1. Field of the Invention
Implementations described herein relate generally to network security and, more particularly, to security perimeters that may be used to protect a customer network from network attacks.
2. Description of Related Art
Network attacks are a real, growing threat to businesses worldwide. These attacks can quickly incapacitate a targeted business, costing victims thousands, if not millions, of dollars in lost revenue and productivity.
One type of network attack, called a denial of service attack, can paralyze Internet systems by overwhelming servers, network links, and network devices (e.g., routers, firewalls, etc.) with bogus traffic. Easily launched against limited defenses, network attacks not only target individual web sites or other servers at the edge of the network, but they also can incapacitate the network itself.
The growing dependence on the Internet makes the impact of successful network attacks increasingly painful (financially and otherwise) for service providers, enterprises, and government agencies. Newer, more powerful tools used by network attackers promise to unleash even more destructive attacks in the months and years to come.
Because denial of service attacks are among the most difficult to defend against, responding to them appropriately and effectively poses a tremendous challenge for all Internet-dependent organizations. Network devices and current perimeter security technologies, such as firewalls and intrusion detection devices (IDDs), although important components of an overall security strategy, do not by themselves provide comprehensive network attack protection.
Current techniques fall short in terms of prevention and/or mitigation of network attacks. Some of the more popular network attack responses, such as blackholing and router filtering, are not optimized to deal with increasingly sophisticated attacks. IDDs offer some excellent attack detection capabilities, but cannot mitigate the impact of the attacks. Firewalls offer a rudimentary level of protection but, like blackholing and router filtering, they were not designed to protect against the types of advanced attacks that are so common today. Still other strategies, such as overprovisioning, do not provide adequate protection against ever larger attacks, and can be costly as a network attack prevention strategy.
Network attacks also make it difficult to keep up with the constant system patching and upgrading required for a successful security system. Many times, implementing significant patches or upgrades is a disruptive event within a customer's network. While overall service disruption can be avoided in a multiple server environment, it still takes time to determine the impact of the patch on the customer's applications and then perform the upgrades.