[Restricted] ONLY for designated groups and individuals Check Point Software Technologies Ltd.

Transcription

1 [Restricted] ONLY for designated groups and individuals

2 Contents Industry Trends DDoS Attack Types Solutions to DDoS Attacks Summary 2

3 Cybercrime Landscape DNS Hijacking Malware 3% 3% Targeted attack (Various tools) 7% iframe Injection 1% Other 7% DDoS 28% Account Hijacking 11% Defacement 17% SQLi 23% Source: 2014 Cyber Attacks Trends, Hackmagedon 28% of all cyber attacks in 2014 involved a DoS/DDoS attck 3

4 What is DoS? Denial-of-Service attack (DoS attack) an attempt to make a machine or network resource unavailable to its intended users. Distributed Denial-of-service attack (DDoS) is coordinated and simultaneously launched from multiple sources 4

5 DDoS Attack Examples Volumetric Attacks Fill the pipe DNS Amplification Attacks Using critical applications as attack source SYN Attacks Simple way to use resources Application Attack Renegotiate SSL Key 5

6 Volumetric Attacks Mixture of Valid Traffic and Spoofed Traffic Limited Pipe Attack Target Victim 6

7 DNS Amplification Attack Example Attacker Open DNS Server Attack Target Simple DNS Request Able to amplify DNS request to victim Victim 7

8 SYN Attacks Spoofed Traffic, Random Sources Random SYN Packets Attack Target Utilize State Table on Firewalls and Servers Victim 8

9 Application Layer DDoS Attacks Application Attacks Are Stealthier Exploit application weakness with Low&Slow attacks Utilize relatively low volume and fewer connections Used in conjunction with volume-based attacks Undetectable by threshold or volume-based solutions 9

10 Application Attacks Examples SSL Login Attack Really Simple Thousands of login requests to web login page, consuming web and database resources Network and Server Resource Consumption Repeated PDF Get Attack Find a large PDF and download it thousands of times 10

11 Amaze your friends & colleagues (not) 11

12 Cost of Damage Per Attack IT equipment failure Cyber crime (DDoS) UPS system failure Water, heat or CRAC failure Generator failure Weather related $0 $200 $400 $600 $800 $1,000 $1,200 K Source: 2013 Cost of Data Center Outages, Ponemon Institute, Dec $822,000 cost of a single DoS/DDoS attack that causes unplanned outage 12

13 Victims of Recent DDoS Attacks 13

14 DDoS Attack Results Amazon.com s 40 minute outage = $5 million in lost sales. (VentureBeat, August 2013) 1 second delay in page loading 3.5% decrease in conversion rate 2.1% decrease in shopping cart size 9.4% decrease in page views 8.4% increase in bounce rate Source: Strangeloop Networks, Case Study: The impact of HTML delay on mobile business metrics. 14

15 Today s Attacks Are More Sophisticated A More DDoS attacks today than ever before B More damage with application attacks C No need to flood network bandwidth 15

16 Diversity of Attacks Vectors Distribution of attack vectors More than 50% of 2013 DDoS attacks had more than 5 attack vectors. Source: Radware ERT Report, Jan. 27, 2014 Over 50% of attacks use more than 5 attacks vectors 16

17 The Right DDoS Solution Should Have Network Layer Protection Adaptable Application Layer Protection Fast Response Time 17

18 Check Point DDoS Protector Block Denial of Service Attacks Within Seconds! 18

19 Multi-Layered Protections Network Flood Server Flood Application Low & Slow Attacks Network High volume of behavioral packets analysis High rate Connection of new verification sessions Web / DNS Behavioral connectionbased HTTP and DNS attacks Advanced Signature attack protections techniques DoS Mitigation Engine (DME) blocking up to 25M PPS Preventing misuse of resources User auth through advanced challengeresponse String Match Engine (SME) L7 RegEx acceleration 20

20 Multi-Layer Protections Application HTTP Flood Protection Server SYN Protection DDoS Protector Network Behavioral DoS Anti-Scanning Available Service DNS Protection Connection Limit Out-Of-State Signature Protection Connection PPS Limit BL/WL 21

21 DDoS Protector Detect Patented behavioral detection Network floods Application attacks: HTTP GET / POST, Low & Slow Mitigate Immediate, Automatic, no need to divert traffic Generates real-time signature Distinguish between attackers and legitimate users Best quality of experience even under attack Powerful using dedicated hardware up to 25M PPS Analyze Denial of Service Event Analysis Historical reports Forensics Trend analysis 25

22 DDoS Protector Platforms DP X420 Family: Up to 40 Gbps throughput 6M concurrent sessions 25 Mpps max DDoS flood attack rate DP X412 Family: Up to 12 Gbps throughput 4M concurrent sessions 10 Mpps max DDoS flood attack rate DP X06 Family: Up to 2 Gbps throughput 2M concurrent sessions 1 Mpps max DDoS flood attack rate String Match Engine (SME) Improved protection from known DDoS attack tools for superior continuity of service Accelerated Layer7 signature protection to quickly mitigate advanced attacks Simplified Adaptable Application Layer Protections - custom protections made easier 26

23 Appliance Specifications X06 and X412 Model DP 506 DP 1006 DP 2006 DP 4412 DP 8412 DP Capacity 0.5Gbps 1Gbps 2Gbps 4GBps 8Gbps 12Gbps Max Concurrent Sessions Max DDoS Flood Attack Protection Rate Latency 2 Million 4 Million 1 Million packets per second 10 Million packets per second <60 micro seconds Real-Time Signatures Detect and protect against attacks in less than 18 seconds 27

24 Appliance Specifications X420 Model DP DP DP DP Capacity 10Gbps 20Gbps 30Gbps 40Gbps Max Concurrent Sessions 6 Million Max DDoS Flood Attack Protection Rate 25 Million packets per second Latency <60 micro seconds Real-Time Signatures Detect and protect against attacks in less than 18 seconds 28

25 Flexible Deployment Options Ready to Protect in Minutes Fits to Existing Network Topology Optional Learning Mode Deployment Low Maintenance and Support 29

26 Where to Protect Against DDoS Scenarios: On-Premise Deployment DDoS Protector Appliance + Off-Site Deployment DDoS Protector Appliance 30

27 But what about those Volumetric Attacks 31

28 On Premise Mitigation ISP On-premise DDOS Protector mitigates the attack X On Premise Mitigation Fastest Time To Protection Protect against advanced attacks (low and slow) Detailed forensics and visibility DDOS Protector Protected Online Services Protected Organization Any on-premise solution cannot handle pipe saturation 32

29 Cloud Based Mitigation Cloud Scrubbing Center ISP X Protected Online Services Protected Organization Cloud Based Mitigation Routes all traffic to Cloud service when under attack. Protects against high volume DDOS attacks Longer Time to Mitigation: Identify, Divert, Mitigate Only protects against high volume DDOS attacks 33

30 DefensePipe in action 1 On Premise DDoS Protector protects in seconds and profiles the attack traffic Scrubbing Center DDOS Protector Protected Online Services Protected Organization 34

31 X DefensePipe in action 1 On Premise DDoS Protector protects in seconds and profiles the attack traffic 2 Attack profile sent to cloud for seamless protection handover Attack volume grows Scrubbing Center Defense Messaging DDOS Protector Protected Online Services Protected Organization 35

32 X DefensePipe in action 1 On Premise DDoS Protector protects in seconds and profiles the attack traffic 2 Attack profile sent to cloud for seamless protection handover Scrubbing Center 3 Traffic is routed to DefensePipe scrubbing center DDOS Protector Protected Online Services Protected Organization 36

33 DefensePipe in action 1 On Premise DDoS Protector protects in seconds and profiles the attack traffic 2 Attack profile sent to cloud for seamless protection handover Scrubbing Center 3 Traffic is routed to DefensePipe scrubbing center 4 Legitimate traffic forwarded to customer site and service restored Protected Online Services DDOS Protector Protected Organization 37

34 DefensePipe Activation When an Attack Starts On Premise DDOS Protector mitigates attacks in real-time Defense Messaging DDOS Protector sends attack profile Defense Messages to DefensePipe Once diverted, the attack is immediately mitigated accurately no learning curve Traffic Diversion BGP or DNS Customer approves traffic divert to the cloud Attack is handled with the customer from inception 38

35 Look for Help Check Point DDoS Solutions include access to DDoS Specialists when under attack! This is included in the support contract You are not alone Check Point can help you [Restricted] ONLY for designated groups and individuals 39

36 Check Point Can Help you Check Point Incident Response Team [Restricted] ONLY for designated groups and individuals 40

37 Integrated Security Management Unified Logs and Monitoring and Unified Reporting Leverage SmartView Tracker, SmartLog and SmartEvent for historic and real-time security status 41

38 Summary Blocks DDoS Attacks Within Seconds Customized multi-layered DDoS protection Ready to protect in minutes Integrated with Check Point Security Management [Restricted] ONLY for designated groups and individuals 42

39 THANK YOU [Restricted] ONLY for designated groups and individuals