Understand & Protect
Total Page：16
File Type：pdf, Size：1020Kb
A Telxius White Paper Understand & protect How to defend against the threat of DDoS attacks 01. Executive Summary Denial of service attacks have become one of the primary cybersecurity threats facing enterprises, making DDoS protection an essential part of a cybersecurity strategy ¹ In the last decade, Distributed Denial According to the Arbor Infrastructure This white paper will outline the of Service (DDoS) attacks have become Security Report 2014, the DDoS consequences for your business of an increasingly sophisticated and landscape has evolved as a result of a not preventing DDoS attacks. Grave dangerous threat on the Internet that combination of factors: consequences such as declines in most companies face on a daily basis. productivity, damage to brand and According to research by Ponemon • An increase in the number of attacks reputation, and lost revenue. Institute, on average DDoS attacks cost and wider use of ‘quick hit’ techniques companies $1.5 million annually.2 which involve short, high-intensity In addition, it aims to provide in-depth attacks. insights into the way in which DDoS According to the Davos World Economic attacks are being carried out and how Forum, all organizations should assume • Greater use of hosting and cloud to protect your organisation – and your they have been hacked, or at least facilities as launch points for DDoS customers – against them. Crucially, it agree that it is not a question of ‘if’ attacks in order to circumvent will help assess what an effective DDoS they will be targeted for an attack, but detection and increase attack solution could mean for your business. ‘when’. capacity. Given the rapid and extraordinary • Higher frequency of application changes that have taken place in the layer DDoS attacks both as a stand- DDoS landscape, companies now alone technique and combined with need to implement security measures volumetric attack methods. that not only protect their clients’ infrastructure but also their own network. 1 Source: http://www.stateoftheinternet.com/security-cybersecurity-ddos-protection-ddos-mitigation.html 2 Source: The Cost of Denial of Service Attacks, Ponemon Institute, March 2015. This document is the property of Telxius. Any reproduction, distribution or public communication without the express written consent of Telxius is forbidden. Understand & protect. A Telxius White Paper 3 02. DDoS attacks – what are they? “The increasingly complex nature of DDoS attacks is making effective detection and mitigation involve more than just deploying an appliance or service. Many organizations that do not have the ability to dedicate resources and skills to monitor and manage their DDoS risk exposure on a daily basis and are seeking increased context and value-added services from their providers for DDoS mitigation.” Source: Gartner Competitive Landscape: DDoS Mitigation Solutions 28 October 2014 G00261259 Gartner Analyst(s): Sid Deshpande, Principal Research Analyst | Eric Ahlm, Research Director Distributed Denial of Service (DDoS) 2.1 Understanding attacks DDoS attacks are often launched 2.2 DDoS attack profiles • Simple network attacks: • NTP attacks: NTP is a networking attacks are among the most common against victims by using a network of protocol for clock synchronisation DDoS attacks attempt to saturate your DDoS attack types have moved up the - SYN floods: exploit the threeway threats on the Internet. These attacks zombie machines or botnet. between computer systems. By Internet links to make your service OSI network model over time, climbing handshake of the TCP setup – are generated internationally and sending a long reply to a short unavailable. By overwhelming the from network to session, right up to consuming enough server resources their main task is to saturate network It is important to understand that for malicious request, the attacker is network with a high volume of traffic today’s application layer attacks. So to make the system unresponsive to bandwidth to make the network attacks intended to consume available able to overwhelm a victim’s system or opening a huge number of sessions what do they look like? legitimate traffic. unavailable to its intended users and bandwidth, the only effective strategy with UDP traffic. As the response is that the network’s resources are unable prevent a service being provided. is to mitigate the attack as close as legitimate data coming from valid to bear, performance is reduced to an • Volumetric: consumes high - UDP & ICMP floods: these are easy possible to the source in order to servers, it is especially difficult to unusable level. bandwidth. The flood of incoming for attackers to generate since the Whereas in the past most attacks prevent your Internet links becoming detect. messages (high volume of data) to the UDP protocol doesn’t validate source were random, today’s are more Fundamentally, there are two types saturated. target system forces it to shut down IP addresses, making them easy systematic and often focus on a single of attacks. The first takes place at the • Application attacks: or slow service performance, thereby to forge. They flood random ports organisation. An attacker’s motivation application layer (Layer 7) and the Furthermore, if an attack successfully denying service to legitimate users. on a remote host with numerous - Slowloris attacks: slowly deliver can range from ‘hacktivisim’ and second at the network layer (Layer 3): consumes a huge bandwidth and then UDP packets, causing the host to request headers forcing the extortion, to competitive sabotage or saturates the network’s international • Application layer: consumes low repeatedly check for the application webserver to keep connections open even simple vandalism. Whatever the • Application layer: attacks are trunk links, all your customers could bandwidth. Especially complex listening at that port, and when without completing the requests. reason behind them, DDoS attacks are especially worrisome for SaaS be harmed too. Consequently, the and difficult to detect, such attacks no application is found reply with This eventually overflows the a global issue and no organisation can application providers. These attacks impact can go well beyond negative overwhelm specific elements of an an ICMP Destination Unreachable maximum concurrent connection afford to ignore them. mimic legitimate user traffic to bypass economic impact, leading to customer application server infrastructure. packet. This process saps host pool and leads to denial of additional barebone anti-DDoS solutions and dissatisfaction and damaged brand resources and can ultimately lead connections from legitimate clients. crash the web server. reputation. 2.3 Common DDoS Attacks to inaccessibility. Amplifying ICMP Echo Reply (pings) floods are also - SSL attacks: by establishing • Network layer: attacks bring down Currently, there are a wide variety of common. They overwhelm the target numerous SSL sessions a website or SaaS application by attacks intended to overwhelm a target resource with ICMP Echo Request simultaneously, the application overwhelming network and server and make it inaccessible. Some of the packets, generally sending pa ckets becomes unavailable because the resources, causing downtime and most frequent attacks are: as fast as possible without waiting system is engrossed with processing blocking responses to legitimate for replies. the previous requests. traffic. • TCP State-Exhaustion attacks: These attempt to consume the • DNS attacks: DNS has become a connection state tables that are favourite target for DDoS flooding presented in many infrastructure attacks. Instead of taking down any components, such as load balancers web server by exhausting a DNS or firewalls. server, users simply cannot find their required website. 4 Understand & protect. A Telxius White Paper 5 03. Why is an anti-DDoS solution important? The volume, magnitude, type and The number of companies attacked Given the growing number and scale • Attacks against banks can interrupt DDoS attacks also continue to increase complexity of DDoS attacks against is increasing all the time and all of DDoS attacks, planning for their their online services preventing in complexity and have reached organisations have increased industry sectors are vulnerable to detection and mitigation is critical. customer and partner access to magnitudes of up to 300 Gbps. substantially over time. Traditional DDoS, especially organisations whose real-time resources or transaction Furthermore, DDoS attackers are not security strategies such as firewalls, business depends on the Internet. The Many enterprises think it is unlikely processing. only targeting the network layer (layer intrusion prevention systems (IPS) or Arbor Infrastructure Security Report their organisation will be attacked. 3) but also the application layer (layer web application firewalls (WAF) which 2014 identified a number of key trends, However, in the 2015 PAC report, • For online gambling companies, an 7) where detection is far more difficult. only defend the perimeter of corporate including: Incident Response Management, outage of their services can lead communications, are no longer 67% of firms reported having had to furious clients, complaints and Clearly enterprises are at a higher sufficient to protect an organisation’s • Shorter attack duration – almost 90% a cyber-breach in the last year, and lost revenues as well as brand and risk of financial loss and reputational network. That’s why it is no longer of attacks last less than an hour.