Arbor s Solution for ISP

Size: px

Start display at page:

Download "Arbor s Solution for ISP"

Bernard Jacobs
8 years ago
Views:

1 Arbor s Solution for ISP

2 Recent Attack Cases

3 DDoS is an Exploding & Evolving Trend More Attack Motivations Geopolitical Burma taken offline by DDOS attack Protests Extortion Visa, PayPal, and MasterCard attacked Techwatch weathers DDoS extortion attack Greater Availability of Botnets Better Bots Easy Access More infected PCs with faster connections Using web 2.0 tools to control botnets Commoditized Cloud-based botnets, cheaper more attacks Increased Volume Increased Complexity Increased Frequency Largest volumetric DDoS has grown from 9 to 100 Gbps in 5 years Over 25% of attacks are now application-based DDoS mostly targeting HTTP, DNS, SMTP >50% of data center operators experience >10 attacks per month Largest single DDos Attack Observed per Year in Gbps Largest 7 DDos Attacks Against IDC Average Number of DDos Attacks per Month 4

4 Arbor Network

5 Who is Arbor Networks? A Trusted & Proven Vendor Securing the World s Largest and Most Demanding Networks 90% Tbps #1 12 Percentage of world s Tier 1 service providers who are Arbor customers Number of countries with Arbor products deployed Amount of global traffic monitored by the ATLAS security intelligence initiative right now 25% of global Internet traffic! Arbor market position in Carrier, Enterprise and Mobile DDoS equipment market segments 61% of total market [Infonetics Research Dec 2011] Number of years Arbor has been delivering innovative security and network visibility technologies & products 6 $16B 2011 GAAP revenues [USD] of Danaher Arbor s parent company providing deep financial backing

6 Sampling of Arbor s Customers vodaphone * These customers have given Arbor Networks authorization to use their names publicly. Over 300 customers use Peakflow SP & TMS today.

7 ASERT Arbor Security Engineering Research Team

8 Malware Analysis Example CnC For ATF/Peakflow SP: study bot-to-cnc traffic to alert on infected clients Bot/CnC comms For AIF/Pravail: study bot-to-victim DDoS traffic to distinguish legit web requests from HTTP flood requests Victim Web Server New Malware Specimen ASERT Sandbox HTTP Flood traffic

9 Arbor DDoS Solution

10 12 DDoS Attack? It WILL Happen

11 300Gbps of DDoS Attack!!

12 The DDoS Attack Surface Any part of your network or services that is vulnerable to an attack Network Interfaces Infrastructure Firewall/IPS Servers Protocols Applications Databases Attackers will find the weakness 14

13 The Broad Impact of DDoS Attacks Modern DDoS Attacks Are Complex & Diverse IPS Load Balancer DATA CENTER Attack Traffic Good Traffic Today s DDoS attacks can cause (1) saturation upstream, (2) state exhaustion, or (3) service outages many times a single attack can result in all three and all with the same end result: 15 critical services are no longer available!

Stopping Volumetric Attacks ISP 1 SCRUBBING CENTER Peakflow SP/TMS Cloud-based DDoS Protection DATA CENTER ISP 2 ISP Firewall IPS Load Balancer ISP n

14 Stopping Volumetric Attacks ISP 1 SCRUBBING CENTER Peakflow SP/TMS Cloud-based DDoS Protection DATA CENTER ISP 2 ISP Firewall IPS Load Balancer ISP n Cloud-based: Volumetric DDoS mitigation must be done up stream, before traffic gets to Data Center Activated on demand : only active when an attack is detected or reported 18

15 How it all works? (Peakflow SP/TMS)

16 Step 1: Have Visibility (x-flow based) Service Provider s Core Arbor Peakflow CP Peering Point POP Mobile Subscriber Network Core Router Peering Point POP Enterprise A Targeted Enterprise B

17 Comprehensive Dashboards

Applications, Peers, Fingerprints, Markets, Alerts Router: Per router stats, Top

18 Traffic & Application Network: Top peers, ASNs, Countries, Cities Applications, Fingerprints, Growth Application: Customers, Ports, Peers, Markets Customer: Applications, Peers, Fingerprints, Markets, Alerts Router: Per router stats, Top Interfaces, Applications, Customers Benefits Better informed, more timely operations management

Cost Optimized Peering and Transit Transit reports Peer traffic exchange reports Peering what if analysis Interface reports Source and Destination Analysis Where is traffic going when it comes IN?

19 Cost Optimized Peering and Transit Transit reports Peer traffic exchange reports Peering what if analysis Interface reports Source and Destination Analysis Where is traffic going when it comes IN? Where has traffic come from when it goes OUT? How much in transit costs is customer A costing me? How much money will I save if I peer with XYZ? View where your customers traffic is truly destined Make intelligent decisions about peering expansions Assure that existing peering agreements are being used to their full potential Ensure that transit customers are abiding by service agreements like no-resell agreements

country Identify growth markets Measure service usage by city A New Dimension of

20 Global Geography Reporting Reports and tracking by country, region, city Track threat sources Country baselines and alerts Allow, drop, shape traffic based on country Identify growth markets Measure service usage by city A New Dimension of Network Intelligence Benefits Better threat response Better market analysis Better planning

reports Real-time packet visibility Alerts on service changes Track baseline service levels Benefits Identify

21 Service Visibility Measure application usage Track Key Performance Indicators (KPIs): Jitter latency RTT 90 predefined applications Customer defined applications Top URL reports VoIP call reports Comprehensive DNS reports Real-time packet visibility Alerts on service changes Track baseline service levels Benefits Identify and address problems before users start to complain Reduce help desk calls Better business and operations planning

cities) Identify top applications, top ports Protection and reporting for mobile and

22 Subscriber Visibility Identify infected subscribers Track # of infected subscribers Track individual and aggregate subscriber traffic Identify top markets (IP Location cities) Identify top applications, top ports Protection and reporting for mobile and fixed networks Benefits Keep malicious traffic off the network Protect subscribers Serve markets better

23 The Attack Service Provider s Core Peering Point Arbor Peakflow CP Core Router 1- Detect POP 2 - Activate Mobile Subscriber Network Peering Point Surgical Mitigation Center POP 3 Divert only target s traffic Enterprise A Targeted Enterprise B

24 The Mitigation Service Provider s Core Arbor Peakflow CP Peering Point Arbor Peakflow CP POP Mobile Subscriber Network Core Router Peering Point 5 Forward the legitimate: GRE, MPLS, Surgical Mitigation Center POP Enterprise A Targeted 4 Identify and filter the malicious Enterprise B

25 Multiple Countermeasures for Multiple Attacks Vulnerability Exploits Generic Flood Attacks Fragmentation Attacks Application Attacks TCP Stack Flood Attacks Static & Dynamic Packet Filters Anti-Spoofing Mechanisms Baseline Enforcement Botnet screening Layer 7 Protections Rate-limiting

26 Service and Application Layer Protection HTTP / Web 2.0 Protection Block malformed HTTP Rate-limit HTTP requests Stop click fraud Stop low and slow attacks SSL Protection Neutralize SSL signaling protocol attacks VoIP Protection Block malformed SIP packets SIP request limiting DNS Protection DNS Regular Expressions (RegEx) DNS Authentication/Anti-Spoofing DNS Query Rate Limiting DNS Non-Existent Domain (NXDOMAIN) Rate Limiting DNS Reporting and Packet Sampling IP-based Protection Packet scrubbing (TCP / UDP/ ICMP) TCP Connection reset White list / black list Benefits Protect business critical applications from targeted attacks

27 Arbor s Unique Solution The Solution to Stop Advanced Threats Built on Global Network Visibility & Security Intelligence Global & Enterprise Visibility Know Your Network No Matter Where It Resides Security Intelligence Find the Threat No Matter Where the Threat Lurks Availability Protection Protect the Business at All Times A World-Class Research Team (ASERT) Analyzing all the World s Internet Traffic (ATLAS) to Stop Emerging Advanced Threats 32

28 Thank You

Security Solutions for the New Threads

Security Solutions for the New Threads We see things others can t Pablo Grande Sales Director, SOLA pgrande@arbor.net What a CISO Is Looking For Show Progress on Response Time Measurably improve our incident