Debunking Myths About DDoS Attacks: Radware 2011 Global Security Report.

Transcription

1 Debunking Myths About DDoS Attacks: Radware 2011 Global Security Report. Mick Stephens, General Manager - Australia & New Zealand, Radware Ltd. March 2012

2 AGENDA About 2011 Global Security Report Key Findings: Debunking a Myth: Does Size Matter? Hacktivism, the Rise of Anonymous and Attack Campaigns. ERT Case Studies: Cyber Attacks against Israeli websites 2012 Recommendations

3 2011 Global Application & Network Security Report 3

4 Information Resources Radware Security Survey External survey 135 participant organisations 80% are not using Radware DoS mitigation solution ERT Survey Internal survey Unique visibility into attacks behaviour 40 selected cases Customer identity remains undisclosed ERT gets to see attacks in Annual revenue of participants real-time on daily basis 4

5 AGENDA About 2011 Global Security Report Key Findings: Debunking a Myth: Does Size Matter? Hacktivism, the Rise of Anonymous and Attack Campaigns. ERT Case Studies: Cyber Attacks against Israeli websites 2012 Recommendations

6 Debunking a Myth: Is Size all that Matters? DDoS attacks are portrayed in the media using size measures a 10Gbps DDoS attack hit site X an 8 Million packet-per-second DDoS flooded site Y Numbers are easy to understand Should one rely on these numbers when planning network security solutions? 6

7 Size does not matter! Reality: Most organization may never experience an intense attack Less intensive application attacks can cause more damage than network attacks The impact of application flood attacks are much more severe than network flood attacks 76 percent of the attacks surveyed were under 1Gbps 76% of attacks are below 1Gbps 7

8 Network Attack and Application Attack Coexist Radware Security Survey: Attack count by type and bandwidth 8

9 Lessons learned Understand the DoS attack landscape. Type of attacks Megabits-per-second New & concurrent connections-per-second transactions-per-second Size is only one measurement dimension 9

10 Hacktivism and the Rise of Anonymous Cablegate Attack! S T O P Anonymous Opens Fire - Operation Payback, Dec 2010 LOIC DoS Tool 10

11 Anonymous Attacks Grows 11

12 More Organization Are Threatened by DoS 12

13 DDoS Attack tools Become Prevalent Public Attacks LOIC Mobile LOIC webloic Inner Circle Attacks Network Application Flood Low & Slow Vulnerability based UDP Floods SYN Floods Fragmented floods FIN+ACK Dynamic HTTP HTTPS Floods RUDY Slowloris Pyloris Intrusion attempts SQL Injection #refref xerex 13

14 Which Elements Are Bottlenecks For DDoS? Internet link is saturated (27% of the attacks) Stateful devices are vulnerable to DDoS (36% of the attacks) 14

15 Multi-Vulnerability Attack Campaigns Large volume network flood attacks 70% of the 2011 attacks had Business 5 or more attack vectors Large volume SYN flood Connection DoS attacks Directed Application DoS attack: Slowloris HTTP & HTTPS flood attacks 15

16 Lessons learned 1. You may be a target. Financial service providers. ecommerce site Government agency Affiliated with copyright industry National brand 2. Get ready! Be prepared for Multi-Vulnerability Attack Campaigns. Test your security solutions against the tools. 3. Deploy DDoS Protection from your service provider Mitigate volumetric attacks that may saturate your bandwidth 4. Deploy anti-dos and network behavioral technologies on site in front of the firewall To protect your IT infrastructure from becoming bottlenecks 16

17 AGENDA About 2011 Global Security Report Key Findings: Debunking a Myth: Does Size Matter? Hacktivism, the Rise of Anonymous and Attack Campaigns. ERT Case Studies: Cyber Attacks against Israeli websites 2012 Recommendations

18 Cyber Attacks against Israeli websites Course Of Events January 3 rd Saudi hacker 0xOmar leaks tens of thousands Israeli credit card numbers and other personal sensitive information. January 16 th Early Morning 0xOmar and associated Nightmare hacker group sends an to the Jerusalem Post, threatens to attack EL-AL website. 9:30 AM EL-AL, Tel-Aviv Stock Exchange, First International Bank of Israel and Discount Bank websites are attacked and are unavailable for hours. January 17 th Israeli hacker group IDF-Team retaliates by attacking Saudi and UAE s Stock Exchanges websites January 18 th More Israeli websites targeted: Bank of Israel website under attack 18

19 Cyber Attacks against Israeli websites Targets under attack In the following weeks, dozens of Israeli web sites were attacked by these hacker groups A Cyber War emerged.. 19

20 Cyber Attacks against Israeli websites Verified Attackers Attacks were highly distributed Generated by an international collective or a Botnet Geo-IP blocking renders useless 20

21 End-to-end solution countering the DDoS threat SSL attacks Protection On-premises protection against: Application DDoS attacks SSL based attacks Low & Slow attacks Internet ISP Core Network NBA Anti-DoS IPS In-the-cloud Anti-DoS Service Attack Mitigation System Anti-DoS Customer site In-the cloud protection against: Volumetric bandwidth attacks Attack Mitigation System 21

22 AGENDA About 2011 Global Security Report Key Findings: Debunking a Myth: Does Size Matter? Hacktivism, the Rise of Anonymous and Attack Campaigns. ERT Case Studies: Cyber Attacks against Israeli websites 2012 Recommendations

23 ERT recommendations to fight DoS/DDoS attacks: Understand the DoS threat landscape Recommendations Collect information about the tools and types of attacks. Perform risk analysis at the business level. Make sure your service provider can mitigate volumetric attacks. Deploy Anti-DoS and Network Behavioral technologies onpremises. 23

24 Thank You