AKAMAI INTELLIGENT PLATFORM™ Akamai Cloud Security – Protection for Websites and Internet-Facing Applications AKAMAI INTELLIGENT PLATFORM™ 200,000+ servers │ 7 scrubbing centers KEY: Fast DNS Security Operations Center Cloud Security Intelligence SIEM integration Luna portal w/Security Monitor Scrubbing Center Detection Identification Orchestration Mitigation Network Applications Other data center infrastructure B A 2 E 6 1 DATA CENTER 5 3 Web server Load balancer Storage Database Origin cloaking Site Shield Edge Server APPLICATION ORIGIN CLIENTS 4a DDoS protection Web app firewall Bot management IP reputation 4b C 4c 4d D 1. Client requests URL – request made to Akamai DNS service with global scale and segmented architecture to absorb the largest DDoS attacks 2. DNS resolves to the optimal Akamai Edge server with fewer lookups using zone apex mapping 3. Client connects and sends request to designated Edge server 4. Edge server inspects and takes action on malicious or bot requests: a. Adaptive rate controls automatically respond within seconds to block requests when the rate exceeds customer-defined thresholds. Also, IP blacklists and geo-blocking block requests from clients as defined b. Web Application Firewall inspects requests for malicious patterns and blocks based on anomaly risk score. Proprietary Kona Rule Set and nightly WAF testing maintains low false positives and false negatives. c. Bot Manager blocks or takes advanced management actions on requests generated by different types of automated bots, based on customer-defined bot categories d. Client Reputation leverages Akamai’s Cloud Security Intelligence big- data analysis engine to block requests from IP addresses that Akamai has observed attacking other Akamai customers 5. For cloud environments or smaller data centers without a /24, customers can configure origin ACLs to only allow communication from Akamai Site Shield servers and “cloak” the origin from attackers 6. For larger data centers with a /24, customers can route all network traffic (for both web and non-web applications) through an Akamai scrubbing center, where the Akamai SOC will inspect for and block any DDoS attack traffic