DDoS Protector

DDoS Protection and Attack Mitigation

! !

Maintain Business Continuity

Even When Under Attack

Features

• Full protection of data center applications against emerging network threats
• Maintain network performance even under attack
• Maintain excellent user response time even under attack
• DDoS Protector combines intrusion prevention system (IPS), network behavioral analysis (NBA), denial-of-service (DoS) protection, and SSL attack protection

Benefits

• Get the most accurate attack detection and prevention without blocking legitimate user traffic
• Reduce Total Cost of Ownership (TCO) of Security Management
• Full investment protection and extended platform lifetime with pay-as-you-grow license upgrade scalability delivering best ROI and CAPEX investment protection
• Multitude of security tools in a single box
• Single management application to manage multiple DDoS Protector units across multiple data centers

DDoS Attacks Are On The Rise

In today’s info-security threat landscape, denial-of-service and distributed denial-of-service (DoS/DDoS) attacks are a major cause of network downtime. Whether executed by hacktivists to draw attention to a cause, fraudsters trying to illegally obtain data or funds, or a result of geopolitical events, DDoS attacks are a destructive cyber weapon. Governments, utilities, financial services, and commercial institutions face daily attacks.

Preparing for “common” DDoS attacks is no longer enough. Thanks to the growing array of online marketplaces, it is now possible for hackers to wreak havoc with virtually no knowledge of computer programming or networks. Attack tools and services are easy to access, making the pool of possible assaults larger than ever.

With Burst attacks and Advanced Persistent DDoS campaigns, hackers launch multivector, blended campaigns with high-volume network vectors with more sophisticated application-layer attacks. In addition, recent IoT threats spawned the largest DDoS attack in history, propelling the industry into the 1Tbps DDoS era.

With these new threats, it is critical to ensure your DDoS mitigation solution can protect your organization and customers from today and tomorrow’s sophisticated attacks.

Integrated On-Prem and Cloud DDoS Protection

DDoS Protector is part of Check Point’s Attack Mitigation Solution and is an award-winning, real-time, perimeter attack mitigation device that secures organizations against emerging network and application threats. DDoS Protector protects the infrastructure against network and application downtime (or slow time), application vulnerability exploitation, malware spread, network anomalies, information theft, and other types of attacks.

With DDoS Protector, Check Point’s attack mitigation solution offers protection with the shortest mitigation time and broadest attack coverage. Check Point provides a hybrid solution combining on-premise and cloud-based mitigation tools in a single integrated solution, designed to optimally block multiple attack vectors occurring in parallel.

!

Why DDoS Protector?

DDoS Protector includes a comprehensive set of four essential security modules – anti-DDoS, network behavioral analysis (NBA), intrusion prevention system (IPS), and SSL-attack protection - to fully protect the application infrastructure against known and emerging network security attacks. It employs multiple detection and mitigation modules, including adaptive behavioral analysis, challenge response technologies, and signature detection.

Compared to standalone solutions, the synergy of multiple security modules on a single, hardware-accelerated platform enables effective protection against attackers who seek to systematically compromise business assets while providing unified reporting, forensics, and compliance.

DDoS Protector consists of adaptive, behavioral-based real-time signature technology that detects and mitigates emerging network attacks, zero-day, DoS/DDoS, application misuse attacks, network scanning, and malware spread. It eliminates the need for human intervention and does not block legitimate user traffic.

! ! ! ! ! ! ! ! !

!

The DDoS Protector appliances offer versatile connectivity and mitigation capacities, adhering to enterprise and service provider deployments. Bandwidth mitigation capacities range from 6, all the way up to 400 Gbps. Protection can be further augmented with our Cloud DDoS Protector Services.

!

Deployment Modes

DDoS Protector can be deployed inline, out-of-path (OoP), or in a scrubbing center to provide the highest mitigation accuracy within the shortest time. Each deployment mode offers the same performance as an inline device.

With DDoS Protector deployed either inline or out-of-path as well as in a scrubbing center, the devices are able to communicate with each other in real-time to collect automatic updates of normal traffic baselines, detect behavioral patterns, and obtain attack footprints. This constant real-time flow of Defense Messaging enables DDoS Protector to provide accurate and instant mitigation without the need to learn this information when an attack occurs.

Deploying DDoS Protector devices out-of-path or in a scrubbing center is the most scalable and flexible solution as it is based on the maximum attack mitigation capacity needed, without being limited by the actual network physical topology.

Integrated, Hybrid Solution

In addition to the security modules integrated in DDoS Protector, Check Point’s Attack Mitigation Solution (AMS) includes an SSL decryption/encryption engine, a WebApp Protector module, and Hybrid Cloud DDoS Protector Service that works in sync with the on-premises solution. With no performance impact or risk, Check Point’s AMS ensures business continuity even when under attack.

The solution is enhanced with a central Security Information Event Management (SIEM) to provide unified situational awareness to our Emergency Response Team (ERT). Unique messaging assures that each component provides information about traffic baselines and real-time signatures to the others, so that all system components have full visibility into all information.

Cloud DDoS Protector Services

Check Point’s DDoS Protector Cloud Service can be delivered in On-demand, Always-on, or in a Hybrid configuration, and can be custom-tailored to suit any customer need, network topology, or threat profile.

!

Global Coverage, Massive Capacity

Check Point’s DDoS Protector Cloud Service is backed by a worldwide network of 16 global scrubbing centers, with 8 Tbps of mitigation capacity (and growing). Check Point’s scrubbing centers are globally connected in full mesh mode, using Anycast-based routing. This ensures that DDoS attacks are mitigated closest to their point of origin and provides truly global DDoS mitigation capable of absorbing even the largest volumetric attacks.

Check Point DDoS Protector Cloud Service Features

Our cloud-based service includes the same features you get in the on-premises solution. This includes behavioral-based detection using advanced, patented machine-learning algorithms to protect against known and unknown threats, zero-day protection against network and application layer DDoS attacks such as Burst attacks, DNS attacks, and others. Our unique protection against SSL-based attacks does not add latency or require customers to provide full SSL certificates. Our extensive compliance options and certification are unparalleled by any rival and include industry-specific certifications such as PCI and HIPAA, as well as cloud security standards such as ISO 27001, ISO 27017, ISO 27018, ISO 27032, and others.

Expert Support

The Emergency Response Team (ERT) is a group of security experts that provides 24x7 support and mitigation services for.

Absolute Vision is a unified management and monitoring system. It provides advanced element management capabilities through a unique plug-and-play device support mechanism, including initial device setup, ongoing maintenance, SSL certificate management, real-time reporting, capacity utilization measurement, forensics, task scheduling, and more. It provides automation of monitoring and maintenance processes across all the devices it manages and includes a central repository of vital device information for IT managers to easily find hardware platform details, upgrade and software version management, and installed licenses. As a result, continuous service delivery through the entire device’s operational life cycle is ensured. A REST API is available for SIEM integrations.

DDoS Protector Specifications

1. External fiber fail-open switch is available at additional cost.

DDoS Protector Specifications (continued)

Ordering DDoS Protection

1. SSL option available for the DDoS Protector 6, 20, 60, 110 and 220. GBICs must be purchased separately.

Hybrid Cloud, DDoS Services

Emergency Response Team DDoS Service1

On-demand, Always-on DDoS Protection

1. SSL option available DDoS Protector 6, 20, 60, 110, and 220

Ordering DDoS Protection (continued)

Vision Management

DDoS Vision Management Appliances