & rate limit) Rate limit based Rate limit based Rate limit based
• Best DDoS attack coverage – High PPS & bandwidth DDoS attacks protection – Connection & application DDoS attacks protection – Directed attacks protection – The only NSS Recommended attack mitigator in the industry • Ensure customer SLA – Shortest time-to-protect solution in the market – in seconds! – Most comprehensive reporting engine with detailed per-customer reports and advanced alerts • Operational efficiency – Best out-of-the-box protection – SOC can focus on complex attack cases – Multitude of DDoS protection and SEM in a single integrated solution – significant CapEx and OpEx savings Slide 32
soysaucechin
mraible
katarinadahlin
chrislema
sabderemane
inesmontani
mkilby
orderedlist
kimpetersen
csswizardry
shlominoach
maltzj
