Mitigating Denial of Service Attacks. Why Crossing Fingers is Not a Strategy

Size: px

Start display at page:

Download "Mitigating Denial of Service Attacks. Why Crossing Fingers is Not a Strategy"

Lesley Carter
8 years ago
Views:

1 Mitigating Denial of Service Attacks Why Crossing Fingers is Not a Strategy

2 Introduction Mark Baldwin - Owner of Tectonic Security MSSP and Security Consulting Primarily Work With SMBs DDoS Mitigation Vulnerability Scanning Web Application Firewall Endpoint Protection Threat Detection and Monitoring Security Consulting and Assessments

Vulnerability Scanning Web Application Firewall Endpoint Protection

3 Agenda What is a Denial of Service Attack? DDoS Attack Statistics Cost of DDoS Attacks Creating a Mitigation Plan Planning - Step by Step Summary Q and A

4 The Connection Has Timed Out

5 What is a Denial of Service Attack? The goal of a DoS attack is to prevent the use of a computing resource by legitimate users CIA Security Triad - Confidentiality, Integrity, Availability DoS attacks affect the availability of a resource Example - Attacker floods an ecommerce with requests so it cannot respond to legitimate requests from customers

users CIA Security Triad - Confidentiality, Integrity, Availability DoS attacks affect

6 DoS Attacks Are Real and Can Be Costly Image shows alert from US-CERT issued on July Attackers using DDoS threats to extort money Many businesses end up paying to prevent or stop the attack What would you? Must have a mitigation plan in place BEFORE attack occurs

extort money Many businesses end up paying to prevent or stop the

7 Live DoS Attack Data The Digital Attack Map shows DoS attacks in real time. Provides information on source, destination, size and type of attack.

8 Types of DoS Attacks DoS attacks can be either distributed or non-distributed. The vast majority today are distributed (DDoS) where traffic is sent from many different sources (botnet). DDoS attacks are MUCH more difficult to stop since the traffic can originate from dozens, hundreds or even thousands of devices (even phones). DDoS attacks can also generate much greater volume of traffic.

9 Types of DoS Attacks Three Basic Types of DDoS Attacks 1. Protocol Attacks - Attempt to use up all the available connections to devices such as load-balancers, firewalls, and servers. SYN flood is example. Measured in packets per second. 2. Volumetric Attacks - Attempt to consume all bandwidth on victim network. These attacks are simply about network causing congestion. Measured in bits per second. 3. Application Attacks - Attempt to overwhelm a specific aspect of an application. Can be effective even with very few attacking machines generating a low traffic rate. HTTP flood is example. Measured in requests per second.

Measured in packets per second. 2. Volumetric Attacks - Attempt to consume all bandwidth on victim network.

10 DDoS Asymmetry Very easy and cheap to launch DDoS attack. Can purchase botnet for DDoS attack for $150 per week or less. No technical skills required. on the other hand Defending against a DDoS attack is difficult and frequently expensive. It is even more difficult and expensive if you wait until you are under attack. It s imperative to have mitigation plan in place before attack occurs!

on the other hand Defending against a DDoS attack is difficult and frequently expensive.

11 DDoS Attack Stats According to Akamai s State of the Internet Q Report % increase in total DDoS attacks from Q to Q Q saw all-time record high in the number of DDoS attacks 18.99% increase in the average attack duration: vs hours Top source countries for DDoS attacks are China, US, UK, India and Spain

high in the number of DDoS attacks 18.99% increase in the average attack duration: 20.

12 DDoS Attack Stats Not only are the number of attacks increasing, but also the size is increasing In Q2 2015, 12 DDoS attacks registered more than 100 Gbps (mega attacks) In Q2 2015, the largest DDoS attack measured nearly 250 Gbps. The largest in Q was 170 Gbps In Q2 2015, syn floods represented the top overall infrastructurebased attack

Q2 2015, the largest DDoS attack measured nearly 250 Gbps.

13 Cost to Victims According to Incapsula s Q DDoS Threat Landscape Report 45% of all organizations surveyed experienced DDoS attack Half of all application layer DDoS attack targets are hit again within 60 days. Two-thirds last 6-24 hours. The longest this past quarter lasted 54 days. The average cost of an unmitigated attack is $40,000 per hour. This includes lost revenue, lost productivity, loss of customer trust and more.

days. Two-thirds last 6-24 hours. The longest this past quarter lasted 54 days.

14 Notable Victims Below are some recent victims of DDoS attacks: Github - March 2015 UK National Crime Agency - Sept 2015 Sony Playstation Network - Dec 2014 WoW Network - Aug 2015 City of Lodi CA - Sept 2015 Polish National Airline LOT - June 2015 These are just a few of the many that occurred in the last year. It is a global problem and is only getting worse.

2015 City of Lodi CA - Sept 2015 Polish National Airline LOT - June 2015 These are just a

Create a DDoS Mitigation Plan Must have a plan to deal with DDoS attacks. Do not wait until attacks happens it will be too late. Need to get defenses in place before an attack occurs.

15 Create a DDoS Mitigation Plan Must have a plan to deal with DDoS attacks. Do not wait until attacks happens it will be too late. Need to get defenses in place before an attack occurs. Will likely require coordinated approach between your IT group, your ISP, hosting provider and a DDoS mitigation vendor. Include DDoS mitigation in your overall incident response plan.

Need to get defenses in place before an attack occurs.

16 Step 1 - Contact Your ISP/Hosting Provider Find out how they deal with DDoS attacks Many will simply null route traffic to affected hosts/networks in order to protect their own network and other customers This means your site will be unavailable to anyone until the attack ends and the null route is removed! Discuss your mitigation plans with them and make sure they are included in the contact list. Ensure that they do not null traffic in the event of an attack.

will be unavailable to anyone until the attack ends and the null route is removed!

Step 2 - Setup Network Monitoring It is critical to have network monitors in place to detect DDoS attacks Netflow data can be very useful Create alarms that will notify you in the event that inbound

17 Step 2 - Setup Network Monitoring It is critical to have network monitors in place to detect DDoS attacks Netflow data can be very useful Create alarms that will notify you in the event that inbound traffic exceeds a certain threshold For example, if your normal inbound traffic is 5Mbps, then create an alarm to notify you if there is 15Mbps for 3 consecutive checks This is invaluable in helping you know if your site is down due to DDoS attack or some other reason. Saves time!

example, if your normal inbound traffic is 5Mbps, then create an alarm to notify you if there is 15Mbps for 3

18 Step 3 - Install a Quality Firewall A firewall alone cannot protect you from every DDoS attack, but it is an essential component Most major firewall products can detect and mitigate simple SYN, ICMP and UDP floods A firewall will not be able to defend against application attacks or against very large volumetric or TCP attacks, but can protect against some of the basic attacks. Make sure it can handle at least 5x or 10x your normal traffic load

firewall will not be able to defend against application attacks or against very large volumetric or TCP

19 Step 4 - Increase Your Bandwidth If possible, add additional bandwidth to your network. Fat pipes make it more difficult and expensive for attackers to take down your network or website If this is not possible due to budgetary constraints, at least make sure your ISP can quickly add more bandwidth if you need it

Fat pipes make it more difficult and expensive for attackers to take down your

Step 5 - Install a Reverse Proxy A reverse proxy can be very useful to mitigate application layer attacks, especially those targeted against a website It intercepts the requests before they are

20 Step 5 - Install a Reverse Proxy A reverse proxy can be very useful to mitigate application layer attacks, especially those targeted against a website It intercepts the requests before they are passed to the web servers You can create rules to detect and block attacks such as HTTP floods that a firewall cannot Can also be used to detect and block other application layer attacks such as SQL Injection and XSS

to the web servers You can create rules to detect and block attacks such as HTTP floods that a

21 Step 6 - Scrubbing DDoS Traffic Even if you implement all the items previously discussed, it is still possible (even likely) that a DDoS attack will be successful Remember the tipping scale easy and cheap to launch, difficult and expensive to defend The last line of defense is traffic scrubbing. If all else fails, there are products and services that will scrub your traffic Legitimate traffic will be allowed through, bad traffic will be blocked

22 Traffic Scrubbing Details Whether you purchase and implement your own hardware, or outsource to a third party, they basically work the same way During an attack, traffic is routed through scrubbers The scrubbers analyze the traffic and attempt to block DDoS traffic and allow legitimate traffic through Various methods to accomplish this such as look at number of requests, cookie behavior, javascript support, and even captcha Not all DDoS mitigation solutions created equal. Some work better than others. Do your research

23 Summary Number take away is don t wait until you under attack to figure out how to respond. Don t cross your fingers and hope you are not attacked. Create a DDoS mitigation plan and make it part of your overall incident response plan There are some very good mitigation services available that will dramatically improve your ability to defend against a DDoS attack Tectonic security provides managed DDoS mitigation services so feel free to contact us if you have questions or need help Thank You!

24 Questions or Comments

25 Thanks!

TDC s perspective on DDoS threats

TDC s perspective on DDoS threats DDoS Dagen Stockholm March 2013 Lars Højberg, Technical Security Manager, TDC TDC in Sweden TDC in the Nordics 9 300 employees (2012) Turnover: 26,1 billion DKK (2012)