Rethinking Security: Corsa Red Armor Network Security Enforcement
0 likes780 views
The document outlines Red Armor's innovative network security enforcement solutions designed to combat escalating DDoS attacks through a high-performance, purpose-built infrastructure. It highlights the NSE7000 series, which installs easily within existing architectures and provides line-rate enforcement without performance degradation. The architecture features best-of-breed analysis and enforcement, enabling both efficiency and scalability while addressing the growing threats in network security.
Rethinking Security: Corsa Red Armor Network Security Enforcement
- 1. Red Armor
- 2. Network Security Enforcement Rethinking Network-Based Security To Protect against DDoS Attacks
- 3. • Perfectly simple high performance infrastructure – Purpose-built high capacity networks – Our architecture and advanced features set us apart • Product Innovation with market-leading support • Customers use this for rapid service creation and delivery within their networks – ISP, SP, IX, CDNs, hosting providers and NREN customers worldwide – Very large networks: Each moving >50Petabytes of data per month
- 4. A Bad Trend in DDoS Attacks BBC – 602Gbps 31/12/2015 Krebs – 665Gbps 20/09/2016 OVH – 1Tbps 20/09/2016 Dyn – 1.2Tbps 21/10/2016 Incapsula– 650Gbps @ 150Mpps 21/12/2016 Mirai Botnet Leet Botnet NWH Botnet
- 5. Anatomy of DDoS Attacks >90% of Attack Traffic is Volumetric Verisign Oct.2016
- 6. “IoT denial of service attacks ….will be orders of magnitude greater than what we have seen. The 2016 IoT DDoS attacks were…merely designed to calibrate their weaponized software. 2017 will see serious internet outages.” 2017 – Tip of the Iceberg
- 8. Security for high volume networks Insufficient performance against escalating intensity of attacks: huge # attack sources, massive increase in attack size, multiplying attack types Mitigation is not keeping pace with detection and analysis Cost prohibitive Not line-rate Limited scale Restricted placement Inadequate evolution Too complex
- 9. Red Armor NSE7000 Series • Installs in 10 minutes within existing architectures • Operates as a bump on the wire • Interoperates with every DDoS detection technology • Provides 100G line rate enforcement at a fraction of the cost Red Armor Turbo Charges Network Security
- 10. Separation of Network Security Functions An evolved security architecture: • Best-of-breed Analysis • Best-of-breed Inspection • Line-rate Enforcement Mitigation/ Enforcement Inspection Analysis
- 11. Line-rate Enforcement Red Armor: Network Security Enforcement 64 Byte line-rate performance: 100Gbps @ 150 Mpps Ultimate precision to protect both network and customer No performance penalty with small packets or number of rules Responsive to evolving security threats Universal Solution Fits in any existing architecture Distributed or centralized with ability to scale up AND scale out Link best of breed inspection and analysis with best enforcement Performance monitoring and reporting for every rule Right-Sized Economics Simplified enforcement Affordable for building truly distributed defence Ability to scale security with scaling the network No software licensing fees or transceiver lock in Universal enforcement for any size volumetric DDoS attack
- 12. Network Security Enforcement for DDoS BGP Flow Spec NetFlow Data Analysis/Detection Bump in the wire Red Armor Line Rate EnforcementAny existing DDoS detection such as Network Routing Add to existing architecture No shared resources with routing No degradation of performance based on packet size No degradation of performance based on # of rules
- 13. Red Armor – How It Works • Enforcement broken down into simple security rules • Packets parsed and matched on any field at L3 and L4 – TCP Flags, SYN in addition to IP src/dst and TCP/UDP src/dst • Rules can be programmed via BGP FlowSpec, REST API or OpenFlow • Real-time per rule statistics for extremely granular performance monitoring and reporting Enforcement Rules Accept Drop Rate-limit DSCP Remark
- 14. NSE Performance: RFC2544 Test Traffic composition: 100% 64byte packets Traffic rate: 100Gbps Performance result: 150Mpps at 100Gbps
- 15. Red Armor NSE7000 Series • Installs in 10 minutes and is additive to existing architectures • Operates as a bump on the wire • Interoperates with every DDoS detection technology • Provides 100G line rate enforcement at a fraction of the cost Red Armor Turbo Charges Network Security
- 16. Red Armor