Attackers Vs. Defenders: Restoring the Equilibrium

1,165 views

Published on

Published in: Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
1,165
On SlideShare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
33
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide
  • I would like to share with you the results of a very interesting survey that we did last month. The research was conducted by Ponemon and included 700 IT & IT security staff that are not Radware customers.The survey is going to be released next week and today we can have a first look into some of its highlights.
  • Availability is the top business priority for organizations today… that has been changed over the last couple of years.
  • We didn’t do this survey in the past, but we know that 2 years ago we had explain the threat more. Today it’s changed.
  • What happens after the Backend server crashes depends on the type of CDN service provided, two options here:Static content still provided by CDN, dynamic content unavailable2. Service is not provided at all when backend server is not responsive
  • Attackers Vs. Defenders: Restoring the Equilibrium

    1. 1. Attackers Vs. Defenders: Restoring theEquilibriumRon MeyranDirector of Security MarketingJanuary 2013
    2. 2. AGENDACyber security StatisticsAbout 2012 Global Security ReportKey FindingsERT Case Studies2013 Recommendations
    3. 3. Cyber Security Study• A research study by Ponemon & Radware• Surveyed 700 IT & IT Security Practitioners• Non Radware customers• Release date: November 12th 2012 3
    4. 4. Cyber Security Business PrioritiesRanking of cyber security objectives in terms of a business priority objective5 = Highest Priority to 1 = Lowest Priority 5 4.74.5 4.4 4 3.53.5 3 2.82.5 2 1.91.5 10.5 0 Interoperability Confidentiality Integrity Compliance Availability 4
    5. 5. DDoS Attacks FrequencyHow many DDoS attacks experienced in thepast 12 months? of organizations had an65% average of 3 DDoS attacks in the past 12 months 5
    6. 6. Average downtime during one DDoS attack25% 22%20% 16%15% 13% Minutes average10% 10% 54 11% downtime during 9% one DDoS attack 5% 10%5% 4%0% Less than 1 11 to 20 minutes 31 to 60 minutes 3 to 5 Cannot minute hours determine 6
    7. 7. Cost of Downtime Cost per minute of downtime25% 21%20%15% 12% $22,000 15% 15% Average cost per minute of downtime 11%10% 8% 7%5% 1% $3,000,000 5% 5%0% Average annual Cost of DDoS Attacks 7
    8. 8. AGENDACyber security StatisticsAbout 2012 Global Security ReportKey FindingsERT Case Studies2013 Recommendations
    9. 9. Information Resources• Radware Security Survey • ERT Survey – External survey – Internal survey – 179 participant – Unique visibility into attacks – 95.5% are not using behaviour Radware DoS mitigation – 95 selected cases solution • Customer identity remains undisclosed ERT gets to see attacks in real-time on daily basis 9
    10. 10. AGENDACyber security StatisticsAbout 2012 Global Security ReportKey FindingsERT Case Studies2013 Recommendations
    11. 11. Organizations Bring a Knife to a Gunfight• ”Someone who brings a knife to a gun fight” – Is someone who does prepare himself for the fight, but does not understand its true nature• Organizations today are like that – They do invest before the attack starts, and conduct excellent forensics after it is over, – however, they have one critical blind-spot – they dont have the capabilities or resources to sustain a long, complicated attack campaign.• Attackers target this blind spot! 11
    12. 12. Attacked in 2012 They had the budget They made the investmentAnd yet they went offline 12
    13. 13. Organizations Deploy Two-phase Security Approach Industry Security SurveyHow much did your organization invest in each of the following security aspects in the last year? 45% 40% 35% 30% 25%Procedures 20%Human skills 15%Equipment 10% 5% 0% Before During After Only 21% of company efforts are invested during the attack itself, while 79% is spent during the pre-attack and post-attack phase. 13
    14. 14. But attacks today have 3 phases 14
    15. 15. Attacks last longer 21% 23% 14 21% 12 12% 10 8 2011 2012 6 11% 4 12% 2 20 0 12 1-2 days 20 Half a week 11 1 weekAttacks last longer: The number of DoS attacks lasting over a week had doubled in 2012 15
    16. 16. And become more complex ERT Cases – Attack Vectors 29% 29% 16% 30% 25% 20% 15% 16% 10% 4% 5% 0% 7% 5-6 7-8 Complexity 9-10 2011 2012Attacks are more complex: 2012 DoS/DDoS attacks have become more sophisticated, using morecomplex attack vectors. Note the number of attacks using a complexity level of 7-10. 16
    17. 17. Content Delivery Network (CDN) Do you consider Content Delivery Networks (CDNs) a solution for a DoS/DDoS attack? 70% Yes 30% No70% of the companies who use CDN believe the CDN is a solution for DoSDDoS attacks. 17
    18. 18. Attacks Evade CDN service GET Legitimate requests www.exmaple.com are refusedLegitimate users Internet Backend Webserver • In recent cyber attacks the CDN was easily bypassed – By changing the page request in every Web GET www.exmaple.com/?[Random] transaction Botnet • These random request techniques force CDNs to “raise the curtain” – All the attacks traffic is disembarked directly to the customer premise – More complex to mitigate attacks masked by CDN CDN service 18
    19. 19. Attackers are well prepared• By definition the defenders loose the battle• Equilibrium has been disrupted 19
    20. 20. The good news (1) Industry Security SurveyHow likely is it that your organization will be attacked by cyber warfare? Possible 37% Organizations start understanding Unlikely 45% the risk of DDoS Very likely Likely 10% 8% Over half of the organizations believe their organization is likely to be attacked by cyber warfare. 20
    21. 21. The good news (2) Industry Security Survey Which solutions do you use against DoS attacks? 40% 45% 40% 32% 32% 35% 27% 30% Organizations start understanding 25% 20% 12% 15%Firewall and IPS cannot fight DDoS 5% 5% 5% 8% 10% 5% 3% 8% 2% 5% 10% 1% 5% attacks 0% 2012 2011 21
    22. 22. Conclusions• Today‟s attacks are different – Carefully planned – Last days or weeks – Switching between attack vectors• Organizations are ready to fight yesterdays‟ attacks – Deploy security solutions that can absorb the first strike – But when attacks prolong - they have very limited gunfire – By the time they succeed blocking the first two attack vectors, attackers switch to a third, more powerful one 22
    23. 23. A different approach is needed• A team of security experts – Acquire capabilities to sustain long attacks – Train a team that is ready to respond to persistent attacks – Deploy the most up-to-date methodologies and tools – 24 x 7 availability to respond to attacks – Deploy counterattack techniques to cripple an attack 23
    24. 24. AGENDACyber security StatisticsAbout 2012 Global Security ReportKey FindingsERT Case Studies2013 Recommendations
    25. 25. US Banks Under Attack: from the news 25
    26. 26. US Banks Under Attack: Operation Ababil• Publication of the „Innocence of Muslim‟ film on YouTube invokes demonstrations throughout the Muslim world• September 18th- „Cyber Fighters of Izz ad-din Al Qassam‟ announced an upcoming cyber attack campaign against „American and Zionist‟ targets. 26
    27. 27. Attack Summary• Attack targets – Bank of America – New York Stock Exchange (NYSE) – Chase – Wells Fargo• Attacks lasted Sep 18-21, 2012• Multiple attacks‟ waves on each target, each wave lasted 4 to 9 hours• Victims suffered from temporary outages and network slowness• ERT was actively involved in protecting the attacked organizations 27
    28. 28. Why it was so challenging? UDP Garbage flood on ports 80 and 443Multi-vulnerability attack campaignLarge volume SYN flood• Mitigation nearly impossible Business• Attackers look for the blind spot SSL Client Hello flood HTTP flood attack 28
    29. 29. Recent updates• HTTP flood was carried from compromised hosting servers – Highly distributed attacks 29
    30. 30. AGENDACyber security StatisticsAbout 2012 Global Security ReportKey FindingsERT Case Studies2013 Recommendations
    31. 31. ERT recommendations for 2013• Acquire capabilities to sustain a long sophisticated cyber attack• Attack tools are known. Test yourself• Carefully plan the position of DoS/DDoS mitigation within network architecture – On premise capabilities – In the cloud capabilities 31
    32. 32. Thank You Ron Meyranronm@radware.com

    ×