Successfully reported this slideshow.
Your SlideShare is downloading. ×

Defending Threats Beyond DDoS Attacks: Featuring Guest Speaker from IDC

Ad
Ad
Ad
Ad
Ad
Ad
Ad
Ad
Ad
Ad

Check these out next

1 of 35 Ad

Defending Threats Beyond DDoS Attacks: Featuring Guest Speaker from IDC

Download to read offline

Join this webinar with guest speaker Christopher Rodriguez, Research Manager of Cybersecurity Products for IDC and Cloudflare, recently named a Leader in the IDC MarketScape: Worldwide DDoS Prevention Solutions 2019 Vendor Assessment (Doc #US43699318, March 2019).

In this webinar, you will learn:
- Why defending against only volumetric layer 3 and 4 attacks will leave you vulnerable to other emerging DDoS attack vectors
- What economic and technological shifts are making DDoS more harmful and more evasive
- Why bot management should be considered in every DDoS mitigation strategy
- Which types of companies in North America are highly targeted and why

Join this webinar with guest speaker Christopher Rodriguez, Research Manager of Cybersecurity Products for IDC and Cloudflare, recently named a Leader in the IDC MarketScape: Worldwide DDoS Prevention Solutions 2019 Vendor Assessment (Doc #US43699318, March 2019).

In this webinar, you will learn:
- Why defending against only volumetric layer 3 and 4 attacks will leave you vulnerable to other emerging DDoS attack vectors
- What economic and technological shifts are making DDoS more harmful and more evasive
- Why bot management should be considered in every DDoS mitigation strategy
- Which types of companies in North America are highly targeted and why

Advertisement
Advertisement

More Related Content

Slideshows for you (20)

Similar to Defending Threats Beyond DDoS Attacks: Featuring Guest Speaker from IDC (20)

Advertisement

More from Cloudflare (20)

Recently uploaded (20)

Advertisement

Defending Threats Beyond DDoS Attacks: Featuring Guest Speaker from IDC

  1. 1. Defending Threats Beyond DDoS Attacks Featuring Guest Speaker from IDC
  2. 2. What you will learn today 2 How is DDoS evolving? Why should bot management also be part of your DDoS mitigation strategy? How Cloudflare helps you address these challenges
  3. 3. Today’s Speakers Timothy Fong Product Marketing Lead, Security Solutions @ Cloudflare Chris Rodriguez Research Manager, Cybersecurity Products @ IDC
  4. 4. We are helping build a better Internet 4
  5. 5. 5 Cloudflare Security Vision Provide world-class visibility, controls, and guided configurations so that customers of any size and technical sophistication can keep their Internet property safe and secure without sacrificing speed and performance 5
  6. 6. A Global Anycast Network 175+Data centers globally 2.8B Monthly active visitors generating 1.3 trillion page view 10%Internet requests everyday 8MRequests/second websites, apps & APIs in 150+ countries 13M+ 2x Speed up each request by
  7. 7. Rate Limiting SSL L3/4 DDoS Protection ` We secure traffic end-to-end, providing a layered defense Request Passed! Bot Management WAFDNS/DNSSEC Argo Tunnel 7 Orbit Spectrum EXTEND WorkersAccess CONTROL 7 L7 DDoS Protection
  8. 8. Factors increasing exposure to security risks Greater scrutiny by government and media around data, privacy and security Greater attack surface area from more public APIs, moving to the cloud, and increasing third-party integrations Stronger and more sophisticated attackers
  9. 9. IDC MarketScape: WW DDoS Prevention Solutions IDC MarketScape vendor analysis model is designed to provide an overview of the competitive fitness of ICT suppliers in a given market. The research methodology utilizes a rigorous scoring methodology based on both qualitative and quantitative criteria that results in a single graphical illustration of each vendor’s position within a given market. The Capabilities score measures vendor product, go-to-market and business execution in the short-term. The Strategy score measures alignment of vendor strategies with customer requirements in a 3-5-year timeframe. Vendor market share is represented by the size of the icons. Cloudflare is positioned as a Leader in the IDC MarketScape: Worldwide DDoS Prevention Solutions 2019 Assessment According to IDC, Cloudflare Strengths are its "unique architecture" and "rapid on-boarding process which is considered one of the easiest and fastest in the industry." Source: IDC MarketScape: Worldwide DDoS Prevention Solutions 2019 Vendor Assessment, by Martha Vazquez, March 2019, IDC #US43699318 Report Link: here
  10. 10. Chris Rodriguez is a Research Manager in IDC's Cybersecurity product research group focused on the products designed to secure today’s complex enterprise networks. IDC's cybersecurity research offerings to which Chris contributes include Endpoint Security, Network Security Products and Strategies; Security Analytics, Intelligence, Response, and Orchestration (Security AIRO); and Identity & Access Management research programs. 10© IDC Today’s Presenter
  11. 11. Top Trends in Today’s DDoS Attacks 11© IDC ▪ Volumetric attack; TCP exhaustion ; Application layer; Multi-vector ▪ Volumetric to various types of DDoS attacks, such as TCP exhaustion , application layer, multi-vector ▪ IoT connected devices is becoming a major force behind DDoS attacks ▪ Highly profitable and low entry (e.g. Script Kiddies) ▪ Convergence of DDoS attack and fraud (e.g. targeting at business logics)
  12. 12. Over 50% of Respondents Had Been Attacked Between 1-10 Times in the Past Year With Over 60% Attacks Lasting an Average of 0-10 Hours 12© IDC Q. How frequently did your organization experience a DDoS attack in the past year? Q. If you experienced a DDoS attack, on average, how long did the attack last? 🞀 ToCSource: DDoS Prevention Survey, January 2018, IDC Frequency of Attacks Duration of Attacks
  13. 13. Prominent Types of DDoS Attacks 13© IDC Q. What type of attacks did you experience? 🞀 ToCSource: IDC DDoS Prevention Survey, January 2018, n=140 • TCP exhaustion (focuses on web servers, firewalls, and load balancers to disrupt connections, thus exhausting the finite number of concurrent connections devices can support) • Application layer attacks (also known as Layer 7 attacks, specifically targets weaknesses in an application or server with the goal of establishing a connection and exhausting it by monopolizing processes and transactions) • Multivector attacks (combine volumetric attacks, stateful exhaustion attacks, and application-layer attacks) • DDoS attacks with ransom requests • DDoS attacks as smoke screen
  14. 14. Multi-vector DDoS Attacks 14 Nearly half of impacted organizations say their DDoS attacks coincided with some form of breach or malicious activity on their networks, including theft and ransomware.
  15. 15. 15© IDC Q. Which type of DDoS mitigation solutions do you use? 🞀 ToC Source: DDoS Prevention Survey, January 2018, IDC n =138 Adoption Trends in DDoS Mitigation Solutions • 47% of organizations are using hybrid deployments to protect against the broadest set of potential attack vector • 23% - 26% of respondents report plans to move to 100% cloud, hosted, and SaaS solutions
  16. 16. Businesses Spending More on DDoS Protection 16© IDC ▪ Customers are ramping up DDoS protection • Majority of organizations do plan to increase spend in DDoS solutions • Most are looking at increasing their spending from 6-15%. n =129 n =110 Base = All Respondents Source: DDoS Prevention Survey, January 2018, IDC
  17. 17. Growing Demand for DDoS Mitigation 17© IDC ▪ Elevated DDoS risk drives mitigation market on-premises products and cloud services • DDoS mitigation services growing at CAGR of 17.8% through 2022. Source: Worldwide DDoS Prevention Products and Services Forecast, 2018–2022, July 2018, IDC On-prem Products Cloud Services
  18. 18. The Intersection Between DDoS and Bot Risk 18© IDC ▪ DDoS is a business operations attack, and bots are the next frontier ▪ Early bots: DDoS, spam, malware propagation ▪ New bots: IoT, mobile ▪ Bot fraud: click- fraud, fake account activity, ad fraud, comment spam ▪ Business logic abuse: data harvesting, scraping, scalping, operations sabotage ▪ Security threats: credential stuffing, account takeover, others (future??)
  19. 19. Business Logic Is Important 19 ▪ Business logic is key to success, and yet, vulnerable © IDC19 1. Business Need 2. Marketing Idea 3. Promotion 4. Execution 5. Customer Experience 6. Drives New Business Customer Engagement and Brand Building ▪ Develop brand and reputation ▪ Drive customer engagement ▪ Build good will with customers
  20. 20. Attacking Business Logic for Profit Harms Everyone 20 ▪ Business logic is vulnerable and lucrative attack vector for bot operators. © IDC20 1. Business Need 2. Marketing Idea 3. (Failed) Promotion 4. (Poor) Execution 5. (Bad) Customer Experience 6. [Deters] New Business Customer Engagement and Brand Building ▪ Not always malicious ▪ Lucrative for attackers ▪ Harms the customer experience ▪ Hard to quantify ▪ Hard to detect ▪ Not well understood Scalper Inventory Hoarders Ad Fraud
  21. 21. Benign Malicious ▪ Search engine bots ▪ Partner systems ▪ Web indexing ▪ Archiving Benign / Beneficial ▪ Data collection ▪ Inventory hoarding ▪ Ad fraud / Skewed metrics ▪ Scalping Unwanted/ Objectionable/ Legal ▪ Credential stuffing ▪ Account takeover ▪ Others (future? unknown?) Security Threat/ Fraud / Possibly Illegal The Bot Risk Spectrum 21© IDC 21 ▪ Bot risk is a spectrum that is unique for each industry and organization
  22. 22. Bot Risk Is Escalating 22 ▪ Awareness of bot risk increased substantially in 2018. © IDC22 Source: various media clips, 2018 -2019
  23. 23. Bot Risk Evolves but Never Disappears 23© IDC ▪ Some types of bots are still used for DDoS attacks..
  24. 24. ▪ Get the facts. To assess the imminent risk and determine what action to take and, perhaps more importantly, communicate to senior management, you must determine who, what, where, when, and how at a broad level. ▪ Identify, friend or foe. With facts in hand, now you can determine whether your organization is a target, in line for collateral damage, or reasonably unaffected. ▪ Take action. If you haven't planned for an outage or the attack exceeds your capacity, your immediate response options are limited to network reconfiguration or isolation (e.g., pulling the plug). ▪ Spread the (accurate) word. With major outages, communication is key. Remember, there could be all sorts of rumors spreading that can only be addressed with specifics of the organization's plan. ▪ Kick the tires. Even if your organization is not the target, these are excellent real-world scenarios that allow organizations to work through their protection mechanisms as if they are affected. ▪ Watch your back. Perhaps the more insidious opportunity for attackers during big splashy failures like these is to execute targeted attacks undercover, using the event as a distraction. ▪ Be a good neighbor. In today's interconnected world, your technical presence on the internet affects others. Downstream liability due to perceived negligence is a budding concern for many. © IDC 24 The CIOs’ Seven-Step Checklist for Internet Availability Source: IDC #US41895416, Nov2016 DNS DDoS Debacle: The CIO's Seven-Step Checklist for Internet Availability
  25. 25. Timothy Fong Security Lead, Product Marketing Manager @ Cloudflare
  26. 26. Industry Legacy Scrubbing vs. Cloudflare Always-On 26 Industry Legacy Scrubbing - Long propagation times (up to 300 sec) - Asynchronous routing - Adds significant latency - Typically requires manual intervention Always-On - Zero propagation time - Synchronous routing - No added latency - Immediate, automated mitigation, with no “cut over” required
  27. 27. Cloudflare DDoS Solution 27 Protect Non HTTP Ports Spectrum protects non- HTTP ports open to the Internet with the same distributed architecture Custom Rate Limiting Customers can tune Layer 7 protections to their specific applications and traffic profile through rate limiting rules. Resilient DNS Cloudflare’s resilient DNS protects customers from going down because their DNS is overwhelmed by a volumetric attack. Always On DDoS With automatic heuristics and a distributed Anycast network, Cloudflare’s Always On DDoS detects and mitigates Layer ¾ and Layer 7 attacks at scale.
  28. 28. Cloudflare DDoS Differentiation 28 Easy Deployment Easy to turn-on protections that mitigate within minutes and remain “always on” without requiring ongoing maintenance or configuration. Integrated Our integration with Bot Management and Firewall Rules gives additional capabilities from a single control plane. Scale As our network continues to grows, so does our capacity and data-driven insight to block attacks automatically.
  29. 29. Bot Management Use Cases Attempts to log into and take-over a user’s account by automatically applying previously stolen account credentials Steals public information from a website Adds malicious content to web properties such as forums and registration forms Credential Stuffing Content Scraping Content Spam Fraudulently purchases goods to deprive legitimate customers or resell for a higher price Inventory Hoarding Credit Card Stuffing Tries to validate stolen credit cards to then make fraudulent purchases 29
  30. 30. Cloudflare Bot Management One-Click Deployment ● With a single click, deploy rules with Cloudflare recommended bot score thresholds ● No instrumentation with third-party JavaScript required Control and Configurability ● Scope rules by path or URI pattern, request method, and bot score thresholds ● Select mitigation methods, such as log, CAPTCHA, or block Rich Analytics and Logs ● Time-series graphs with drill-down tables ● Logs bot management rule, action, and rich request meta-data for every request Detect and mitigate bad bots by leveraging intelligence from over 13 million Internet properties. All with one click.
  31. 31. Cloudflare Bot Management Methods Machine Learning Cloudflare’s ML trains on a curated subset of more than 475 billion requests per day across 13M+ Internet properties to create a reliable “bot score” for every request. Behavioral Analysis Behavioral analysis detects anomalies in site-specific traffic, scoring every request on how different it is from the baseline. Automatic Whitelist Because not all bots are bad, the solution automatically maintains and updates a white list of "good" bots, such as those belonging to search engines. Mobile SDK The mobile SDK prevents attacks against mobile application APIs by impersonation and emulation bots. 31 Detection Protection
  32. 32. Cloudflare Bot Management Differentiation 32 Integrated Complete not Complex Cloudflare Bot Management is best-in-class both as a stand-alone solution and as integrated with WAF and DDoS protection: ● Streamlines deployment by integrating with a CDN and smart routing for origin traffic. ● Shares control plane through UI and API with WAF and Firewall Rules for better consistency and lower context switching ● Gives a holistic view through common analytics and logs Deploys a bot management solution against a full range of bot attacks with a single click: ● Deploys protections against content/price scraping, credential and credit card stuffing, content spam, and inventory hoarding -- all in one click. ● Fingerprints all traffic without requiring Javascript injection ● Suggested rules work out-of-the box. No fiddling and endless configuration required to get solid results Smart Data Cloudflare Bot Management leverages the trillions of requests per day processed from protecting 13M+ Internet properties: ● Machine learning trains on data curated from 475B requests per day and analyzed on a state-of-the-art GPU cluster ● Our data set contains traffic from over 150 countries ● Learnings from one website are immediately applied to the whole network
  33. 33. Summary 33 How DDoS is evolving Why should bot management also be part of your DDoS mitigation strategy How Cloudflare helps you address these challenges
  34. 34. Questions?
  35. 35. Thank You

×