Point of Presence (PoP)

Points of Presence, or PoPs, are a foundational piece of technology within today’s internet. They serve as basic network access points that route, cache, and deliver data efficiently across regions. Rather than connecting to a distant internet provider’s server, PoPs allow for a user to connect to a provider’s local presence – from there, the PoP routes the request and finds the best path for it to reach the underlying, more central servers.

Talk To an Expert Security Report

Why PoPs Are Necessary

When you request a webpage or resource, the resulting signal is limited by the laws of physics. When moving from sender to receiver, a signal is stuck at the speed of its medium, like fiber optic cable or copper wiring. Even with fiber optic’s speed of light (around 203,000 km/s), signals need about 10 milliseconds to cross every 1,000 kilometers. This means that data traveling across continents or oceans can experience tens to hundreds of milliseconds of delay.

On the other hand, consider a packet that needs to ‘hop’ from your home network, to your ISP’s routers, and a slew of internet exchange points from there. Each hop demands that the new network device processes and queues the data packets, adding a few microseconds of delay.

There’s no way around it: the further a signal needs to travel, the greater latency it accrues. However, it’s economically unfeasible for a business to physically connect every single user to their central servers. Enter, PoPs: these are bundles of routers and switches that connect a device or network in one location to another. They support the foundations of today’s Internet Service Providers (ISPs), online service providers, and streaming services; across the board, PoP performance is unmatched.

How PoP Cybersecurity Works

Consider the amount of visibility unlocked by a local PoP: their proximity to users’ real-time requests – while caching and recalling an organization’s content from their more central servers – makes them a natural gateway. This makes PoP security best practices a natural point for the incorporation of cybersecurity processes close to the end-user.

For a basic example, PoPs can check that incoming traffic adheres to their expected transmission protocols – such as SSL/TLS. This allows for PoPs to prevent some man-in-the-middle attacks when dealing with data that’s previously been sent over the public internet. Since PoP cloud security can draw from a scalable pool of resources, it’s able to pull more power and check for multiple security policies at once. This makes them a foundational technology for a Web Application Firewall (WAF).

WAFs allow organizations to put specific policies in place, to define which traffic and behavior their PoPs respond to. In this way, PoPs act as two-way streets: not only can they shuttle real-time traffic intelligence to a central security solution, but they can also offer enforcement, applying security best practice policies that reflect their specific users, networks, and locations.

Other security solutions that are deployed at distributed PoPs include Intrusion Detection Systems (IDS), which monitor network traffic for unexpected behaviors, while other PoPs implement comprehensive anti-malware solutions to protect against viruses, ransomware, and other malicious software.

A Short History of PoPs

In the 1970s, the early internet was spreading from fully-local networks within individual organizations toward wider sets of more distributed end-users. User requests, however, were often still routed directly to the provider’s central server – resulting in large amounts of latency.

The answer to this growing issue would come from the biggest shift in the era’s telecommunications field: the breakup of the Bell Telephone system, in 1982. As essentially the only phone provider in the US, AT&T had already run into the same problem within its long-distance calls. Rather than a large, central switchboard, AT&T had recognized the importance of splitting its infrastructure into more local subdivisions.

When the US government split the Bell Telephone system into smaller organizations, the architectural split would designate PoPs as the termination point. Here, in the first PoPs, the long-distance carrier’s switches would be installed. Connected to the other side of the PoP would be a local exchange carrier, which routes the call from the individual house to a receiver in another county. When ARPANET was met with the problem of expansion, PoPs became the architectural solution of choice.

Today, each PoP is issued its own IP address; large numbers of PoPs may also be housed in a large data center that covers a set geographical region. The size of this region also depends on how many people and buildings there are – for example, an ISP may choose a PoP in a densely-packed city that serves customers for up to 5km away. This way, each customer can benefit from near-zero latency, and commonly-requested content can even be cached at the PoP – drastically cutting wait time.

Virtual PoPs vs. Physical PoPs

Since PoPs are so integral to the internet today, there is a large amount of variance between them.

Physical PoPs are the older solution: they are tangible facilities that house the physical networking hardware – routers, switches, and servers. Physical PoPs are a major part of an ISP’s telecom hubs, physically connecting local users’ fiber optic cables to broader networks. These locations often feature a large amount of redundancy systems to ensure high availability.

A good PoP is akin to a small networking setup, including server racks, cooling circuits, physical security, and monitoring tools. As a result, setting up new physical PoPs can represent a massive expenditure; particularly risky when a business is expanding into a new area.

To provide a level of geographical presence without the risk, today’s cloud providers often provide virtual PoPs. These make use of virtualized network functions – where routing and switching capabilities are powered by the cloud providers’ virtual machines. For the customer, virtual PoPs don’t require dedicated physical hardware and can be spun up or scaled rapidly – meaning their reach can very quickly reflect real-world user demands.

Challenges and Limitations of PoPs

PoPs are essential for providing fast and secure access to network resources, but implementing and maintaining them introduces new challenges. Organizations must carefully plan their PoP strategies to ensure optimal performance and security without introducing technical limitations or operational challenges.

High Costs: Setting up PoPs involves significant financial investment in hardware, maintenance, and infrastructure. Maintenance and regular updates can also be resource-intensive, requiring specialized personnel and ongoing financial outlays.
Complexity of Management: To benefit from distributed computing resources, you must accept the added complexity of managing multiple PoPs across different geographic locations. It requires constant monitoring and coordination among network nodes, making scalability and network redundancy management another potential issue. PoPs are designed to help scale business operations across different locations. However, adding new users or increasing traffic in a specific location can be a time-consuming, lengthy process, especially when relying on manual configuration.
Latency Issues: Similarly, while PoPs aim to reduce latency, poorly distributed infrastructure and overburdened PoPs can create performance bottlenecks that end up having the opposite effect. Strategic PoP placement based on current and future network requirements helps minimize the likelihood of latency issues that delay data transfers, slow network speeds, and reduce productivity.
Regulatory and Compliance Challenges: PoPs located in different regions fall under different jurisdictions, each with its own data privacy and security regulations. Complying with these regulations can be complex and time-consuming, as organizations navigate the data security requirements of local jurisdictions and adapt their security policies accordingly.
Security Risks: PoPs, while crucial for reducing latency, are vulnerable to cyberattacks. They offer a new entry point for threat actors attempting to infiltrate the network. As we discuss below, PoPs are a vital part of delivering cybersecurity controls at the network edge. However, you must also ensure they don’t introduce their own vulnerabilities. This requires consistent and robust security measures across PoP networks, including the use of firewalls and intrusion detection systems.

Use Cases of PoPs in Cybersecurity

PoPs serve a variety of roles in cybersecurity, helping organizations protect their networks, improve performance, and ensure compliance. Below are several key use cases where PoPs are integral to securing and optimizing infrastructure.

Distributed Denial of Service (DDoS) Mitigation: PoPs are often used to distribute the load during DDoS attacks. By redirecting traffic across multiple PoPs, organizations can better absorb and mitigate the large number of requests from a DDoS attack. Without any single server becoming overwhelmed, you can lessen service disruptions caused by DDoS attacks.
Edge Security: PoPs are deployed closer to the edge of the network to filter malicious traffic before it reaches central infrastructure, reducing the risk of data breaches. This is also vital for edge devices such as the Internet of Things (IoT).
Distributed Traffic Inspection and Filtering: By placing PoPs at strategic locations, organizations can inspect and filter inbound and outbound traffic for malicious content, ensuring that threats are identified and neutralized before they reach critical assets.
Network Redundancy and Failover: PoPs contribute to network resilience by providing backup routes in case of primary route failures. This ensures continued service availability, security controls, and network reliability.
Secure Access Service Edge (SASE) and Zero Trust: PoPs are a fundamental component of SASE architecture, which combines networking and security services in a single cloud-based platform. They enforce zero trust access policies and enforce a variety of SASE security technologies, verifying every user and device at the nearest access point before granting access to resources, moving security beyond traditional network perimeters.

Implement Security Across All Users Everywhere with Check Point

It’s vital that organizations keep all users secured – no matter where they’re connecting from. However, when growing and onboarding new users, it can be difficult to maintain a comprehensive overview of how secure their connections and devices are. Take the guesswork out of your network security with a comprehensive security report from Check Point.

For more proactive defense, Check Point’s SASE provides unified, cloud-delivered PoP in SASE for users anywhere in the world by integrating network security, threat prevention, and secure connectivity into a single platform. At its core, Workspace Security operates through a strategic global network of PoPs, which enforce intelligent security policies that deliver Zero Trust Network Access (ZTNA), alongside advanced threat prevention capabilities – all powered by Check Point’s ThreatCloud AI intelligence.