Trend Micro TippingPoint Threat Protection System Primary Use Case
When the client chooses a security setup we first need to explain to them why the dedicated IPS assist is correct for them and its advantages. We need to determine their traffic load. With all those calculations we show them we sometimes end up with over-commitment for the TOC. If we're talking about Trend Micro, you should know that they have a range of products, from IPS, anti-security solutions, and discovery solutions.
We lay out all those products and if they feel that any of them meet their requirements then they incorporate that into their solution. After that, it normally goes through the tender process. We participate in the tender and if we win, we send the product to the customer. We generally work with larger companies or different government bodies. For the different public sector units, there is a security requirement where we go to the client to analyze their existing infrastructure, try to find out where the loopholes are, and when we find something we advise and present the solution. We then incorporate whatever product the client requires.
Maybe it's a small setup or maybe it's a multi-department dedicated IPS setup. We deliver whatever IPS featured is required.
The general use cases are for large data centers and state data centers, where people from different state departments post their applications with their servers in the data center cloud. I'm from Calcutta, India. Our company takes care of different government departments in the Eastern part of India, in West Bengal, in Bihar, in Orissa, in Jharkhand, different states there. In all these cases, the state data center or maybe some big government bodies like PUC's, public utility commissions, like ONGC have their own data centers. All their applications are hosted on this data center, or maybe there is a DR. Maybe the DR is on the cloud. Or maybe like the ONGC, they are on-premise.
They need to process the graphs to identify whether there's an intrusion or not, and maybe some micro-sandboxing needs to be done. Right when the setup is changed, when these data centers get these devices and need to process a huge amount of data, huge incoming and outbound data, the firewall integrated into the IPS is not capable of handling that much load. Then you need to put in a dedicated IPS. That's where we introduce NGIPS from Trend Micro. That's the thing - it totally depends on the client's requirements, the site's needs, the data bandwidth, and how much processing is required. Trend Micro offers a complete solution.
Trend Micro offers the NGIPS solution, as well as the Deep Discovery Inspector or Deep Discovery Analyzer, the DDI, and DDA. If you put a DDI in line, we can create a different operating system via a sandbox to process. Whatever packet we get, whatever file is getting processed, we capture according to that and we find anything that needs to be blacklisted or whitelisted. If it's blacklisted, that informs us from the DDA that it is getting first to the IPS and the IPS can take care of it.
It's a complete security solution. We might need to introduce the INWB or IWSBA solutions from Trend Micro to analyze the base traffic as well as the main traffic. It's a combination - NGIPS is there to take care of any intrusion and APT is there to analyze the file and network traffic. I'm doing the network sandboxing. IWSBA takes care of that traffic. INSBA is there for taking care of the mail traffic. These four devices can communicate with each other and can instruct the IPS to do any ad-hoc blacklisting that is required.View full review »
Senior Network Engineer at a comms service provider with 10,001+ employees
We primarily use the solution for email scanning.View full review »
Head of Group at MTI
Our partner is a solution integrator and this is one of the products that he implements for our customers. We are currently working on two pilot projects that involve this solution.
Our experience is with on-premises deployments.View full review »
Technical Manager at Digital World
We use this solution to inspect the data packets before they can enter the firewall. Then, the packets can enter into our LAN infrastructure.View full review »