Pravail 2.0 Technical Overview. Exclusive Networks

Transcription

1 Pravail 2.0 Technical Overview Exclusive Networks

2 Pravail Features and Benefits Arbor Pravail APS is the a CPE-based security appliance focused on stopping availability threats Arbor Pravail APS Arbor Pravail APS Firewall Firewall Load Balancer Load Balancer Public Web Servers Corporate Servers DNS Servers SMTP Servers Data Center Network Out-of-the-Box Protection Immediate protection from threats with more control Advanced DDoS Blocking Introduces new packet-based DDoS detection & mitigation Botnet Threat Mitigation Block dynamic botnet-based DDoS attacks with AIF Simple Deployment Models Easily fits IDC deployment including inline Cloud Signaling Stop volumetric DDoS attacks by signaling upstream MSSPs Page 2 - Company Confidential

3 ATLAS Intelligence Feed (AIF) Continuously updated feed of botnet threats to service availability Layer 7 fingerprints focused on inbound botnet attack traffic Includes ASERT threat level and confidence assessment Inbound HTTP Botnet Attacks ASERT Severity Levels IP Location Data ASERT tracking hundreds individual botnets in the wild More added nearly every day Page 3 - Company Confidential

4 Cloud Signaling Utilize Cloud Signaling Coalition members for volumetric protection Gain Volumetric & Application protection from a single console! Subscriber Network Arbor Peakflow SP / TMS-based DDoS Service Data Center Network Arbor Pravail APS Firewall / IPS / WAF Public Facing Servers Subscriber Network Internet Service Provider 1. Service Operating Normally 2. Attack Begins and Initially Blocked by Pravail 3. Attack Grows Exceeding Bandwidth 4. Cloud Signal Launched 5. Customer Fully Protected! Cloud Signaling Status Page 4 - Company Confidential

5 Pravail 2.0 Availability Protection System Pravail APS FW, IPS, Server Availability Protection System Inline layer-2 deployment (bump in the wire) In front of Firewall, IPS, WAF, load-balancer, etc Including DPI (layer 7) inspection of traffic AIF signatures for detecting complex elements Detect and protect against attacks at customer edge Page 5 - Company Confidential

6 The Failure of Existing Security Devices Today s CPE-based security devices focus on integrity & confidentiality but not on availability Information Security Triangle Firewalls Product Family Triangle Benefit Intrusion Prevention System Integrity / Confidentiality Integrity Enforce network policy to prevent unauthorized access to data Block break-in attempts causing data theft Firewalls and IPS device do not solve the DDoS problem because they (1) are optimized for other security problems, (2) can t detect or stop distributed attacks, and (3) can not integrate with incloud security solutions. IPS and firewall vendors will not win the arms race against hackers. Stateful device will always be threatened by state-exhausting attacks. Page 6 - Company Confidential DATA CENTER IPS Load Balancer Firewalls and IPS devices are part of the DDoS problem!

7 What happens to the traffic? Each client is checked by multiple intelligent filters Generic Flood Attacks Protocol Attacks TCP Stack Attacks Generic Application Attacks Intelligent BOTNET Attacks Static & Dynamic Packet Filters Malformed & Behavior Filters Client Verification Filters Application Level Attack Filters BOTNET Attack Filters (AIF-Signatures) Page 7 - Company Confidential

8 Intelligent Filters some Examples Page 8 - Company Confidential

9 Welcome to Pravail! Page 9 - Company Confidential

10 Summary - Page Overview: Protection Group(Group of Servers /Services) Interface Traffic Total Traffic Passed Traffic Blocked Traffic Protection Group Cloud Signaling Status System Status Change Log Page 10 - Company Confidential

11 Protection Group WebServer example - I A Protection Group is a individual set of IPs of the same Server/Service Type. E.g. WebServer Details: Total Traffic Passed Traffic Blocked Traffic Blocked Hosts Details per Attack Prevention Type Options: Time Period BPS/PPS PDF / Page 11 - Company Confidential

12 Protection Group II URL statistics Domain statistics Option to easily BLOCK Domains / URLs Page 12 - Company Confidential

13 Protection Group III IP Location statistics Option to easily BLOCK attacking countries Page 13 - Company Confidential

14 Protection Group IV Protocol statistics Service statistics Page 14 - Company Confidential

15 Protection Group V Blocked Hosts statistics Option to unblock hosts Page 15 - Company Confidential

16 Summary Mode, Protection Level, Cloud Help Mode: Active Inactive Protection Level: Low Medium High Cloud Signaling Status Automatic Manually Page 16 - Company Confidential

17 Prevention Types Details I/VI Page 17 - Company Confidential

18 Prevention Types Details II/VI Page 18 - Company Confidential

19 Prevention Types Details III/VI Page 19 - Company Confidential

20 Prevention Types Details IV/VI Page 20 - Company Confidential

21 Prevention Types Details V/VI Page 21 - Company Confidential

22 Prevention Types Details VI/VI Page 22 - Company Confidential

23 Pravail 2.0 APS - Cloud Signaling Pravail APS FW, IPS, Server Pravail stand-alone inline protection Detects and defends attacks at customer edge Can ask for help to protect from volumetric attacks larger than uplinks mitigation must be performed upstream Page 23 - Company Confidential

24 ISP - Cloud Signaling as a Managed Service ISP uses Peakflow SP and TMS products in the cloud Peakflow SP and TMS ISP DDoS protection Block volumetric attacks before they reach the customer infrastructure Cloud Signaling DATA CENTER IPS Load Balancer Pravail APS CPE-based DDoS protection Stop DDoS Attacks on the customer premise Trigger Cloud DDoS protection for volumetric attacks with Cloud Signaling Page 24 - Company Confidential

25 Thank You