Sprint last week launched two security services that it says will help customers mitigate distributed denial-of-service attacks and better enforce security policies.
Sprint last week launched two security services that it says will help customers mitigate distributed denial-of-service attacks and better enforce security policies.
The offerings include Sprint’s IP Defender and Secure Content Management and Filtering services. They are designed to keep customer networks safer by using tools that proactively thwart distributed DoS attacks and dedicate a network appliance designed to enforce a customer’s security policy, respectively, the company says.
Sprint’s IP Defender service is the latest anti-distributed-DoS offering from a carrier that proactively detects attacks and then puts mitigation efforts into effect. Sprint has deployed Arbor Networks’ PeakFlow, which detects network-behavior anomalies, in its network and Cisco Mitigation devices at customer sites.
“The Arbor piece provides the 24/7 monitoring and the Cisco element lets us divert and mitigate traffic to a black hole or another port,” says John Pardun, security solutions manager at Sprint.
PeakFlow monitors networks and detects if there has been a drastic change in traffic heading toward a specific customer, which is a telltale sign of an attack. Sprint then uses the Cisco devices to immediately make changes to a customer’s network to try and stop the attack. The guidelines as to when and how Sprint reacts are outlined with the customer when Sprint sets up the service.
One industry watcher says the Sprint move makes sense.
“This announcement is most important to Sprint customers,” says Kelly Kavanagh, senior analyst at Gartner. The service is attractive to customers that want to increase network uptime and avoid DoS attacks as much as possible, he says.
Late last year the carrier said it would beef up its anti-distributed-DoS efforts with monitoring and mitigation services. Sprint has a network-based system that uses stateful inspection in its edge routers to examine traffic for all IP customers. But its IP Defender is an add-on service for which the carrier charges an additional fee.
|
Sprint is not alone in offering proactive services or charging for them. AT&T first announced its Internet Protect distributed-DOS monitoring and mitigation service in March and then added a proactive mitigation feature in June.
MCI also offers distributed DoS monitoring and mitigation service, but MCI has yet to provide a proactive mitigation feature.
As part of its DoS response service-level agreement (SLA), the carrier guarantees it will respond to DoS attacks directed at any of its IP customers within 15 minutes of when a user calls MCI and the carrier issues a trouble ticket.
Sprint also is offering a standard SLA with its IP Defender service that covers notification and mitigation. The carrier guarantees it will notify a customer within 15 minutes of a possible DoS attack.
Customers can set up a policy that allows Sprint to initiate mitigation immediately, but for those that want to first grant approval, the carrier guarantees it will initiate mitigation within 15 minutes of that approval.
Sprint’s IP Defender service is available in two versions: one monitors multiple customer networks using one PeakFlow device, and another that lets customers dedicate PeakFlow devices to monitor only their networks. The carrier says its standard offering is priced based on port size, meaning all T-1 customers would pay the same fee. The carrier would not reveal prices.
Sprint launched its Secure Content Management and Filtering service last week.
It is deploying and managing Network Appliance’s NetCache device at customer sites to support this service. “We’re using a platform that provides filtering and also uses Web caching and bandwidth optimization,” Pardun says.
With this device users can set and enforce security policies such as access controls, authentication, Web filtering and blocking potentially malicious code while using Web caching for better bandwidth optimization.
Sprint is offering its Secure Content Management and Filtering service to Sprint IP customers and others using dedicated IP services from another carrier.
