Protect Your Assets with Single IP DDoS Protection
•Download as PPTX, PDF•
4 likes•992 views
A secure web server isn’t really secure if the infrastructure supporting it remains vulnerable. Unless you implement infrastructure protection, your non-HTTP assets are vulnerable and you may not be as protected as you think you are. You may be like others who need to get better DDoS protection but haven’t been able to or had to settle for an imperfect solution because of deployment limitations such as protocol dependencies and BGP restrictions. Incapsula IP Protection has now overcome these barriers — and we are the only service that can do it. At this webinar our product experts will discuss how Incapsula customers are adopting IP Protection and bringing their DDoS protection to the next level. We’ll also have a discussion with Imperva CISO Shahar Ben-Hador who will share insights on how we use IP Protection and real-world lessons learned. You need to protect more than just your web servers from DDoS attacks. We’ll address these questions: Why do you need to protect more than just your web servers? What were the limitations others ran into when they tried to do it? How did Incapsula help them overcome the limitations? ...and much more!
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Protect Your Assets with Single IP DDoS Protection
Similar to Protect Your Assets with Single IP DDoS Protection (20)
More from Imperva Incapsula
More from Imperva Incapsula (20)
Recently uploaded
Recently uploaded (20)
Protect Your Assets with Single IP DDoS Protection
- 1. © 2015 Imperva, Inc. All rights reserved. Protect Your Assets with Single IP DDoS Protection Shahar Ben-Hador CISO Dvir Shapira Director, Product Management @imperva@Incapsula_com
- 2. © 2015 Imperva, Inc. All rights reserved. Agenda • DDoS threat trends • Current solutions • IP Protection overview • How Imperva is using IP Protection • Lessons learned Confidential2
- 3. © 2015 Imperva, Inc. All rights reserved. Speaker Bio for Dvir Shapira • Background – BSc in physics (no idea why I did it…) and EE – Saw the bubble burst around me as a part-time startup employee back at 2001 – Held various roles at Applied Materials, CheckPoint, Incapsula and a few startups. • Director of product management • Email: dvir@incapsula.com 3
- 4. © 2015 Imperva, Inc. All rights reserved. Speaker Bio for Shahar Ben-Hador • Background – BSc in Math and Computer Science – More than 7 years with Imperva – Held various roles at Imperva around Infrastructure and Security • CISO • Email: shaharb@imperva.com 4
- 5. © 2015 Imperva, Inc. All rights reserved. DDoS Protection Today 1
- 6. © 2015 Imperva, Inc. All rights reserved. Confidential6
- 7. © 2015 Imperva, Inc. All rights reserved. Confidential7 DDoS Propelling the Rise of Cyber Extortion “Any organization can be hit by a DDoS attack” – Swiss Governmental Computer Emergency Response Team • Armada Collective, DD4BC, others continue threatening attacks for Ransom • Even governments are alerting organizations of the growing threat • The need for comprehensive, upstream mitigation is urgent
- 8. © 2015 Imperva, Inc. All rights reserved. You may not be protected even if you have anti-DDoS • Non-HTTP assets are still vulnerable • An attack on an exposed server can bring down your entire infrastructure • Protected HTTP servers can still suffer direct-to-origin attacks • Public cloud servers can be vulnerable Confidential8
- 9. © 2015 Imperva, Inc. All rights reserved. What are the alternatives? • Use a different set of IPs Confidential9 DDoS Legit Traffic • On demand BGP • TCP/UDP proxy • Single IP protection
- 10. © 2015 Imperva, Inc. All rights reserved. IP Protection Confidential10 DDoSLegit Traffic Incapsula Network GRE Tunnel Incapsula IP Address 1.2.3.4 Customer Infrastructure • Provides complete Infrastructure DDoS protection for single IP addresses • Deploys as an always-on service for immediate detection and mitigation of DDoS attacks • Enables origin protection for DNS redirection based services (e.g. CDNs)
- 11. © 2015 Imperva, Inc. All rights reserved. Common Use Cases 2
- 12. Customer Story (1/3) Confidential12 We have constant DDoS attacks on three IPs in which we use proprietary protocols. Looked at four different vendors, none of them were able to provide a decent protection. Diego T | CTO, Online Poker site No C-Class ranges, using proprietary protocol
- 13. BGP on-demand customer, requires always on Customer Story (2/3) Confidential13 We use on-demand BGP, but for one specific server we want to deploy an always on solution. John O | IT Director, video conferencing platform
- 14. Customer Story (3/3) Confidential14 DDoS attacks on a few customers can affect the entire ISP operation. We need to identify the few targets and protect them, to keep our whole network from being burdened by attack. Tim W | Ops Manager, ISP ISPs need to protect Specific IPs that are vulnerable
- 15. © 2015 Imperva, Inc. All rights reserved. How it Works 3
- 16. Confidential16 © 2016 Imperva, Inc. All rights reserved. How it works Customer Origin Server 1.1.1.1 Traffic is routed directly to the server
- 17. Confidential17 © 2016 Imperva, Inc. All rights reserved. How it works Customer Origin Server 1.1.1.1 Incapsula establishes a GRE tunnel between its CDN and the origin server
- 18. Confidential18 © 2016 Imperva, Inc. All rights reserved. How it works Customer Origin Server 1.1.1.1 Incapsula assigns a unique IP to the customer 2.2.2.2
- 19. Confidential19 © 2016 Imperva, Inc. All rights reserved. How it works Customer Origin Server Customer changes the DNS record to point to the Incapsula allocated IP 2.2.2.2
- 20. Confidential20 © 2016 Imperva, Inc. All rights reserved. How it works Customer Origin Server All traffic is routed through the Incapsula global network Only clean traffic is passed to origin 2.2.2.2
- 21. © 2015 Imperva, Inc. All rights reserved. Safeguarding our Own House 4
- 22. © 2015 Imperva, Inc. All rights reserved. Proof in the Pudding • All IP ranges need to be protected • Non-HTTP entry points usually weak links (e.g. VPN tunnels with customers, client server applications) • We’re implementing on-demand Infrastructure Protection with IP Protection for all non-HTTP apps • This approach provides full coverage for all assets Confidential22
- 23. © 2015 Imperva, Inc. All rights reserved. Imperva Architecture Confidential23 Cloud Based DDOS and WAF Protection (Incapsula) Redundant Enterprise Database Firewalls Redundant Enterprise Web Application Firewalls Database Servers Network Application Servers Network Web Servers Network Redundant ISP Connections Redundant Enterprise Edge Routers Redundant Enterprise Firewalls,IPS,AV Website Protection Infrastructure Protection
- 24. © 2015 Imperva, Inc. All rights reserved.24 Questions?
- 25. © 2015 Imperva, Inc. All rights reserved. Lessons Learned • Organizations face growing risk of DDoS attacks for ransom • Existing mitigation solutions may still have vulnerabilities that leave organizations exposed • Always-on IP-level DDoS protection is the only way to completely secure your network infrastructure Confidential25
Editor's Notes
- Over the past few months, groups like DD4BC, Armada Collective, Vikingdom and others have targeted financial institutions, hosting companies, and many other organizations with increasing frequency and intensity. [CLICK] Just this week, the Swiss government’s cyberdefence agency released this note that Armada Collective sent to several financial institutions [click] This criminals have one goal: to terrorize legitimate businesses that lack the means to defend themselves into paying up ransom [CLICK]
- What we’re seeing is that DDoS continues to be the weapon of choice
- Incapsula market-leading DDoS protection now available for single IP addresses. The benefits of DDoS protection have only been available to HTTP servers and entire BGP-enabled C-class ranges. Now, Incapsula can immediately stop any size attack on any IP without the need to monitor or configure an entire network. With Incapsula IP Protection, network operations managers that thought they couldn’t afford the hassle or expense of strong DDoS protection now have a solution
- Gaming companies Forex streaming New customers who want infrastructure protection for their custom, non-HTTP protocols (e.g. gaming, betting). Up till now the only way to portect custom protocols was to put THE ENTIRE IP range that contained the custom protocol behind a scrubbing solution. While is inconvenient for many reasons, one big downside of this was that many customers SIMPLY don’t have an an entire c-class range of IP addresses. Therefore these organizations had, really, no way to effectively protect their critical assets.
- Why always-on vs on-demand mention pros n cons
- Protect all your customers
- Use a different IP address when setting up the GRE.