Building an Early Warning System in a Service Provider Network
|
|
|
- Phillip Rice
- 10 years ago
- Views:
Transcription
1 Building an Early Warning System in a Service Provider Network Nicolas FISCHBACH Senior Manager, IP Engineering/Security - COLT Telecom [email protected] - version 1.1
2 Building an Early Warning System in a Service Provider Network Nicolas FISCHBACH Senior Manager, IP Engineering/Security - COLT Telecom [email protected] - version 1.1
3 Agenda» What are ISPs/NSPs looking for?» Honeynet-like sensors > Routers as honeypots > DDoS detection with honeybots > Traffic diversion to honeyfarms» Other information sources > System data > Security data > Network data» Early Warning System > Putting all the information bits together» Conclusion 3
4 DDoS, Worms and the Underground» MEECES an acronym for > Money > Ego > Entertainment > Cause > Entrance into social groups > Status» Max Kilger (Honeynet Project) > Applies to the underground/ hacker /blackhat community > INTEL agencies MICE (Money, Ideology, Compromise, Ego) 4
5 DDoS, Worms and the Underground» What have we seen up to now > Cause/Hacktivism: - Web site defacement - DDoS (SCO, WU/MSFT, etc) > Ego/Status: - I have more (network) power than you - I m not going to loose that item in <online game> > Entertainment - Hey look, I just DoSed <favorite IRC user/website> > Entrance into a social group - Wanna trade this botnet? 5
6 DDoS, Worms and the Underground» What have we seen up to now > Money: - BGP speaking routers - SPAM, botnets, open proxies, etc. - C/C numbers incl. personal information, ebay accounts, etc.» Where are we today? Real money > Pay or get DDoSed > Worms for SPAM > Organized crime using real world proven ways of making money on the Internet > Targets: online business, mainly gaming/gambling/betting sites nowadays 6
7 DDoS, Worms and the Underground» Where are we today > Loosing a botnet isn t a tragedy > Mass-acquisition tools are mandatory > Protect your property (host and communication channel) - Control channel over IRC/P2P/not so common protocols/ipv6 (anonymous) - Secure the host to avoid multiple zombies/agents > Not for fun on free time anymore (people with network and DoS filtering technology/techniques skills) > The skills, knowledge, organization and hierarchy are not different/worse in the blackhat world anything but not the chaotic world we all expect 7
8 DDoS, Worms and the Underground» Where are we today > A few hundred/thousand dollars/euros is a yearly salary in poor countries > AP and SA are the main sources, not (just).ro anymore > Usually good education, leaving in a country with a high number of unemployed people > Most of the communications are in-band (Internet), out-ofband is limited to hacker meetings or local phone calls > Do you have the resources to analyze TBs a day of IRC logs coming from compromised hosts/honeypots (in x different languages)? 8
9 DDoS, Worms and the Underground» A vulnerability s life cycle: worm or not? Victims Proof of Concept Automated Noise Exploit PoC + Exploit + Worm? Time Vulnerability found Vulnerability found again Disclosure bad patch Patch available Patch deployed > Key: is the exploit generic? [Messenger vs LSASS] Full/fixed patch 9
10 What are ISPs/NSPs looking for?» An EWS in a large network > Detect - DDoS attacks - (Unknown) worms - SPAM - Covert channels - Hacked system - Open proxies - Scans > Detect it early! > Cover a large network - Distributed approach, bandwidth/pps requirements and system performance > Easy to detect/fingerprint? 10
11 What are ISPs/NSPs looking for?» An EWS in a large network > Lots of data > Information sources - Honey* sensors - Systems and Applications - Security devices - Network» Quick BGP - MPLS - Netflow - DDoS - Honeypot 11
12 Honeyrouters» Routers as honeypots > BGP speaking routers > Traded in the underground: more value than ebay accounts or valid CC numbers - Makes them good targets > Password policy issue - Are miscreant just scanning for open telnet/ssh or brute force the login and try out commands? > BGP route injection: DDoS attack or SPAM? 12
13 Honeyrouters» Network architecture internet BGP session filter honey tacacs AAA 13
14 Honeyrouters» Using honeyd > Cisco CLI/telnet script > SNMP script» Using an UNIX+Zebra > Cisco-like CLI» Using a Cisco router > Real BGP feed - read-only BGP session > Real fake account - AAA and TACACS+ > Real network connectivity - IP filtering and rate-limiting 14
15 Honeybots» DDoS attack detection with honeybots/honeyzombies > DDoS attack detection - Netflow, ACLs, SNMP, etc. > Other SPs DDoS detection - Backscatter data - Honeybots. 0) Infected host post-mortem/forensics. 1) Run bots and DDoS agents/zombies in a sandbox. 2) Watch IRC, P2P, control channel communications 15
16 Honeybots» Network Architecture ircd/p2p command/control channel internet filter host malware (ddos agent/zombie) 16
17 Honeyfarms» Traffic diversion to honeypots ibgp route bgp edge internet MPLS LSP filter honeypot honeypot edge traffic flow honeypot 17
18 Honeyfarms» Traffic diversion to honeypots > Easy traffic rerouting > May be invisible > Limitations - RTT/TTL may change - Overhead (L2TP and especially GRE/IPIP) > Use low-interaction honeypots - Basic TCP/UDP listeners, no real active response - honeyd > Avoid high-interaction (unless you have time and resources) > Established sessions - p0f v2: learn what the source may run on 18
19 System Data» System information sources > Exposed services - SMTP (mail server/relay): virus@mm - DNS (authoritative/caching): Zonelabs/TAT14 - HTTP (portal/cache) > System logs 19
20 System Data» What not to do (at least not as an SP) > Use honeypots/fake open relays to detect and fight SPAM - Risk of ending up in RBLs > Use open proxies to detect surfing, phising, etc. > Use honeypots/honeybots to bite back and clean up attacking systems: Active Defense - Legal issues - Not customers and even if they are AUP? - Usually causes more harm than good! > But an interesting approach inside an IT network - Automated network management - Perimeter is defined 20
21 Security Data» Security information sources > Firewalls > xids > Anti-virus > Security logs 21
22 Network Data» Network information sources > Routers - ACLs - urpf and interface counters - Requires a mix of scripts and SNMP polling > Traffic - Netflow. Header (src/dst IP, src/dst port, protocol, ingress interface, ToS but exports TCP flags, ASN, etc) and inbound only - Full traffic dump (RMON/SPAN/RTE/tap) in specific locations (hosting center upstreams, DSL/dial aggregation, etc) - Dark IP space - Sinkholes 22
23 Network Data» Network information sources > Routing - BGP updates - Route-server - Projects. RIPE RIS. Netlantis 23
24 Netflow and BGP» Network Architecture tr SOC ixpr tr collector controller collector ccr ar Router types Edge Access ppr ccr ar Flows (Sampled) Netflow and R/O BGP session Aggregated Netflow and BGP information (SNMP) Alerts 24
25 Dark IP space/sinkholes» Network Architecture customer bgp internet filter unallocated network traffic sinkhole customer customer 25
26 Dark IP space/sinkholes» Collecting backscatter data Bad guy Master agent Victim (s) Slave agents (zombies, bots) Owned host Third parties [backscatter] 26
27 Dark IP space/sinkholes» Setup > BGP speaking router - Route-reflector - Full ibgp mesh > Announce PA/PI allocations > Non-allocated/unused prefixes routed to the sinkhole/darkip monitor > More-specific route followed for allocated (customer space) > Dynamic (add/remove) - Take the prefixes history into account. Ceased customers. Allocation method (dial/dsl): lots of short term noise > Central or distributed/regional deployment? - IP Anycast 27
28 Dark IP space/sinkholes» Data analysis > What kind of information will you get? > How to identify backscatter from other (rogue) traffic 28
29 Early Warning System» EWS > Share/reuse data with/from your SOC (SIM/SEM) central syslog server applications logs security logs and events network sources honey* sources aggregate/correlate lookup display/alert search SIM/SEM 29
30 Early Warning System» EWS > Which data have value? - High value - Low value > Use the human eye to catch anomalies > Challenge: how to display and visualize data» Can be deployed and useful inside an IT network» Don t put your network at risk by deploying these sensors 30
31 Conclusion» Conclusion» See also > Backbone and Infrastructure Security Presentations - > (Distributed) Denial of Service Presentations - Q&A» Thanks > Lolo, Phil, Marc, Lance, Jose and Toby Image: 31
Project Proposal Active Honeypot Systems By William Kilgore University of Advancing Technology. Project Proposal 1
Project Proposal Active Honeypot Systems By William Kilgore University of Advancing Technology Project Proposal 1 Project Proposal 2 Abstract Honeypot systems are readily used by organizations large and
HOW TO PREVENT DDOS ATTACKS IN A SERVICE PROVIDER ENVIRONMENT
HOW TO PREVENT DDOS ATTACKS IN A SERVICE PROVIDER ENVIRONMENT The frequency and sophistication of Distributed Denial of Service attacks (DDoS) on the Internet are rapidly increasing. Most of the earliest
Securing the system using honeypot in cloud computing environment
Volume: 2, Issue: 4, 172-176 April 2015 www.allsubjectjournal.com e-issn: 2349-4182 p-issn: 2349-5979 Impact Factor: 3.762 M. Phil Research Scholar, Department of Computer Science Vivekanandha College
Tunisia s experience in building an ISAC. Haythem EL MIR Technical Manager NACS Head of the Incident Response Team cert-tcc
Tunisia s experience in building an ISAC Haythem EL MIR Technical Manager NACS Head of the Incident Response Team cert-tcc 1 Agenda Introduction ISAC objectives and benefits Tunisian approach SAHER system
Security Toolsets for ISP Defense
Security Toolsets for ISP Defense Backbone Practices Authored by Timothy A Battles (AT&T IP Network Security) What s our goal? To provide protection against anomalous traffic for our network and it s customers.
How to build and use a Honeypot. Ralph Edward Sutton, Jr. DTEC 6873 Section 01
How to build and use a Honeypot By Ralph Edward Sutton, Jr DTEC 6873 Section 01 Abstract Everybody has gotten hacked one way or another when dealing with computers. When I ran across the idea of a honeypot
Putting the Tools to Work DDOS Attack
Putting the Tools to Work DDOS Attack 1 DDOS = SLA Violation! Hacker ISP CPE Target What do you tell the Boss? SP s Operations Teams have found that they can express DDOS issues as SLA violations, which
Multifaceted Approach to Understanding the Botnet Phenomenon
Multifaceted Approach to Understanding the Botnet Phenomenon Christos P. Margiolas University of Crete A brief presentation for the paper: Multifaceted Approach to Understanding the Botnet Phenomenon Basic
AT&T Real-Time Network Security Overview
AT&T Real-Time Network Security Overview Dan Solero Director of Security Technology, AT&T Know Your Enemy: Security Threats Extend Beyond Viruses & Worms Distributed Denial of Service Spam for Hire Social
About Botnet, and the influence that Botnet gives to broadband ISP
About net, and the influence that net gives to broadband ISP Masaru AKAI BB Technology / SBB-SIRT Agenda Who are we? What is net? About Telecom-ISAC-Japan Analyzing code How does net work? BB Technology
Detecting peer-to-peer botnets
Detecting peer-to-peer botnets Reinier Schoof & Ralph Koning System and Network Engineering University of Amsterdam mail: [email protected], [email protected] February 4, 2007 1 Introduction Spam,
DDoS Protection. How Cisco IT Protects Against Distributed Denial of Service Attacks. A Cisco on Cisco Case Study: Inside Cisco IT
DDoS Protection How Cisco IT Protects Against Distributed Denial of Service Attacks A Cisco on Cisco Case Study: Inside Cisco IT 1 Overview Challenge: Prevent low-bandwidth DDoS attacks coming from a broad
Global Network Pandemic The Silent Threat Darren Grabowski, Manager NTT America Global IP Network Security & Abuse Team
Global Network Pandemic The Silent Threat Darren Grabowski, Manager NTT America Global IP Network Security & Abuse Team The Internet is in the midst of a global network pandemic. Millions of computers
Network Security Monitoring and Behavior Analysis Pavel Čeleda, Petr Velan, Tomáš Jirsík
Network Security Monitoring and Behavior Analysis Pavel Čeleda, Petr Velan, Tomáš Jirsík {celeda velan jirsik}@ics.muni.cz Part I Introduction P. Čeleda et al. Network Security Monitoring and Behavior
Honeypots / honeynets
Honeypots / honeynets presentatie naam 1 Agenda Honeypots Honeynets Honeywall presentatie naam 2 Traffic Problem: Vast quantities of normal traffic Find suspect bits presentatie naam 3 Honeypot Machine
Security workshop Protection against botnets. Belnet Aris Adamantiadis Brussels 18 th April 2013
Security workshop Belnet Aris Adamantiadis Brussels 18 th April 2013 Agenda What is a botnet? Symptoms How does it work? Life cycle How to fight against botnets? Proactive and reactive NIDS 2 What is a
Botnets. Botnets and Spam. Joining the IRC Channel. Command and Control. Tadayoshi Kohno
CSE 490K Lecture 14 Botnets and Spam Tadayoshi Kohno Some slides based on Vitaly Shmatikov s Botnets! Botnet = network of autonomous programs capable of acting on instructions Typically a large (up to
Hunting down a DDOS attack
2006-10-23 1 Hunting down a DDOS attack By Lars Axeland +46 70 5291530 [email protected] 2006-10-23 What we have seen so far What can an operator do to achieve core security What solution can
Stop DDoS Attacks in Minutes
PREVENTIA Forward Thinking Security Solutions Stop DDoS Attacks in Minutes 1 On average there are more than 7,000 DDoS attacks observed daily. You ve seen the headlines. Distributed Denial of Service (DDoS)
BUILDING A SECURITY OPERATION CENTER (SOC) ACI-BIT Vancouver, BC. Los Angeles World Airports
BUILDING A SECURITY OPERATION CENTER (SOC) ACI-BIT Vancouver, BC. Los Angeles World Airports Building a Security Operation Center Agenda: Auditing Your Network Environment Selecting Effective Security
Computer Security CS 426 Lecture 36. CS426 Fall 2010/Lecture 36 1
Computer Security CS 426 Lecture 36 Perimeter Defense and Firewalls CS426 Fall 2010/Lecture 36 1 Announcements There will be a quiz on Wed There will be a guest lecture on Friday, by Prof. Chris Clifton
Contents. vii. Preface. P ART I THE HONEYNET 1 Chapter 1 The Beginning 3. Chapter 2 Honeypots 17. xix
Honeynet2_bookTOC.fm Page vii Monday, May 3, 2004 12:00 PM Contents Preface Foreword xix xxvii P ART I THE HONEYNET 1 Chapter 1 The Beginning 3 The Honeynet Project 3 The Information Security Environment
Firewalls and Intrusion Detection
Firewalls and Intrusion Detection What is a Firewall? A computer system between the internal network and the rest of the Internet A single computer or a set of computers that cooperate to perform the firewall
INTRODUCTION TO FIREWALL SECURITY
INTRODUCTION TO FIREWALL SECURITY SESSION 1 Agenda Introduction to Firewalls Types of Firewalls Modes and Deployments Key Features in a Firewall Emerging Trends 2 Printed in USA. What Is a Firewall DMZ
JK0 015 CompTIA E2C Security+ (2008 Edition) Exam
JK0 015 CompTIA E2C Security+ (2008 Edition) Exam Version 4.1 QUESTION NO: 1 Which of the following devices would be used to gain access to a secure network without affecting network connectivity? A. Router
Denial of Service Attacks
(DoS) What Can be DoSed? First Internet DoS Attack The TCP State Diagram SYN Flooding Anti-Spoofing Better Data Structures Attacking Compact Data Structures Generic Solution SYN Cookies It s Not Perfect
Evading Infrastructure Security Mohamed Bedewi Penetration Testing Consultant
Evading Infrastructure Security Mohamed Bedewi Penetration Testing Consultant What infrastructure security really means? Infrastructure Security is Making sure that your system services are always running
Malicious Network Traffic Analysis
Malicious Network Traffic Analysis Uncover system intrusions by identifying malicious network activity. There are a tremendous amount of network based attacks to be aware of on the internet today and the
Web Application Security. Radovan Gibala Senior Field Systems Engineer F5 Networks [email protected]
Web Application Security Radovan Gibala Senior Field Systems Engineer F5 Networks [email protected] Security s Gaping Hole 64% of the 10 million security incidents tracked targeted port 80. Information Week
Country Case Study on Incident Management Capabilities CERT-TCC, Tunisia
Country Case Study on Incident Management Capabilities CERT-TCC, Tunisia Helmi Rais CERT-TCC Team Manager National Agency for Computer Security, Tunisia [email protected] [email protected] Framework
Glasnost or Tyranny? You Can Have Secure and Open Networks!
AT&T is a proud sponsor of StaySafe Online Glasnost or Tyranny? You Can Have Secure and Open Networks! Steven Hurst CISSP Director - AT&T Security Services and Technology AT&T Chief Security Office 2009
Networking for Caribbean Development
Networking for Caribbean Development BELIZE NOV 2 NOV 6, 2015 w w w. c a r i b n o g. o r g N E T W O R K I N G F O R C A R I B B E A N D E V E L O P M E N T BELIZE NOV 2 NOV 6, 2015 w w w. c a r i b n
Keywords Intrusion detection system, honeypots, attacker, security. 7 P a g e
HONEYPOTS IN NETWORK SECURITY Abhishek Sharma Research Scholar Department of Computer Science and Engineering Lovely Professional University (Punjab) - India Abstract Computer Network and Internet is growing
How to launch and defend against a DDoS
How to launch and defend against a DDoS John Graham-Cumming October 9, 2013 The simplest way to a safer, faster and smarter website DDoSing web sites is... easy Motivated groups of non-technical individuals
How to build and run a Security Operations Center
How to build and run a Security Operations Center v1.1 Nicolas FISCHBACH Senior Manager, Network Engineering Security, COLT Telecom [email protected] - http://www.securite.org/nico/ About Nicolas Fischbach
BOTNETS. Douwe Leguit, Manager Knowledge Center GOVCERT.NL
BOTNETS Douwe Leguit, Manager Knowledge Center GOVCERT.NL Agenda Bots: what is it What is its habitat How does it spread What are its habits Dutch cases Ongoing developments Visibility of malware vs malicious
A Critical Investigation of Botnet
Global Journal of Computer Science and Technology Network, Web & Security Volume 13 Issue 9 Version 1.0 Year 2013 Type: Double Blind Peer Reviewed International Research Journal Publisher: Global Journals
Campus LAN at NKN Member Institutions
Campus LAN at NKN Member Institutions RS MANI [email protected] 1/7/2015 3 rd Annual workshop 1 Efficient utilization Come from: Good Campus LAN Speed Segregation of LANs QoS Resilient Access Controls ( L2 and
Information Security Threat Trends
Talk @ Microsoft Security Day Sep 2005 Information Security Threat Trends Mr. S.C. Leung 梁 兆 昌 Senior Consultant 高 級 顧 問 CISSP CISA CBCP M@PISA Email: [email protected] 香 港 電 腦 保 安 事 故 協 調 中 心 Introducing
IPv6 Security. Scott Hogg, CCIE No. 5133 Eric Vyncke. Cisco Press. Cisco Press 800 East 96th Street Indianapolis, IN 46240 USA
IPv6 Security Scott Hogg, CCIE No. 5133 Eric Vyncke Cisco Press Cisco Press 800 East 96th Street Indianapolis, IN 46240 USA Contents Introduction xix Chapter 1 Introduction to IPv6 Security 3 Reintroduction
PROFESSIONAL SECURITY SYSTEMS
PROFESSIONAL SECURITY SYSTEMS Security policy, active protection against network attacks and management of IDP Introduction Intrusion Detection and Prevention (IDP ) is a new generation of network security
TECHNICAL NOTE 01/2006 ENGRESS AND INGRESS FILTERING
TECHNICAL NOTE 01/2006 ENGRESS AND INGRESS FILTERING 20 APRIL 2006 This paper was previously published by the National Infrastructure Security Co-ordination Centre (NISCC) a predecessor organisation to
Top 5 Essential Log Reports
Top 5 Essential Log Reports Version 1.0 Contributors: Chris Brenton - Independent Security Consultant - [email protected] Tina Bird, Security Architect, PGP Corporation Marcus J Ranum, CSO, Tenable
Case Study: Instrumenting a Network for NetFlow Security Visualization Tools
Case Study: Instrumenting a Network for NetFlow Security Visualization Tools William Yurcik* Yifan Li SIFT Research Group National Center for Supercomputing Applications (NCSA) University of Illinois at
Plugging Network Security Holes using NetFlow. Loopholes in todays network security solutions and how NetFlow can help
Plugging Network Security Holes using NetFlow Loopholes in todays network security solutions and how NetFlow can help About ManageEngine Network Servers & Applications Desktop ServiceDesk Windows Infrastructure
HoneyBOT User Guide A Windows based honeypot solution
HoneyBOT User Guide A Windows based honeypot solution Visit our website at http://www.atomicsoftwaresolutions.com/ Table of Contents What is a Honeypot?...2 How HoneyBOT Works...2 Secure the HoneyBOT Computer...3
NGN Next Generation Nightmare? What telco 2.0 really means
NGN Next Generation Nightmare? What telco 2.0 really means Nicolas FISCHBACH Senior Manager, Network Engineering Security, COLT Telecom [email protected] - http://www.securite.org/nico/ Internet-wide Security
HONEYPOT SECURITY. February 2008. The Government of the Hong Kong Special Administrative Region
HONEYPOT SECURITY February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in part without
FortiDDos Size isn t everything
FortiDDos Size isn t everything Martijn Duijm Director Sales Engineering April - 2015 Copyright Fortinet Inc. All rights reserved. Agenda 1. DDoS In The News 2. Drawing the Demarcation Line - Does One
Bleeding Edge DDoS Mitigation Techniques for ISPs
Bleeding Edge DDoS Mitigation Techniques for ISPs Abstract. Distributed Denial of Service (DDoS) attacks are increasing plaguing the Internet since their first big appearance against Yahoo in the year
Denial of Service Attacks
2 Denial of Service Attacks : IT Security Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 13 August 2013 its335y13s2l06, Steve/Courses/2013/s2/its335/lectures/malicious.tex,
The HoneyNet Project Scan Of The Month Scan 27
The HoneyNet Project Scan Of The Month Scan 27 23 rd April 2003 Shomiron Das Gupta [email protected] 1.0 Scope This month's challenge is a Windows challenge suitable for both beginning and intermediate
Agenda. Taxonomy of Botnet Threats. Background. Summary. Background. Taxonomy. Trend Micro Inc. Presented by Tushar Ranka
Taxonomy of Botnet Threats Trend Micro Inc. Presented by Tushar Ranka Agenda Summary Background Taxonomy Attacking Behavior Command & Control Rallying Mechanisms Communication Protocols Evasion Techniques
Seminar Computer Security
Seminar Computer Security DoS/DDoS attacks and botnets Hannes Korte Overview Introduction What is a Denial of Service attack? The distributed version The attacker's motivation Basics Bots and botnets Example
CS 356 Lecture 17 and 18 Intrusion Detection. Spring 2013
CS 356 Lecture 17 and 18 Intrusion Detection Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists
THE SMARTEST WAY TO PROTECT WEBSITES AND WEB APPS FROM ATTACKS
THE SMARTEST WAY TO PROTECT WEBSITES AND WEB APPS FROM ATTACKS INCONVENIENT STATISTICS 70% of ALL threats are at the Web application layer. Gartner 73% of organizations have been hacked in the past two
CS 640 Introduction to Computer Networks. Network security (continued) Key Distribution a first step. Lecture24
Introduction to Computer Networks Lecture24 Network security (continued) Key distribution Secure Shell Overview Authentication Practical issues Firewalls Denial of Service Attacks Definition Examples Key
HONEYD (OPEN SOURCE HONEYPOT SOFTWARE)
HONEYD (OPEN SOURCE HONEYPOT SOFTWARE) Author: Avinash Singh Avinash Singh is a Technical Evangelist currently worksing at Appin Technology Lab, Noida. Educational Qualification: B.Tech from Punjab Technical
Chapter 9 Firewalls and Intrusion Prevention Systems
Chapter 9 Firewalls and Intrusion Prevention Systems connectivity is essential However it creates a threat Effective means of protecting LANs Inserted between the premises network and the to establish
Team Cymru. Network Forensics. Ryan Connolly, [email protected] <http://www.cymru.com>
Team Cymru Network Forensics Ryan Connolly, [email protected] Network Forensics what does it mean? network forensics is the analysis of network events in order to discover the source
TDC s perspective on DDoS threats
TDC s perspective on DDoS threats DDoS Dagen Stockholm March 2013 Lars Højberg, Technical Security Manager, TDC TDC in Sweden TDC in the Nordics 9 300 employees (2012) Turnover: 26,1 billion DKK (2012)
TECHNICAL NOTE 06/02 RESPONSE TO DISTRIBUTED DENIAL OF SERVICE (DDOS) ATTACKS
TECHNICAL NOTE 06/02 RESPONSE TO DISTRIBUTED DENIAL OF SERVICE (DDOS) ATTACKS 2002 This paper was previously published by the National Infrastructure Security Co-ordination Centre (NISCC) a predecessor
Spyware. Michael Glenn Technology Management [email protected]. 2004 Qwest Communications International Inc.
Spyware Michael Glenn Technology Management [email protected] Agenda Security Fundamentals Current Issues Spyware Definitions Overlaps of Threats Best Practices What Service Providers are Doing References
THE BEST WAY TO CATCH A THIEF. Patrick Bedwell, Vice President, Product Marketing
THE BEST WAY TO CATCH A THIEF Patrick Bedwell, Vice President, Product Marketing AlienVault Vision Accelerating and simplifying threat detection and incident response for IT teams with limited resources,
CYBERTRON NETWORK SOLUTIONS
CYBERTRON NETWORK SOLUTIONS CybertTron Certified Ethical Hacker (CT-CEH) CT-CEH a Certification offered by CyberTron @Copyright 2015 CyberTron Network Solutions All Rights Reserved CyberTron Certified
Yahoo Attack. Is DDoS a Real Problem?
Is DDoS a Real Problem? Yes, attacks happen every day One study reported ~4,000 per week 1 On a wide variety of targets Tend to be highly successful There are few good existing mechanisms to stop them
DDoS Overview and Incident Response Guide. July 2014
DDoS Overview and Incident Response Guide July 2014 Contents 1. Target Audience... 2 2. Introduction... 2 3. The Growing DDoS Problem... 2 4. DDoS Attack Categories... 4 5. DDoS Mitigation... 5 1 1. Target
Attacks Against the Cloud: A Mitigation Strategy. Cloud Attack Mitigation & Firewall on Demand
Attacks Against the Cloud: A Mitigation Strategy C L O U D A T T A C K M I T I G A T I O N & F I R E W A L L O N D E M A N D A l e x Z a c h a r i s a z a h a r i s @ a d m i n. g r n e t. g r G R N E
Cisco IOS Flexible NetFlow Technology
Cisco IOS Flexible NetFlow Technology Last Updated: December 2008 The Challenge: The ability to characterize IP traffic and understand the origin, the traffic destination, the time of day, the application
Distributed Denial of Service protection
Distributed Denial of Service protection The cost in terms of lost business caused by a successful DDoS attacks can be significant. Our solution recognises when a DDoS attack is happening and identifies
BotNets- Cyber Torrirism
BotNets- Cyber Torrirism Battling the threats of internet Assoc. Prof. Dr. Sureswaran Ramadass National Advanced IPv6 Center - Director Why Talk About Botnets? Because Bot Statistics Suggest Assimilation
NetFlow Tracker Overview. Mike McGrath x ccie CTO [email protected]
NetFlow Tracker Overview Mike McGrath x ccie CTO [email protected] 2006 Copyright Crannog Software www.crannog-software.com 1 Copyright Crannog Software www.crannog-software.com 2 LEVELS OF NETWORK
Watch your Flows with NfSen and NFDUMP 50th RIPE Meeting May 3, 2005 Stockholm Peter Haag
Watch your Flows with NfSen and NFDUMP 50th RIPE Meeting May 3, 2005 Stockholm Peter Haag 2005 SWITCH What I am going to present: The Motivation. What are NfSen and nfdump? The Tools in Action. Outlook
CSE 3482 Introduction to Computer Security. Denial of Service (DoS) Attacks
CSE 3482 Introduction to Computer Security Denial of Service (DoS) Attacks Instructor: N. Vlajic, Winter 2015 Learning Objectives Upon completion of this material, you should be able to: Explain the basic
Traffic Diversion Techniques for DDoS Mitigation using BGP Flowspec. Leonardo Serodio [email protected] May 2013
Traffic Diversion Techniques for DDoS Mitigation using BGP Flowspec Leonardo Serodio [email protected] May 2013 Distributed Denial of Service (DDoS) Attacks DDoS attack traffic consumes
Network reconnaissance and IDS
Network reconnaissance and IDS CS642: Computer Security Professor Ristenpart h9p://www.cs.wisc.edu/~rist/ rist at cs dot wisc dot edu University of Wisconsin CS 642 Let s play over the network Target
Course Content Summary ITN 261 Network Attacks, Computer Crime and Hacking (4 Credits)
Page 1 of 6 Course Content Summary ITN 261 Network Attacks, Computer Crime and Hacking (4 Credits) TNCC Cybersecurity Program web page: http://tncc.edu/programs/cyber-security Course Description: Encompasses
Botnets: The Advanced Malware Threat in Kenya's Cyberspace
Botnets: The Advanced Malware Threat in Kenya's Cyberspace AfricaHackon 28 th February 2014 Who we Are! Paula Musuva-Kigen Research Associate Director, Centre for Informatics Research and Innovation (CIRI)
How To Perform A Large Scale Attack On A Large Network
95 95 9. Exercise: Large Scale Incident Handling Main Objective Targeted Audience Total Duration Time Schedule The main objective of the exercise is to teach incident handlers the key information and actions
SECURING APACHE : DOS & DDOS ATTACKS - II
SECURING APACHE : DOS & DDOS ATTACKS - II How DDoS attacks are performed A DDoS attack has to be carefully prepared by the attackers. They first recruit the zombie army, by looking for vulnerable machines,
Certified Ethical Hacker Exam 312-50 Version Comparison. Version Comparison
CEHv8 vs CEHv7 CEHv7 CEHv8 19 Modules 20 Modules 90 Labs 110 Labs 1700 Slides 1770 Slides Updated information as per the latest developments with a proper flow Classroom friendly with diagrammatic representation
THREAT VISIBILITY & VULNERABILITY ASSESSMENT
THREAT VISIBILITY & VULNERABILITY ASSESSMENT Date: April 15, 2015 IKANOW Analysts: Casey Pence IKANOW Platform Build: 1.34 11921 Freedom Drive, Reston, VA 20190 IKANOW.com TABLE OF CONTENTS 1 Key Findings
General Network Security
4 CHAPTER FOUR General Network Security Objectives This chapter covers the following Cisco-specific objectives for the Identify security threats to a network and describe general methods to mitigate those
CMPT 471 Networking II
CMPT 471 Networking II Firewalls Janice Regan, 2006-2013 1 Security When is a computer secure When the data and software on the computer are available on demand only to those people who should have access
Service Provider Solutions. DDoS Protection Solution. Enabling Clean Pipes Capabilities
Service Provider Solutions Enabling Clean Pipes Capabilities June 2005 1 Service Provider Security Highlights Security is the heart of internetworking s future A secure infrastructure forms the foundation
Second-generation (GenII) honeypots
Second-generation (GenII) honeypots Bojan Zdrnja CompSci 725, University of Auckland, Oct 2004. [email protected] Abstract Honeypots are security resources which trap malicious activities, so they
Introduction: 1. Daily 360 Website Scanning for Malware
Introduction: SiteLock scans your website to find and fix any existing malware and vulnerabilities followed by using the protective TrueShield firewall to keep the harmful traffic away for good. Moreover
Use of Honeypot and IP Tracing Mechanism for Prevention of DDOS Attack
Use of Honeypot and IP Tracing Mechanism for Prevention of DDOS Attack Shantanu Shukla 1, Sonal Sinha 2 1 Pranveer Singh Institute of Technology, Kanpur, Uttar Pradesh, India 2 Assistant Professor, Pranveer
Cheap and efficient anti-ddos solution
Cheap and efficient anti-ddos solution Who am I? Alexei Cioban Experience in IT 13 years CEO & Founder IT-LAB 7 years IT trainings 5 years 2 About company Year of foundation - 2007 12 employees www.it-lab.md
Radware s Behavioral Server Cracking Protection
Radware s Behavioral Server Cracking Protection A DefensePro Whitepaper By Renaud Bidou Senior Security Specialist,Radware October 2007 www.radware.com Page - 2 - Table of Contents Abstract...3 Information