Neustar forms partnership with Limelight for turbocharged DDoS mitigation

Transcription

1 Neustar forms partnership with Limelight for turbocharged DDoS mitigation Publication Date: 28 Jun 2016 Product code: IT Rik Turner

2 Ovum view Summary Neustar, a provider of real-time cloud-based information and analysis to the Internet and telecom sectors, as well as to the financial, media and advertising, and retail industries, has announced a partnership with content delivery network (CDN) Limelight to create what the companies describe as the world s largest, most distributed DDoS mitigation network. The partnership is part of a trend toward larger, more muscular DDoS mitigation services, responding to the rise in the maximum bandwidths of attacks. The partnership raises the competitive bar Neustar is already an established player in DDoS mitigation, with three types of service: managed on-premise (with equipment supplied by Arbor Networks), always-on cloud, and a hybrid whereby on-premise technology can escalate mitigation to the cloud whenever it detects that a volumetric attack is underway. The partnership with Limelight is designed to dramatically increase the capabilities of the hybrid and pure cloud services. The agreement between the companies will see Neustar put mitigation equipment into 27 of Limelight s points of presence (PoPs) worldwide, representing a huge increase in scrubbing capacity from the four dedicated PoPs the Neustar-only hybrid and cloud-based services have offered to date. In terms of network capacity, meanwhile, the service will go from a 1.2Tbps bandwidth when it was on Neustar s own infrastructure, to 10Tbps on Limelight s. Despite the jump in bandwidth, the two companies believe it is the increased scrubbing clout that is the fundamental differentiator in the way they will deal with DDoS traffic. Other CDNs that offer DDoS services typically mitigate in a two-phase process. In the first, network routers are used to enforce access control list policies, filtering the traffic and dropping packets as they deem appropriate, after which dedicated mitigation kit is used to scrub the remaining traffic, with about 10% of the traffic actually making it through to the second phase. By contrast, the Neustar/Limelight service will not rely on edge routers at all, and will instead scrub the entire incoming traffic once it has been activated. The partners argue that this approach is better because it frees the routers to continue performing their primary function of directing traffic while guaranteeing that all incoming packets are nonetheless scrubbed, with the cleansed traffic sent back to the customer over a pre-ordained path. Moreover, the fact that scrubbing is now carried out in 27 PoPs spread around the world also means the two companies can speak of scrubbing locally (much closer to the customer), which will reduce the latency compared to when traffic was being routed to one of only four scrubbing centers globally. Other competitors have also upped their game The low-hanging fruit for this partnership is of course the existing customers on Limelight s CDN service, who can now flick a switch to get DDoS mitigation on an ad hoc basis, or as an always-on service if so desired. However, the partners will also be competing for new business from the Ovum. All rights reserved. Unauthorized reproduction prohibited. Page 2

3 hundreds of other businesses being targeted by DDoS attacks. This is a space where the competition is intensifying, with the Neustar/Limelight partnership only the latest in a series of developments. Akamai was the first CDN to enter the DDoS mitigation business with its Kona Site Defender service, which also has a cloud-based web application firewall. The Kona service gained considerable visibility with its defense of major US financial sector customers during the Operation Ababil volumetric attacks carried out by cyber terrorists in 2012 and That was an always-on, network-only approach to mitigation, which essentially consists of soaking up all the DDoS traffic until the attackers capacity to generate it is exhausted, without impact on the customers infrastructure. The acquisition of Prolexic, which was announced in November 2013 and closed in February 2014, brought with it Akamai cloud-based scrubbing facilities.with regard to its bandwidth capabilities, Akamai says it typically carries 24 Tbps of traffic on its DDoS services, but has peaked at over 35 Tbps. In terms of scrubbing facilities, the company runs seven centers globally. Verizon has been offering DDoS Defense mitigation since 2008, serving customers on three continents. In March this year the company launched an upgraded offering called DDoS Shield, which it describes as a hybrid always-on service. DDoS Shield combines locally deployed, fully managed mitigation appliances to detect and mitigate initial attacks, with a cloud-based mitigation service to which traffic can be moved when the size or complexity of an attack warrants. The new service will protect customers regardless of attack size. It is sold in packages based on inbound traffic (not circuit) sizes from 100Mbps up to 10Gbps. For larger attacks, customers can purchase multiple packages. Pay attention to the language used in DDoS services If you are currently performing all DoS mitigation on your company s premises, and on occasion are overwhelmed by attacks with a huge bandwidth, you should familiarize yourself with the leading options for cloud-based mitigation services such as those from Akamai, Verizon, and Neustar, particularly now that Neustar has announced the partnership with Limelight. Have vendors explain very clearly what they mean, for instance, by always-on. The term has generally been used to mean a service where all traffic is automatically routed through the DDoS mitigation provider at all times. This description distinguishes these services from the on-premise option, which is self-explanatory, and a hybrid approach, which involves on-premise equipment as the first line of defense, escalating defensive measures to a cloud-based service as and when required. This is why it is sometimes referred to as an ad hoc service. Now Verizon has coined the term hybrid always-on, meaning a combination of managed on-premise with ad hoc escalation to the cloud. Ovum is watching the market to see whether this description will be adopted by other vendors. Ask all the vendors who present their services to you to outline the pros and cons of all their offerings and those of their competitors, from which you should be able to glean how well they truly understand the evolving market. Once they have told you about the bandwidth they can bring to bear against volumetric attacks, ask how they address the stealthier attacks that do not use massive bandwidths and instead target the application layer. Ovum. All rights reserved. Unauthorized reproduction prohibited. Page 3

4 If you do decide to employ the services of one of these mitigation providers, check that they can work with whatever mitigation technology you currently have on premise. Are you going to have to throw it all away or sell it off on the second-hand market, or can it be integrated with their services? Appendix Further reading Arbor's Move to Address an Expanding DDoS Market, IT (November 2015) The Competitive Landscape for DDoS Protection, IT (June 2014) The New Buzz About DDoS, IT (May 2014) Tackling the DDoS Threat to Banking in 2014, EI (January 2014) On the Radar: DOSarrest, EI (January 2014) SWOT Assessment: F5 Networks BIG-IP Platform, V11.4, IT (December 2013) SWOT Assessment: Arbor Networks Peakflow and Pravail, IT (November 2013) SWOT Assessment: Incapsula DDoS Protection, IT (November 2013) SWOT Assessment: Akamai, Kona Site Defender, IT (September 2013) Author Rik Turner, Senior Analyst, Infrastructure Solutions Ovum Consulting We hope that this analysis will help you make informed and imaginative business decisions. If you have further requirements, Ovum s consulting team may be able to help you. For more information about Ovum s consulting capabilities, please contact us directly at consulting@ovum.com. Copyright notice and disclaimer The contents of this product are protected by international copyright laws, database rights and other intellectual property rights. The owner of these rights is Informa Telecoms and Media Limited, our affiliates or other third party licensors. All product and company names and logos contained within or appearing on this product are the trademarks, service marks or trading names of their respective owners, including Informa Telecoms and Media Limited. This product may not be copied, reproduced, distributed or transmitted in any form or by any means without the prior permission of Informa Telecoms and Media Limited. Whilst reasonable efforts have been made to ensure that the information and content of this product was correct as at the date of first publication, neither Informa Telecoms and Media Limited nor any person engaged or employed by Informa Telecoms and Media Limited accepts any liability for any errors, omissions or other inaccuracies. Readers should independently verify any facts and figures as Ovum. All rights reserved. Unauthorized reproduction prohibited. Page 4

5 no liability can be accepted in this regard readers assume full responsibility and risk accordingly for their use of such information and content. Any views and/or opinions expressed in this product by individual authors or contributors are their personal views and/or opinions and do not necessarily reflect the views and/or opinions of Informa Telecoms and Media Limited. Ovum. All rights reserved. Unauthorized reproduction prohibited. Page 5

6 CONTACT US INTERNATIONAL OFFICES Beijing Dubai Hong Kong Hyderabad Johannesburg London Melbourne New York San Francisco Sao Paulo Tokyo Ovum. All rights reserved. Unauthorized reproduction prohibited. Page 6