Security perimeters

1. A security system associated with a customer network, comprising:

a first security perimeter including a plurality of content delivery network (CDN) devices to provide first protection against a network attack associated with the customer network, the plurality of CDN devices serving content on behalf of the customer network and acting as a first termination point for the customer network;

a second security perimeter including a plurality of mitigation devices to provide second protection in terms of mitigation services as a result of a network attack associated with the customer network, the plurality of mitigation devices process traffic intended for the customer network to remove malicious traffic and forward legitimate traffic toward the customer network; and

a third security perimeter including a plurality of hierarchy devices to provide third protection against a network attack associated with the customer network, the plurality of hierarchy devices functioning as reverse proxies for the customer network and acting as a second termination point for the customer network, the plurality of hierarchy devices receiving the legitimate traffic from the plurality of mitigation devices.

2. The security system of claim 1 , where the first, second, and third security perimeters are located outside of the customer network.

3. The security system of claim 1 , where each of the plurality of CDN devices is to serve replicated content associated with the customer network and provide security services with regard to requests for the replicated content.

4. The security system of claim 3 , where each of the plurality of CDN devices is further to obscure the presence of the customer network.

5. The security system of claim 1 , where one of the plurality of mitigation devices is to:

receive traffic intended for the customer network,

process the received traffic to remove the malicious traffic and leave the legitimate traffic, and

forward the legitimate traffic toward the customer network.

6. The security system of claim 5 , where a tunnel is established between the one of the plurality of mitigation devices and one of the plurality of hierarchy devices; and

where, when forwarding the legitimate traffic toward the customer network, the one of the plurality of mitigation devices is to:

apply a tunnel encapsulation to the legitimate traffic, and

forward the legitimate traffic with the tunnel encapsulation to the one of the plurality of hierarchy devices via the tunnel.

7. The security system of claim 1 , where each of the plurality of hierarchy devices is to act as a gateway for traffic intended for the customer network to obscure the presence of the customer network.

8. The security system of claim 1 , where one of the plurality of hierarchy devices is to determine when the customer network is the subject of a network attack; and

where one of the plurality of mitigation devices is to receive traffic redirected from the customer network when the customer network is the subject of the network attack.

9. The security system of claim 1 , where the plurality of hierarchy devices are to receive traffic from the plurality of CDN devices and the plurality of mitigation devices.

10. The security system of claim 1 , where the plurality of CDN devices and the plurality of hierarchy devices are to obscure the presence of the customer network to protect the customer network against network attacks during system patching or upgrading within the customer network.

11. The security system of claim 1 , where the plurality of CDN devices and the plurality of hierarchy devices are to use network attack detection or prevention techniques to identify or process malicious traffic intended for the customer network.

12. A security system associated with a customer network, comprising:

a first security perimeter including a plurality of content delivery network (CDN) devices geographically distributed in a public network, the CDN devices being configured to serve as a first termination point for a first set of traffic intended for the customer network; and

a second security perimeter including a plurality of hierarchy devices located within the public network, the hierarchy devices being configured to serve as a second termination point for a second set of traffic intended for the customer network, where the second set of traffic includes traffic from the CDN devices and traffic different from the traffic from the CDN devices.

13. The security system of claim 12 , where the CDN devices and the hierarchy devices are to obscure the presence of the customer network to protect the customer network against network attacks during system patching or upgrading within the customer network.

14. The security system of claim 12 , where the CDN devices and the hierarchy devices are to use network attack detection or prevention techniques to identify or process malicious traffic intended for the customer network.

15. The security system of claim 12 , where each of the CDN devices is to serve replicated content associated with the customer network and provide security services with regard to requests for the replicated content.

16. The security system of claim 12 , where each of the hierarchy devices is to act as a reverse proxy for traffic intended for the customer network to obscure the presence of the customer network.

17. A security system associated with a customer network, comprising:

a first security perimeter including a plurality of hierarchy devices located outside of the customer network, each of the plurality of hierarchy devices is to:

act as a reverse proxy for the customer network, and

determine when the customer network is the subject of a network attack; and

a second security perimeter including a plurality of mitigation devices located outside of the customer network, one of the plurality of mitigation devices is to:

receive traffic intended for the customer network when one of the plurality of hierarchy devices determines that the customer network is the subject of the network attack,

process the received traffic to remove malicious traffic and leave legitimate traffic, and

forward the legitimate traffic to one or more of the plurality of hierarchy devices.

18. The security system of claim 17 , where a mitigation service is initiated when the one of the plurality of hierarchy devices determines that the customer network is the subject of the network attack, the mitigation service causing traffic intended for the customer network to be redirected to one or more of the plurality of mitigation devices.

19. The security system of claim 17 , where a tunnel is established between one of the plurality of mitigation devices and one of the plurality of hierarchy devices; and

where, when forwarding the legitimate traffic to one or more of the plurality of hierarchy devices, the one of the plurality of mitigation devices is to:

apply a tunnel encapsulation to the legitimate traffic, and

forward the legitimate traffic with the tunnel encapsulation to the one of the plurality of hierarchy devices via the tunnel.

20. The security system of claim 19 , where the one of the plurality of hierarchy devices is to:

receive the legitimate traffic with the tunnel encapsulation from the one of the plurality of mitigation devices,

remove the tunnel encapsulation, and

forward the legitimate traffic to the customer network.

21. The security system of claim 17 , where each of the plurality of hierarchy devices is to act as a gateway for traffic intended for the customer network to obscure the presence of the customer network.

22. A method for protecting a customer network, comprising:

receiving traffic associated with the customer network at a first device outside the customer network, the first device serving content on behalf of the customer network and acting as a first termination point for the customer network;

sending the traffic to a second device outside the customer network, where the second device acts as a second termination point for the customer network;

determining, at the second device, whether the traffic includes malicious traffic; and

initiating, by the second device, a mitigation service when the traffic is determined to include malicious traffic by sending the traffic to a third device that performs the mitigation service to remove the malicious traffic and leave legitimate traffic, where the third device sends the legitimate traffic to the second device.

23. The method of claim 22 , further comprising:

determining, at the first device, whether the traffic includes malicious traffic; and

discarding the traffic when the traffic is determined to include malicious traffic.

24. The method of claim 23 , where determining, at the first device, whether the traffic includes malicious traffic includes:

determining whether the traffic includes malicious traffic based on application-level filtering.

25. The method of claim 22 , where sending the traffic to a second device includes:

determining, at the first device, whether the traffic can be processed, and

forwarding the traffic to the second device when the traffic cannot be processed.

26. The method of claim 22 , where determining, at the second device, whether the traffic includes malicious traffic includes:

determining whether the traffic includes malicious traffic based on application-level filtering.

27. The method of claim 22 , further comprising:

processing, at the third device, the traffic to remove malicious traffic and leave legitimate traffic; and

forwarding the legitimate traffic to the second device.

28. The method of claim 27 , where forwarding the legitimate traffic includes:

establishing a tunnel between the third device and the second device, and

sending the legitimate traffic from the third device to the second device via the tunnel.