Radware DDoS Reviews

The main use cases I have for Radware DDoS are traffic scrubbing, hybrid protection in the cloud and on-premise, and automatic mitigation when the bandwidth is saturated.

I use Radware DDoS in my day-to-day work with the company's core services and ERP exposed to the internet.

When the core services and the ERP are exposed to the internet, Radware DDoS has not managed to mitigate any specific attack with major impact that I can recall.

Radware DDoS has positively impacted my organization by giving us greater visibility into all the traffic that hits our applications and faster decision-making when it comes to mitigating any attack and determining whether it is a false positive or a real attack.

An indicator that has improved since I started using Radware DDoS is the reduction of incidents and it gives us more clarity about false positives.

I consider the best features that Radware DDoS offers to be the protection, including SSL protection, the creation of dynamic signatures automatically during attacks, inspection and mitigation of HTTPS and SSL attacks, and integration with the router to divert all the traffic and block malicious traffic.

I would like to add that the always-on protection and activation based on an attack threshold is an especially innovative feature.

I think Radware DDoS could improve the end-user interface slightly, but everything else is excellent as it is an easy-to-use tool.

I have been using Radware DDoS for approximately two years.

Radware DDoS is a very stable solution.

My experience when increasing or decreasing the capacity of Radware DDoS according to the company's needs has been very good, and I would give it a nine out of ten.

I would rate the scalability of Radware DDoS as excellent as it adapts well to changes in traffic volume and the company's needs.

I would describe the attention and assistance I have received from the Radware DDoS team as excellent, as they have been there when we have needed them.

I would describe Radware DDoS's customer support as excellent.

I did not use any other solution before Radware DDoS as it is the first solution we are using.

I would describe the ease of integration of Radware DDoS with other tools or systems that I use in my company as relatively simple, thanks to its compatibility with widely used networking and security standards. Radware DDoS allows integration with firewalls, and in our case we use Fortinet firewalls, and with additional network-level monitoring platforms that we have in the company.

Regarding daily management, I would describe the ease of administration and monitoring of Radware DDoS as very good as the dashboard is very intuitive and easy for the end user.

I have seen a return on investment since I implemented Radware DDoS with savings in resources and time, and greater visibility when making decisions.

My experience with the costs, pricing, and licensing of Radware DDoS is that while it is expensive, the tool meets all expectations.

Before choosing Radware DDoS, I evaluated other options such as Fortinet and F5.

My advice to other professionals who are considering implementing Radware DDoS is to validate the need for which the tool is going to be purchased, since it is expensive, but even so it is an excellent tool that in my case fit all the needs and meets all the objectives for which it was acquired. I gave this review a rating of ten out of ten.

The main use case for Radware DDoS in my organization is configuring the thresholds to mitigate DDoS attacks and protect the infrastructure. I have limited SYN and flood connections to mitigate any traffic poisoning or massive connection attacks.

The best features that Radware DDoS offers, in my opinion, are the fast detection of attacks and response mitigation. The fast detection and mitigation functions have made a concrete difference in my team's daily operations by allowing us to quickly detect DDoS attacks.

Radware DDoS has positively impacted my organization by notifying us of attacks that may be carried out against the company, and seeing possible network scans. We have noticed improvements since we detect traffic floods, and that helps us with our daily analysis and alerting about possible incidents.

I think Radware DDoS could be improved by simplifying the policies a bit, that is, adjusting the configuration a bit better and making it easier.

Radware DDoS has not been very effective in mitigating advanced threats such as burst attacks, DNS attacks, encrypted SSL floods, or IoT botnets in my organization, as we do not have this functionality very well enabled and use it only for detections and to mitigate certain traffic floods. I do not have layer 7 enabled, so we have not used Radware DDoS's HTTP web protection.

Regarding the response times after an attack, this is a point we have not been able to test since we don't have many attacks; they are simple network scans that help us with traffic analysis. I think the ease of use of the Radware DDoS interface requires a bit more advanced knowledge, and there are applications that are much more intuitive.

I have been using this solution in my organization for specifically around a year.

I consider Radware DDoS to be a stable solution, as we have not had stability problems.

The scalability of Radware DDoS is good, as it can adapt to traffic growth and protect infrastructures of different sizes, allowing you to increase mitigation capacity through cloud services.

My experience with Radware DDoS customer support has been very good; they respond to us very quickly and solve all the problems we report.

We did not have another solution before implementing Radware DDoS; it was handled by an external provider.

I have seen a return on investment with Radware DDoS, particularly saving time for investigations since we use the statistics and traffic measurements to evaluate traffic, and Radware DDoS gives us the results a bit more ready-made.

My experience with the pricing, implementation costs, and licensing of Radware DDoS has been good; I have not had the opportunity with DDoS but have found it very easy with Radware DDoS as a load balancer, and the contact with the manufacturer has been good and easy.

Before choosing Radware DDoS, we evaluated other options like Imperva and F5 due to prices and economic reasons, and I think they decided on this option.

I would advise other people who are considering using Radware DDoS that it is a very good tool, that it can be easily implemented, that support is very collaborative, and I would encourage them to try it. I gave this review a rating of 9.

We are using the service for DDoS protection, and all applications that are accessed over the internet need to be put behind the Radware WAF. Currently, we are using 60 to 65 licenses of Radware WAF where we have onboarded these internet-exposed applications. 

Our package includes protection from the Top 10 OWASP attacks and behavioral learning, which is important for traffic monitoring. We focus on low latency mitigations and granular controls in application level policies. When onboarding any application, we work with our stakeholders who inform us which controls should be enabled or disabled. We communicate with the Radware team, and after learning the traffic patterns for 10 to 15 days in the normal mode, Radware provides documentation to share with our stakeholders before moving to protection or block mode.

We are the owners of the Radware DDoS licenses, and there is a dedicated team providing 24/7 real-time monitoring of the product. The detection and prevention capabilities are very good.

It provides protection for network applications and infrastructure level, and the best part is the behavioral-based detection that Radware provides us, along with real-time signature creation. We also have some applications where we have botnets running, and it provides protection against them. 

Web DDoS targets the application layer, which is layer seven of the OSI model. For that, we focus on the Web DDoS technique for bot-based attacks because we have many applications where bots are running. We also face many random URL attacks every day, and it protects against malicious or suspicious random URL attacks.

It ensures both security and performance. It achieves this by learning behavior patterns and providing protection without blocking normal traffic. These are some of the features I am particularly satisfied with in this product.

There should be some extra layer of security and a method of advanced rate limiting. We can limit the number of IPs or URLs per session and per country. There should be improved bot management integration that mitigates bot-based DDoS attacks completely.

I have been using Radware DDoS for the last two to three years.

It's stable. I would rate it a nine out of ten for stability. 

It's scalable. I would rate it a nine out of ten for scalability.

We have 65 licenses.

I'm from India, and we have a dedicated technical account manager who is very supportive. Additionally, we have a large partner team that is a gold partner of Radware. They provide a lot of support as well. Whenever I encounter any issues, I can easily reach out to Radware. I typically submit a ticket for any malicious activity that occurs, and I usually receive a resolution within two to three hours.

Positive

Many years back, I used Barracuda WAFs. I cannot comment on what Barracuda is currently doing in the WAF area, but that solution was good. However, with Radware DDoS, the console is very easy to learn. There is no complexity, and everyone can use the console and easily see all the features. In the future, I will definitely continue with Radware DDoS.

The setup is easy as it is a cloud-based service. It does not present any significant challenges and takes only one or two days to implement.

It saved us 40% to 50% of time, money, and resources. 

It is not expensive. It is medium range. The pricing is good, as we recently renewed our licenses from Radware.

I've been using this solution for the past two and a half years at my company, and I’m pleased to share that we’ve successfully achieved all of our use cases with their services. We are very happy with the product, which effectively detects and prevents external attacks. We also recommend Radware DDoS to other customers because it truly is one of the best products available.

According to what I learned from the Radware DDoS team, the new features are AI-powered, which makes everything faster and more efficient. The best part is the auto policy with zero-touch tuning. We do not require much tuning as we can auto-apply the policy, which automatically optimizes itself using behavior analytics. We have recently purchased API discovery and protection features, which are working very effectively.

We purchased the API protection plan. Previously, testing was done manually while creating software. We have purchased the Radware API discovery and API protection plan, which has reduced our time effort and enhanced quality checks. There was only one incident in the last two to three years, which Radware WAF handled very effectively. We had only two to three hours of downtime for that particular application.

I recommend Radware because of its features, including AI-powered Web DDoS protection, zero-touch tuning, auto policy, API discovery and protection, and advanced bot manager. They have excellent device fingerprinting, behavior analytics, and enhanced threat intel feed that they provide to customers. These are the main reasons I would recommend other customers to choose Radware. 

I would rate this solution a nine out of ten.

Currently, I only use Radware DDoS. I have been carrying Radware DDoS for about 10 years already.

Radware DDoS can mitigate attacks from layer 4 to 7, which makes the organization more secured with a dedicated DDoS solution.

Using Radware HTTP or HTTPS protection actually protects my application at the application layer. I am confident that the applications running on my system are well protected from different types of DDoS attack.

Radware DDoS is very effective in mitigating distributed denial-of-service attacks. The solution is very mature, and since Radware DDoS can detect attacks within 18 seconds, it really helps the organization against those types of attacks.

Using behavioral-based detection, Radware DDoS can detect even unknown or zero-day attacks and mitigate those attacks within 18 seconds. That is the advantage of the behavioral-based feature of Radware DDoS.

Radware DDoS can pinpoint whether users are legitimate or illegitimate, meaning the traffic. That is one of the key features that Radware DDoS has.

On the appliance, maybe the hardware could be improved. Most of Radware DDoS appliances are physical, so they could improve that aspect.

In terms of the system and the functionality, Radware DDoS is constantly upgrading.

I have been working in the industry for 25 years already.

Deploying Radware DDoS is very easy. It is an inline appliance, so I just put it in line and then configure it using its Cyber Controller. Cyber Controller is the management interface for the Radware DDoS device or appliance.

It does not take much time to set up. If I already have the information in place, it does not take much time to configure Radware DDoS.

Including the downtime of the customer or deploying it, it will take maybe an hour or an hour and a half if all necessary configuration is already pre-configured.

The only thing needed is mounting the appliance because it is heavy.

Radware DDoS definitely reduced my operational cost.

Radware DDoS response time is in real-time. As mentioned earlier, it can detect vulnerability or attacks within 18 seconds and can generate its own signatures within that period.

I would rate Radware DDoS a 9 out of 10.

I use Radware DDoS as DDoS protection with active protection. Our BGP is also transferred to Radware. We also have the WAF, which is a web application firewall, but that is a different matter.

What I like most about Radware DDoS is a favorite feature that we call a pipe. That is the clean traffic that they guarantee towards our company, our bank. The clean traffic is actually the favorite feature that we have, and that is one of the reasons why we went with Radware instead of other solutions. I also appreciate their responsiveness because we were having some troubles initially to establish the whole traffic and routes. They were very responsive to that and helped us a lot. They essentially did the whole routing traffic and everything by themselves because we did not have engineers with experience in internet routing traffic.

Radware has been effective at mitigating advanced DDoS threats, such as Burst and DNS attacks. There were several attacks that I was not even aware of. That is actually the best scenario because I did not know that I was attacked, and that demonstrates how effective they are. I think the best answer is when you are not even aware that you are under attack.

What I think they can do better in the future is provide more explanation about the features of the system. During our last DDoS attack in February, we were setting up the system too strict. After some time, our protection started to kill our traffic. However, the team from Radware immediately reacted, and everything was resolved in approximately fifteen to twenty minutes. It was quite interesting that our protection behavior for DDoS started to kill regular sessions.

I would like to see better documentation and more explanation about the features.

Regarding stability, I am not aware of any issues. There is a small time needed to transfer the BGP takeover. There is some gap in the communication, but that is understandable.

When it comes to scalability, I do not have an answer to that because we have not even thought about upgrading or scaling. I believe it will be okay, but I cannot answer with certainty.

I have contacted the technical support and customer support during attacks. We were having some problems during a DDoS attack when legitimate traffic started to be killed. I contacted them and they immediately resolved the issue. They explained what the problem was, remapped everything about the thresholds, and everything was perfect after that because this was the first time we were experiencing such a type of DDoS attack.

If I were to rate the technical support on a scale from one to ten, I would give them a nine.

I have not used any alternatives to Radware DDoS as our system is set up within our premises. However, I was using a system from our internet ISP, and I was not satisfied at all. This was the reason we switched. I believe it was the next day when Russia invaded Ukraine that we were having a major DDoS. All banks in Macedonia were having major DDoS attacks, and the ISP protection did not work at all. They did not react at all.

The initial deployment was not easy, but with the help of Radware engineers, it was not that difficult. From an engineering point of view, it was interesting. Because we did not have BGP and did not have all the prerequisites that we needed, it was challenging for us engineers. I cannot say that it was easy, but I also cannot say that it was difficult. It was challenging.

I have not used any alternatives to Radware DDoS as our system is set up within our premises. However, I was using a system from our internet ISP, and I was not satisfied at all. This was the reason we switched. I believe it was the next day when Russia invaded Ukraine that we were having a major DDoS. All banks in Macedonia were having major DDoS attacks, and the ISP protection did not work at all. They did not react at all.

When I scheduled the call, it did not allow me to pick a time zone. I was only given time slots to choose from.

I am familiar with the pricing because I handled the whole procurement, and I think it is fair pricing. Radware is not at the level of Akamai, but they are more expensive than other competition. However, the services that they are providing are on the next level from their competition, and we do not even consider other providers.

As of right now, after I deployed it, it does not require any maintenance on my end. I do not connect for maintenance, and I do not believe that our engineers connect either. There may be some preventive maintenance, but it is not heavy and not excessive.

I have not used the web DDoS protection. My overall rating for Radware DDoS is nine out of ten.

We are the largest data center company in Asia with almost six data centers in India, and we are planning to expand beyond India. We use Radware DDoS Protection Service for protecting our infrastructure and providing Cloud DDoS as a service to around 500 end customers who have hosted their infrastructure on our cloud co-location.

We've been using it in a fully-manged way, and always on an on-demand. 

We began to see value almost a year back. It took a year to streamline when using it, and then we started we started onboarding our customer on the same pipe. 

We wanted to protect our own data center. We are India's only cloud. We are in direct or hyperscale. We are in direct competition with Azure, AWS, and all. And at the same time, we have lots of ISP networks. 

Our environment is hybrid. We are the largest data center. Most of the infrastructure is on-premise, and then we have India's first AI cloud and India's first hyperscale. It took almost a year to streamline everything. 

Radware DDoS Protection Service is valued for its multi-layered defense protection, always-on and on-demand service, zero-day protection with adaptive behavioral-based mitigation, DNS and infrastructure protection, and SSL attack mitigation. The solution's multi-layer protection covers volumetric, protocol-based, and application layer attacks.

They offer a very effective response against DNS attacks. 

Regarding behavior-based detection technology, in terms of real-time detection, it has been able to reduce false positives. We have pretty good experience with them. The geolocation is pretty good for an organization such as ours. We can block anything from certain regions, like North Korea or China, etc, cetera. It works alongside machine learning. They can update policies globally in less than ten seconds, which really helps with false positives.

During a DDoS attack, it ensures legitimate users are not affected. We're working on a hybrid solution, so we have Defence Pro devices on our side and unlimited mitigation capabilities on the cloud. 

Their Cyber Security Controller portal, including its GUI and dashboard, could be more intuitive so CXOs can easily understand them. 

Improvements in visualization for reporting also need consideration. This feedback has already been provided directly to Radware DDoS Protection Service.

We have been using the solution for the past 12 years or possibly more.

Lately there have been some issues with stability, which results in a stability rating between eight and nine out of ten.

Scalability has never been a challenge due to the hybrid cloud model and the Cloud DDoS capability, which allows scaling as demand increases.

We have 24/7 access to Radware DDoS Protection Service's Emergency Response Team who collaborate during ongoing attacks, ensuring less than one second mitigation for L3/L4 and less than ten seconds for L7. This is supported by a direct relationship with key personnel at Radware DDoS Protection Service.

Positive

We conducted a POC with F5 and Arbor Networks. We chose Radware DDoS Protection Service due to its superior capabilities and willingness to host a scrubbing center, minimizing latency.

The initial setup was quite easy, aided by a team experienced with Radware DDoS Protection Service for well over a year.

Implementation was handled internally by a team of six to seven team members who were experienced with Radware DDoS Protection Service.

The ROI was realized after a year, giving a year-on-year return of around 20% to 30%. The hybrid approach optimized infrastructure costs and personnel resources.

We have a premium cost setup to align with a tier four uptime certified data center, storing and protecting critical infrastructure.

Radware DDoS Protection Service stood out due to its better capability and flexible hosting options that reduced latency.

Radware DDoS Protection Service offers enterprise-grade protection across all layers from L3 to L7, with hybrid flexibility and global scrubbing network. 

On a scale of one to ten, I rate this solution an eight or nine.

In my previous company, I used Radware DDoS for more than one and a half years, and it was positioned in front of the perimeter firewall.

Our main use case for Radware DDoS was to protect the external services, which were deployed on Big-IP F5, and then in front of that, a Check Point firewall was there, and in front of the Check Point firewall, Radware DDoS was there, protecting all the external services for that particular company I worked for.

I can give a specific example of an attack where Radware DDoS made a difference; we verified that an attacker tried to generate a TCP flood attack originating from multiple sources, and Radware DDoS was able to mitigate that based on the security features that were enforced on it.

Regarding our use case for Radware DDoS, it was enforced for each and every application, with TPS assigned there for verifying the requests coming from each single source, either based on a single source or distributed sources.

In my experience, the best features Radware DDoS offers include the ability to mitigate DDoS attacks such as TCP and SYN flood attacks; we can also mitigate UDP flood attacks, and while using TCP, it can verify the client and many other aspects, being implementable on Layer 7 for more granular information such as user-agent, which is possible if we import the private key of the particular service.

Out of all those features, the one that had the biggest impact for my team was the Layer 3 and Layer 4 DDoS implementation because it was more effective for us; we did not want to have decryption on the first layer of defense as it would introduce latency for our applications.

Radware DDoS has positively impacted my organization by sorting unwanted traffic, specifically malicious traffic targeting the applications, and it has taken the burden off the perimeter firewall during incidents.

For one particular incident, I believe that more than two million requests came through, and I think over twenty million requests were mitigated at the Radware DDoS level.

I believe Radware DDoS could be improved for cloud deployments with more granular controls that could provide valuable gains for the company, especially by verifying whether the client is genuine or not with additional metrics.

While I think the support is quite good and the user interface is acceptable, it does require a more friendly interface, although I cannot recall the exact improvements needed.

I have been in this field for more than four and a half years.

Radware DDoS is stable in my experience, with no downtime or reliability issues; on-premises performance exceeds expectations.

Radware DDoS's scalability is good; scaling up or down is easy without performance issues.

Customer support for Radware DDoS is fine; I would rate them nine out of ten. The learning curve for Radware DDoS was fine; it was easy for my team to get up and running.

I do not believe we had any other DDoS solution prior to Radware DDoS; we had F5 Cloud DDoS for cloud, which was good but still used Radware DDoS for on-premises.

I have seen a return on investment with Radware DDoS because it reduced our work by mitigating traffic before it reached the perimeter firewall, which lessened the need for extra security policies.

I am unsure if we evaluated other options before choosing Radware DDoS; my team likely did, but I was not part of that particular process.

My advice for others looking into using Radware DDoS is that if they are seeking a good solution while also considering budget, Radware DDoS is a suitable option.

I would rate Radware DDoS a seven out of ten because I believe that our board DDoS is much better.

I think we have covered all the aspects of Radware DDoS, but I feel the cloud requires more attention compared to on-premises. I gave this review a rating of seven out of ten.

My use case is that whatever traffic is coming from the internet, all that traffic is being monitored. It is sent to their scrubbing center, and from there, anything non-genuine gets blocked as per IOC, and the genuine traffic is sent to my inside applications.

Since implementing Radware DDoS Protection Service, I have been able to see DDoS attack sources and their origins. We didn't have the capacity to visualize DDoS attacks before. Blocking is also very fast compared to before, around 18 seconds of blocking time.

In my organization, I have observed many SQL injections and cross-site attacks, alongside heavy bandwidth utilization, which Radware DDoS Protection Service has been able to mitigate effectively.

Since implementing Radware DDoS Protection Service, I have experienced a transformation. I didn't have any DDoS mitigation tool previously, and my internet bandwidth was completely utilized by DDoS attacks. It is now filtering at the scrubbing center, especially during volumetric attacks.

Radware DDoS Protection Service ensures that legitimate users are not affected during DDoS attacks by communicating with my Anti-DDoS DefensePro tool. Based on configured policies, the scrubbing center can pass the traffic while already blocking the designated attackers' IPs.

Before implementing automation, my security monitoring team had to continually monitor DDoS attacks around the clock and send IPs for approval to the operations team for blocking, whereas now, it automatically blocks based on policies.

The time consumption in our processes has decreased compared to before because the internal ticketing process required approval from respective authorities, while now it is completely automated, allowing immediate blocking.

The solution effectively prevents attacks much earlier, making monitoring less burdensome than before.

Compared to other products, Radware DDoS Protection Service provides superior performance, as it blocks attacks within 18 seconds.

Previously, managing one incident took around three hours for complete approval and implementation, but now the Anti-DDoS tool immediately blocks particular IPs within 18 seconds.

With the SecOps dashboards for monitoring and reporting metrics, we can continuously monitor our Security Operations Center 24/7. We have absolute visibility.

The dashboard can provide historical information on objects and networks for three months, and we also have a backup tool that retains data for six years, per my industry policies.

The best feature of Radware DDoS Protection Service is the automation. Previously, manual intervention was necessary, and for incoming attacks, we had to inform the respective security and operations teams, whereas now, it is an automated process that blocks attacks based on policies by default.

This automation has significantly improved my organization's security compared to before. We didn't have that much automation previously, but now, with multiple policies, we can prevent attacks effectively.

I want to improve the blocking time; it should be within 10 seconds because 18 seconds allows multiple transactions in the financial industry. I want the blocking time to be better than 18 seconds.

I have been using the solution for the last six months.

Radware DDoS Protection Service is stable. For the last six months, I have not faced any issues, so it is a good solution.

In my opinion, there is no downtime experienced with Radware DDoS Protection Service due to external network redundancy.

It is scalable and user-friendly. My team members understand the policies and dashboards easily.

I would rate their customer support positively. Before using Radware, I experienced some delays with another product, but with Radware, we have immediate connections with high-level technical support.

I would rate Radware's customer support an eight out of ten because when we had initial configuration issues, support resolved the issues after a couple of escalations.

Positive

Before Radware DDoS Protection Service, I didn't have any DDoS solution at all, just manual processes.

The deployment of Radware DDoS Protection Service is very simple. It is user-friendly.

Radware DDoS Protection Service does not require separate maintenance, and there is minimal downtime during maintenance periods, such as during firmware upgrades of the Anti-DDoS tool.

There are five members in my team who work with Radware DDoS Protection Service.

I didn't check pricing of other providers in depth but verified with two, and found Radware to be significantly cheaper compared to F5.

I chose Radware because, as per Gartner, it is recognized in the market as the number one anti-DDoS solution.

I would recommend Radware DDoS Protection Service fully because I have observed improvements in bandwidth speed.

I would rate Radware DDoS Protection Service a ten out of ten.

My main use case for Radware DDoS is preventing our applications from attackers, and that is the main goal.

I find that Radware DDoS is very useful and helpful, and I have nothing else to add about my main use case or how I use it day-to-day.

As for the support team, we have configured all of the required things to stop or mitigate an attack with Radware DDoS.

In my experience, the best features Radware DDoS offers include very good support, as the team helps us whenever we require it. What makes the support stand out for me is that they solved a tricky problem quickly, which is an example of when they helped me.

Radware DDoS is the best tool, as it protects our applications just as we intended it to.

Radware DDoS has positively impacted my organization.

I believe there is no need to improve anything about Radware DDoS.

I am saying that there is no need to change anything, and I have nothing more to add about needed improvements.

I have been using Radware DDoS for the last one year.

Whenever a DDoS attack is happening, your team rectifies the situation for us, and that is the main thing for us as a particular metric we have seen since using Radware DDoS.

Radware DDoS is a perfect tool and there is no need to add anything else about the features besides support.

As of now, I notice there is no need to change anything, and using the WAF, I feel more safe for our applications.

We have been using Radware DDoS extensively for the past two years in our production network within the utility sector. Primarily, we use it for application layer filtering and for direct termination with our Internet Service Providers (ISPs). Initially, we encountered several challenges during the configuration process, primarily due to the lack of ready-made templates. However, over the last two years, we have successfully implemented filtering measures, effectively mitigating our DDoS attacks by removing unwanted traffic directed at our public IP addresses.

This system has been crucial in securing our operations and meeting our specific needs for our data center. All public domain URLs in the utility sector are hosted behind an Internet firewall, ensuring that the traffic directed to these public domains is properly managed through DDoS protection. That sums up our experience with this system.

Radware DDoS has been effective at mitigating advanced DDoS attacks such as burst or DNS attacks and encrypted SSL floods because we blocked all public domain IPs through access lists at my DC router, where all the ILLs are delivered from the ISP. We are getting IOCs, which are Indicators of Compromise from CERT-In, NCIIPC, and CS K-Cyber Swachhata Kendra, from central agencies.

My experience with the behavior-based detection technology for real-time attack detection and minimizing false positives is quite positive. The behavioral framework we have consists of three layers. The first layer focuses on DDoS protection, as we are implementing two policies for two ISPs simultaneously. In our environment, we are not using an active-standby setup; instead, we utilize both links from each ISP. Therefore, we are deploying two identical boxes, one connected to each ISP. These ISP links are directed towards our management service, where all public domain sites are hosted in our data center. Regarding the behavioral aspect, let's consider a scenario where there is suddenly a spike in packet traffic from a public domain. We typically monitor the daily bandwidth usage on the ISP side. For example, if the average bandwidth usage is around 200 Mbps, but one day we notice a surge to 400 Mbps, this may indicate unknown traffic hits. This is particularly concerning because we operate in the utility sector, where we collect electricity bills each month. We use handheld devices to fetch these bills from our system, processing them at the beginning of each month. This increase in traffic could likely stem from these sources, as they may be generating numerous unknown visits to our data center servers in an attempt to log in. 

To analyze this behavioral pattern, we first examine the trust levels associated with the bandwidth usage. We investigate the cause of the sudden increase in bandwidth and identify the unknown IP addresses responsible for the traffic. We then determine the locations of these IPs and formulate policies in our DDoS logon system to block any suspicious activity. Additionally, we address two other behavioral patterns: one through endpoint security for end-user services and another through anti-Advanced Persistent Threats (APT) measures. This comprehensive approach helps us safeguard our systems effectively.

Radware DDoS protects legitimate users during a DDoS attack. We have a behavioral filtering template that we enabled after subscription. Every month, we create a report analyzing the number of unknown hits generated from DDoS, identifying legitimate IPs from our customer base and unknown IPs from other countries. We conduct geo-fencing as the first level of protection, allowing only Indian region IPs to execute packets towards our management server. The second level involves using default templates to perform this activity efficiently.

The HTTP Layer 7 protection works effectively as the signatures are updated on a daily basis and automated from the Radware cloud. Zero-day protection happens automatically because the initial steps only require us to create the policy for filtering, but after that, it continuously does its job without any manual intervention.

The zero-day attack signatures for new types of attack threats and vulnerabilities are directly taken from the cloud and blocked. For DC network flow, the fast layer DDoS attack itself is removed from the entry point from the ISP side only. After that, the traffic lands with DDoS, coming from my perimeter firewall, providing another layer of filter and protection. After my perimeter firewall, the traffic goes to my anti-APT, where we perform another level of protection or filtering for DDoS.

There are areas where Radware DDoS could improve, specifically regarding centralized visibility. If someone is allowed access to one payment server but attempts to access the backend database and application servers from that source, we need to analyze the level of propagation. If they are performing suspicious activities such as random logins, it would be beneficial to have a centralized console that shows which IP is attempting which actions for greater visibility, enabling better analysis.

To sum it up, we suggest that clear visibility within a management console could significantly enhance Radware DDoS's usability. We use Radware DDoS and Check Point for our public site because understanding the origin and pattern of public hits is crucial. If the console could segregate packets by type—such as HTTPS, logger, database-related queries, or other behavioral data—and generate reports accordingly, it would better aid our analysis.

We have been using Radware DDoS for two years.

In terms of scalability, Radware DDoS excels. One device we procure is reliable and automates filtering by downloading signatures and providing behavioral analysis. It operates with predefined signature filtering without needing much from us other than receiving reports. I would rate its scalability as nine out of ten.

I have contacted technical support for Radware DDoS many times, and their support quality is the best I have encountered in my entire career. Their responses are quick, and the support surpasses my experience with other OEMs such as Check Point, Sophos, Fortinet, and Cisco, who can often be slow with their solutions.

I have faced issues and approached TAC, and their ability to provide skilled and technically sound support is impressive. They accurately address the service requests and come up with effective solutions faster than many other manufacturers. Their support is significantly better than other OEMs who often resort to trial-and-error methods.

Throughout my career, I have done DDoS filtering through ISPs, but currently, we have a dedicated appliance for DDoS, following recommendations from the DOT and Central Government of India for compliance with ISO 27001 certification.

The initial deployment process can be quite challenging.  The business analyst or and solution integrator often creates confusion, particularly in our location. The Solution Integrators are usually not able to explain everything clearly in one go, which means we often have to go through the information piece by piece. As a result, completing the initial setup and implementation can take nearly forty-five days. If there were a ready-made template available, it would greatly simplify the process. We need to identify the specific hardware requirements and develop a checklist for hardware compatibility and configuration that meets our cybersecurity policies. To comply with these policies, we are currently working on strategies to mitigate potential risks.

Getting a ready-made template for hardware considerations, including guidance on how to harden that hardware before moving to the production level, would be extremely helpful. Additionally, having recommended guidelines from Radware on enabling these policies could streamline our implementation process. In my opinion, this approach would allow us to complete the entire solution implementation within the recommended timeframe.

Maintenance involves ensuring that hardware is functioning properly, including checking subscriptions and enabling necessary blades. For example, last month, we had to enable geo-fencing to block all traffic except from India, which involved re-enabling a previously disabled geo-fencing blade. If there were a central management console that provided alerts about system health, such as fan RPMs and SMPS performance, it would help us maintain the Radware DDoS system proactively.

Typically, two to three people are required for deployment. Initially, we communicate with the application team to ensure proper TLS and SSL levels. After confirming application legitimacy, we assess the delivery and operation level, followed by database and server reviews before concluding that the application is ready to integrate with the DDoS devices.

We are going for seven-year support with a solution comprising two hardware boxes for redundancy and high availability, priced at around 2.4 crores. This pricing is manageable without any worry.

I have considered competing products in the market. We have raised a request for another solution besides Radware DDoS, as Cloudflare has been selected as L1 for another DR setup we are trying to establish. Management requests that we consider similar solutions, which is why Radware DDoS remains qualified as L1.

I would rate Radware DDoS a nine out of ten.