Arbor s Solution for ISP

Arbor s Solution for ISP

Recent Attack Cases

DDoS is an Exploding & Evolving Trend More Attack Motivations Geopolitical Burma taken offline by DDOS attack Protests Extortion Visa, PayPal, and MasterCard attacked Techwatch weathers DDoS extortion attack Greater Availability of Botnets Better Bots Easy Access More infected PCs with faster connections Using web 2.0 tools to control botnets Commoditized Cloud-based botnets, cheaper more attacks Increased Volume Increased Complexity Increased Frequency Largest volumetric DDoS has grown from 9 to 100 Gbps in 5 years Over 25% of attacks are now application-based DDoS mostly targeting HTTP, DNS, SMTP >50% of data center operators experience >10 attacks per month Largest single DDos Attack Observed per Year in Gbps Largest 7 DDos Attacks Against IDC Average Number of DDos Attacks per Month 4

Arbor Network

Who is Arbor Networks? A Trusted & Proven Vendor Securing the World s Largest and Most Demanding Networks 90% 105 43+ Tbps #1 12 Percentage of world s Tier 1 service providers who are Arbor customers Number of countries with Arbor products deployed Amount of global traffic monitored by the ATLAS security intelligence initiative right now 25% of global Internet traffic! Arbor market position in Carrier, Enterprise and Mobile DDoS equipment market segments 61% of total market [Infonetics Research Dec 2011] Number of years Arbor has been delivering innovative security and network visibility technologies & products 6 $16B 2011 GAAP revenues [USD] of Danaher Arbor s parent company providing deep financial backing

Sampling of Arbor s Customers vodaphone * These customers have given Arbor Networks authorization to use their names publicly. Over 300 customers use Peakflow SP & TMS today.

ASERT Arbor Security Engineering Research Team

Malware Analysis Example CnC For ATF/Peakflow SP: study bot-to-cnc traffic to alert on infected clients Bot/CnC comms For AIF/Pravail: study bot-to-victim DDoS traffic to distinguish legit web requests from HTTP flood requests Victim Web Server New Malware Specimen ASERT Sandbox HTTP Flood traffic

Arbor DDoS Solution

12 DDoS Attack? It WILL Happen

300Gbps of DDoS Attack!!

The DDoS Attack Surface Any part of your network or services that is vulnerable to an attack Network Interfaces Infrastructure Firewall/IPS Servers Protocols Applications Databases Attackers will find the weakness 14

The Broad Impact of DDoS Attacks Modern DDoS Attacks Are Complex & Diverse IPS Load Balancer DATA CENTER Attack Traffic Good Traffic Today s DDoS attacks can cause (1) saturation upstream, (2) state exhaustion, or (3) service outages many times a single attack can result in all three and all with the same end result: 15 critical services are no longer available!

Stopping Volumetric Attacks ISP 1 SCRUBBING CENTER Peakflow SP/TMS Cloud-based DDoS Protection DATA CENTER ISP 2 ISP Firewall IPS Load Balancer ISP n Cloud-based: Volumetric DDoS mitigation must be done up stream, before traffic gets to Data Center Activated on demand : only active when an attack is detected or reported 18

How it all works? (Peakflow SP/TMS)

Step 1: Have Visibility (x-flow based) Service Provider s Core Arbor Peakflow CP Peering Point POP Mobile Subscriber Network Core Router Peering Point POP Enterprise A Targeted Enterprise B

Comprehensive Dashboards

Traffic & Application Network: Top peers, ASNs, Countries, Cities Applications, Fingerprints, Growth Application: Customers, Ports, Peers, Markets Customer: Applications, Peers, Fingerprints, Markets, Alerts Router: Per router stats, Top Interfaces, Applications, Customers Benefits Better informed, more timely operations management

Cost Optimized Peering and Transit Transit reports Peer traffic exchange reports Peering what if analysis Interface reports Source and Destination Analysis Where is traffic going when it comes IN? Where has traffic come from when it goes OUT? How much in transit costs is customer A costing me? How much money will I save if I peer with XYZ? View where your customers traffic is truly destined Make intelligent decisions about peering expansions Assure that existing peering agreements are being used to their full potential Ensure that transit customers are abiding by service agreements like no-resell agreements

Global Geography Reporting Reports and tracking by country, region, city Track threat sources Country baselines and alerts Allow, drop, shape traffic based on country Identify growth markets Measure service usage by city A New Dimension of Network Intelligence Benefits Better threat response Better market analysis Better planning

Service Visibility Measure application usage Track Key Performance Indicators (KPIs): Jitter latency RTT 90 predefined applications Customer defined applications Top URL reports VoIP call reports Comprehensive DNS reports Real-time packet visibility Alerts on service changes Track baseline service levels Benefits Identify and address problems before users start to complain Reduce help desk calls Better business and operations planning

Subscriber Visibility Identify infected subscribers Track # of infected subscribers Track individual and aggregate subscriber traffic Identify top markets (IP Location cities) Identify top applications, top ports Protection and reporting for mobile and fixed networks Benefits Keep malicious traffic off the network Protect subscribers Serve markets better

The Attack Service Provider s Core Peering Point Arbor Peakflow CP Core Router 1- Detect POP 2 - Activate Mobile Subscriber Network Peering Point Surgical Mitigation Center POP 3 Divert only target s traffic Enterprise A Targeted Enterprise B

The Mitigation Service Provider s Core Arbor Peakflow CP Peering Point Arbor Peakflow CP POP Mobile Subscriber Network Core Router Peering Point 5 Forward the legitimate: GRE, MPLS, Surgical Mitigation Center POP Enterprise A Targeted 4 Identify and filter the malicious Enterprise B

Multiple Countermeasures for Multiple Attacks Vulnerability Exploits Generic Flood Attacks Fragmentation Attacks Application Attacks TCP Stack Flood Attacks Static & Dynamic Packet Filters Anti-Spoofing Mechanisms Baseline Enforcement Botnet screening Layer 7 Protections Rate-limiting

Service and Application Layer Protection HTTP / Web 2.0 Protection Block malformed HTTP Rate-limit HTTP requests Stop click fraud Stop low and slow attacks SSL Protection Neutralize SSL signaling protocol attacks VoIP Protection Block malformed SIP packets SIP request limiting DNS Protection DNS Regular Expressions (RegEx) DNS Authentication/Anti-Spoofing DNS Query Rate Limiting DNS Non-Existent Domain (NXDOMAIN) Rate Limiting DNS Reporting and Packet Sampling IP-based Protection Packet scrubbing (TCP / UDP/ ICMP) TCP Connection reset White list / black list Benefits Protect business critical applications from targeted attacks

Arbor s Unique Solution The Solution to Stop Advanced Threats Built on Global Network Visibility & Security Intelligence Global & Enterprise Visibility Know Your Network No Matter Where It Resides Security Intelligence Find the Threat No Matter Where the Threat Lurks Availability Protection Protect the Business at All Times A World-Class Research Team (ASERT) Analyzing all the World s Internet Traffic (ATLAS) to Stop Emerging Advanced Threats 32

Thank You