JUNOS DDoS SECURE. Advanced DDoS Mitigation Technology

Transcription

1 JUNOS DDoS SECURE Advanced DDoS Mitigation Technology

2 Biography Nguyen Tien Duc Consulting Engineer- Viet Nam CISSP # CISA # Copyright 2013 Juniper Networks, Inc.

3 SECURITY AT JUNIPER Customer segments Service Providers, Enterprise Business segments Routing, Switching, Security Security innovation & leadership Invest more than 20% of revenue on R&D Leader in high-end firewalls and remote access SSL VPN Pioneer in Intrusion Deception technology DDoS advanced technology First to deliver purpose-built virtual firewall SC Magazine 2014 best cloud, UTM and NAC solution Tech Target s 2013 reader s choice gold awards for virtual security, IDP, and NAC 3 Copyright 2013 Juniper Networks, Inc. Access Apps Networks Mgmt Mobility Edge Data center Cloud Products

4 DDOS ATTACK VECTORS VOLUMETRIC Easy to detect. Attacks are getting bigger in size Frequency of attacks increasing at a moderate rate. ANYTHING THAT MAKES THE RESOURCES BUSY Flash mobs. Legitimate requests for a big event available at one time. SLOW AND LOW Growing faster than volumetric 25% of attacks in 2013 (source: Gartner) More sophisticated & difficult to detect Target back-end weaknesses Small volume of requests can take out a large web site. 4 Copyright 2013 Juniper Networks, Inc.

5 TUTORIALS ON LAUNCHING DDOS ATTACKS 5 Copyright 2013 Juniper Networks, Inc.

6 LOW ION ORBIT CANNON (LOIC) Flood any site Easy to download Simple to run 6 Copyright 2013 Juniper Networks, Inc.

7 DDOS FOR ONE HOUR COSTS $5 7 Copyright 2013 Juniper Networks, Inc.

8 Stealth EVOLVING ATTACK COMPLEXITY Signature-Based Scrubbers Volumetric Low-and-slow Challenge: Creating signatures for new attacks Emerging Battleground Challenge: manual management of IP thresholds in dynamic networks Thresholds & Netflow Analysis Known Newness Unknown 8 Copyright 2013 Juniper Networks, Inc.

9 THE GAPS THAT DDOS SECURE ADDRESSES 1 New attacks: before the signature exists 2 Low-and-slow application attacks 9 Copyright 2013 Juniper Networks, Inc.

10 KEY CONCEPT: CHARM CHARM: Real-time risk score for each source IP 100 Initial 50 Human-like Per packet Simple example: real human traffic typically bursty and irregular; machine/bot traffic is regular 0 Machine-like Algorithms updated regularly with characteristics of new attacks 10 Copyright 2013 Juniper Networks, Inc.

11 Examples KEY CONCEPT: RESOURCE HEALTH Resource health: real-time view of status for every discrete thing on protected interface, based on stateful analysis of source and resource responsiveness Internet Traffic Internet Traffic Resources Internet Traffic DDoS Secure L7 DNS/URL Response Time URL Rate, Pending counts HTTP Server Error Codes L3-4 Backlog Queue (per resource, per port) TCP stats: SYN, SYN-ACK, CLS, RST, etc 11 Copyright 2013 Juniper Networks, Inc.

12 JUNOS DDoS SECURE RESOURCE MANAGEMENT Resource Control The In this attack example, traffic to Resource 2 s reduces response as the time attackers starts to switch degrade the and attack the CHARM to Resource pass threshold 3. is increased to start the process of rate Once limiting again, the bad Junos traffic. DDoS Secure responds dynamically At this point by the increasing good traffic the will pass continue threshold to pass for Resource unhindered 3 whilst Limiting the bad traffic. attackers will start to believe their attack has been successful as their request fails. Resource 1 Resource 2 Resource 3 Resource N 12 Copyright 2013 Juniper Networks, Inc.

13 JUNOS DDoS SECURE PACKET FLOW SEQUENCE CHARM Technology Resource Control IP Behavior Table Resource CHARM Threshold 1 Validates data packet Validates against defined filters Validates packet against RFCs Validates packet sequencing TCP Connection state 3 Behaviour is 4 Calculates recorded CHARM Threshold Supports up to 32M profiles Profiles aged on least used basis Responsiveness of Resource Packet Enters Syntax Screener OK So Far CHARM Generator With CHARM Value CHARM Screener Packet Exits Drop Packet 2 Calculates CHARM value for data packet References IP behaviour table Function of time and historical behaviour Better behaved = better CHARM 5 Drop Packet Allow or Drop CHARM Threshold CHARM value 13 Copyright 2013 Juniper Networks, Inc.

14 HEURISTIC MITIGATION IN ACTION Normal Internet Traffic Normal Internet Traffic DDoS Attack Traffic Resources Normal Internet Traffic Junos DDoS Secure Heurisitc Analysis DDoS Attack Traffic Management PC Normal Internet traffic flows through the Junos DDoS Secure Appliance, while the software analyses the type, origin, flow, data rate, sequencing, style and protocol being utilized by all inbound and outbound traffic. The analysis is heuristic in nature and adjusts over time but is applied in real time, with minimal (store and forward) latency. 14 Copyright 2013 Juniper Networks, Inc.

15 LOW AND SLOW ATTACKS What to say about DDoS Secure and Topology DDoS Secure is an in-line device, usually deployed at the data center edge (behind internet facing router, in front of firewall) DDoS Secure performs real-time stateful analysis and heuristics of packets, both inbound and outbound, as they pass Source IP addresses are given a real-time risk score called CHARM Resource health (web server, firewall, etc) is monitored and have a CHARM threshold Once resource starts to struggle, threshold is raised, and packets with a lower CHARM score are rate limited One website is in logging mode so we can see the results of the attack. The other website is in defending mode so we can see how the attack is mitigated. 15 Copyright 2013 Juniper Networks, Inc.

16 VOLUME ATTACK What to say: Once again, DDoS Secure is sitting inline behind the router. Attacker is sending traffic to the web server (but it could also be the customer s firewall or load balancer) and is attempting to overwhelm the customers network pipe But DDoS Secure will detect the attack, and will signal the upstream router to redirect the traffic so that the network is not saturated 16 Copyright 2013 Juniper Networks, Inc.

17 JUNOS DDoS SECURE SUMMARY Defined Outstanding 24/7 support 80% Effective 10 mins after installation % effective after 6-12 hours Virtualized options available Dynamic Heuristic Technology Multi Tenanted and fully IPv6 compliant 1Gb to 10Gb HA appliances No Public IP address Layer 2 Transport Bridge 17 Copyright 2013 Juniper Networks, Inc.

18