Visualizing Network Security Threats
•
1 like•1,031 views
This document discusses two major network security threats: BGP hijacks and DDoS attacks. It provides examples of how each threat can disrupt traffic routing and deny service. The document also emphasizes the importance of monitoring networks for these threats. Effective monitoring can help detect attacks early, improve mitigation, and facilitate collaboration to resolve issues.
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to Visualizing Network Security Threats
Similar to Visualizing Network Security Threats (20)
More from ThousandEyes
More from ThousandEyes (20)
Recently uploaded
Recently uploaded (20)
Visualizing Network Security Threats
- 1. Visualizing Network Security Threats Mohit Lad CEO, ThousandEyes
- 2. 2 Two Serious Network Security Threats BGP Hijacks DDoS Attacks Hijacker routes incoming or outgoing traffic to the wrong network Attacker saturates network links, hardware or servers to deny service
- 3. BGP Attacks
- 4. 4 A Primer on BGP Hijacks AS 14340 Salesforce AS 2914 NTT Autonomous System AS 7018 AT&T AS 3356 Level3 Border Router Salesforce advertises routes among BGP peers to upstream ISPs Salesforce.com advertises prefix 96.43.144.0/22 AT&T receives route advertisements to Salesforce via Level3 and NTT AS 4761 Indosat Traffic Path
- 5. 5 A Primer on BGP Hijacks AS 14340 Salesforce AS 2914 NTT AS 7018 AT&T AS 3356 Level3 Indosat also advertises prefix 96.43.144.0/22, ‘hijacking’ Salesforce’s routes AS 4761 Indosat Traffic Path AT&T now directs Salesforce-destined traffic to Indosat
- 6. 6 BGP Hijack: Normal Routes to PayPal PayPal / Akamai prefix Akamai Autonomous System Comcast upstream
- 7. Locations with completely 7 BGP Hijack: Routes Advertised from Indosat PayPal / Akamai prefix Correct Autonomous System Hijacked hijacked routes Autonomous System
- 8. 8 BGP Hijack: PCCW Has No Routes to PayPal PCCW Network only connected to Indosat Not to Akamai / PayPal
- 9. 9 BGP Hijack: Causing All Traffic to Drop Traffic transiting PCCW has no routes and terminates
- 10. DDoS Attacks
- 11. 11 Why Monitor DDoS Attacks Global Availability Mitigation Deployment Mitigation Performance Vendor Collaboration
- 12. 12 Network Topology of DDoS Attack and Mitigation Sydney Portland, OR 1 London YourBank.com Chicago, IL Tokyo Atlanta On-premises appliance at network edge ISP filters traffic with a 2 remote-triggered black hole Cloud-based mitigation 3 provider scrubs traffic Internet Enterprise Scrubbing Center Attackers flood your web service from around the world
- 13. 13 DDoS Attack: Drop in Global Availability Problems at TCP connection and HTTP receive phases Global availability issues Availability dip to 0%
- 14. 14 DDoS Attack: Increased Packet Loss and Latency Loss, latency and jitter Loss during height of attack
- 15. 15 DDoS Attack: Congested Nodes in Upstream ISPs Nodes with >25% packet loss Packet loss in upstream ISPs Verizon and AT&T HSBC bank website under attack High packet loss from all testing points
- 16. 16 DDoS Attack: Mitigation Effectiveness Verisign DDoS mitigation networks in yellow
- 17. 17 DDoS Attack: Mitigation Handoff Using BGP New Autonomous System (VeriSign) Prior Autonomous System (HSBC) HSBC prefix New routes Withdrawn routes
- 18. 18 Tips for Network Threat Monitoring • Monitor critical external services – ISPs, DNS providers • Proactively alert on network stress and faults – Establish baselines and reduce alert fatigue • Record data for future forensics – Preserve detailed outage and attack diagnostics • Establish a procedure to share data – Trusted internal and vendor teams
- 19. It’s time to see the entire picture.