SlideShare a Scribd company logo
© 2017 Imperva, Inc. All rights reserved.
Blocking a 650 Gbps DDoS
Attack Over Lunch
Robert Hamilton – Imperva Incapsula
Infosecurity Europe – June 2017
© 2017 Imperva, Inc. All rights reserved.2
DDoS Attacks
Bigger than ever
2009 2012 2014 2016
100
300
500
700
2017
1,000
60 Gbps
300 Gbps
1 Tbps
(Dyn)
600 Gbps
(Krebs Blog)
Data blast equal to 15 HD movies per SECOND
© 2017 Imperva, Inc. All rights reserved.
DDoS Mitigation
It Takes a Monster
3
• A mighty animal
• Something of monstrous size
• A Behemoth
– Massive throughput
– Software intensive
– Designed and built by us
© 2017 Imperva, Inc. All rights reserved. Confidential4
21 December 2016
© 2017 Imperva, Inc. All rights reserved.
Lunchtime at the NOC, 08:56:00 UTC
Confidential6
Throughput
Stress test
© 2017 Imperva, Inc. All rights reserved. Confidential7
Let’s Go Back in Time…
© 2017 Imperva, Inc. All rights reserved.8
Before Behemoth
© 2017 Imperva, Inc. All rights reserved.
Performance Challenges
Start Measuring Everything as Early as Possible
Detection Core
Brain
75% CPU
Muscle
99% CPU
Mitigation Core
© 2017 Imperva, Inc. All rights reserved.
Mitigation by HW
Process packets at line rate using software
The “brain” detects and applies the right mitigation policy
Brain then offloads mitigation to specially designed hardware
© 2017 Imperva, Inc. All rights reserved. Confidential11
Before Behemoth
© 2017 Imperva, Inc. All rights reserved. Confidential12
After Behemoth
© 2017 Imperva, Inc. All rights reserved. Confidential13
21 December 2016
Confidential14
650Gbps Throughput
Hit wave
Behemoth
Networked Behemoths
© 2017 Imperva, Inc. All rights reserved.
Layered Network
• 20 x Local PoPs – 40G
– CDN, small/medium size DDoS
– Serve limited regions
• 10 x Super PoPs – 500G
– Large DDoS
– Cover gaps and out of region traffic
Confidential15
We Optimize for Both CDN and DDoS
Europe Network
© 2017 Imperva, Inc. All rights reserved.
Want the Full Story?
Clear here to read the blog “650Gbps DDoS Attack from the Leet Botnet”
https://www.incapsula.com/blog/650gbps-ddos-attack-leet-botnet.html
Confidential16
How We Blocked a 650Gb DDoS Attack Over Lunch

More Related Content

What's hot

Cloud Surfing: Kubernetes on Mesos
Cloud Surfing: Kubernetes on MesosCloud Surfing: Kubernetes on Mesos
Cloud Surfing: Kubernetes on Mesos
KubeAcademy
 
Secure your Hadoop clusters with BlueTalon SecureAccess for WebHDFS
Secure your Hadoop clusters with BlueTalon SecureAccess for WebHDFSSecure your Hadoop clusters with BlueTalon SecureAccess for WebHDFS
Secure your Hadoop clusters with BlueTalon SecureAccess for WebHDFS
Isabelle Dumont
 
Women Who Code
Women Who CodeWomen Who Code
Women Who Code
Everett Toews
 
CloudFlare DDoS attacks 101: what are they and how to protect your site?
CloudFlare DDoS attacks 101: what are they and how to protect your site?CloudFlare DDoS attacks 101: what are they and how to protect your site?
CloudFlare DDoS attacks 101: what are they and how to protect your site?
Cloudflare
 
Students to Business Day 2012: Maarten Balliauw
Students to Business Day 2012: Maarten BalliauwStudents to Business Day 2012: Maarten Balliauw
Students to Business Day 2012: Maarten BalliauwFrederik De Bruyne
 
Rhipe @Netpluz CS Event Nov 2017
Rhipe @Netpluz CS Event Nov 2017Rhipe @Netpluz CS Event Nov 2017
Rhipe @Netpluz CS Event Nov 2017
Netpluz Asia Pte Ltd
 
PLNOG19 - Sławomir Janukowicz - Zestaw uzbrojenia na wyposażeniu wykonujących...
PLNOG19 - Sławomir Janukowicz - Zestaw uzbrojenia na wyposażeniu wykonujących...PLNOG19 - Sławomir Janukowicz - Zestaw uzbrojenia na wyposażeniu wykonujących...
PLNOG19 - Sławomir Janukowicz - Zestaw uzbrojenia na wyposażeniu wykonujących...
PROIDEA
 

What's hot (7)

Cloud Surfing: Kubernetes on Mesos
Cloud Surfing: Kubernetes on MesosCloud Surfing: Kubernetes on Mesos
Cloud Surfing: Kubernetes on Mesos
 
Secure your Hadoop clusters with BlueTalon SecureAccess for WebHDFS
Secure your Hadoop clusters with BlueTalon SecureAccess for WebHDFSSecure your Hadoop clusters with BlueTalon SecureAccess for WebHDFS
Secure your Hadoop clusters with BlueTalon SecureAccess for WebHDFS
 
Women Who Code
Women Who CodeWomen Who Code
Women Who Code
 
CloudFlare DDoS attacks 101: what are they and how to protect your site?
CloudFlare DDoS attacks 101: what are they and how to protect your site?CloudFlare DDoS attacks 101: what are they and how to protect your site?
CloudFlare DDoS attacks 101: what are they and how to protect your site?
 
Students to Business Day 2012: Maarten Balliauw
Students to Business Day 2012: Maarten BalliauwStudents to Business Day 2012: Maarten Balliauw
Students to Business Day 2012: Maarten Balliauw
 
Rhipe @Netpluz CS Event Nov 2017
Rhipe @Netpluz CS Event Nov 2017Rhipe @Netpluz CS Event Nov 2017
Rhipe @Netpluz CS Event Nov 2017
 
PLNOG19 - Sławomir Janukowicz - Zestaw uzbrojenia na wyposażeniu wykonujących...
PLNOG19 - Sławomir Janukowicz - Zestaw uzbrojenia na wyposażeniu wykonujących...PLNOG19 - Sławomir Janukowicz - Zestaw uzbrojenia na wyposażeniu wykonujących...
PLNOG19 - Sławomir Janukowicz - Zestaw uzbrojenia na wyposażeniu wykonujących...
 

Viewers also liked

Imperva ppt
Imperva pptImperva ppt
Imperva ppt
Imperva
 
Extend Enterprise Application-level Security to Your AWS Environment
Extend Enterprise Application-level Security to Your AWS EnvironmentExtend Enterprise Application-level Security to Your AWS Environment
Extend Enterprise Application-level Security to Your AWS Environment
Imperva
 
Database Security, Better Audits, Lower Costs
Database Security, Better Audits, Lower CostsDatabase Security, Better Audits, Lower Costs
Database Security, Better Audits, Lower Costs
Imperva
 
5 Steps to a Secure Hybrid Architecture - Session Sponsored by Palo Alto Netw...
5 Steps to a Secure Hybrid Architecture - Session Sponsored by Palo Alto Netw...5 Steps to a Secure Hybrid Architecture - Session Sponsored by Palo Alto Netw...
5 Steps to a Secure Hybrid Architecture - Session Sponsored by Palo Alto Netw...
Amazon Web Services
 
20171109 Amazon EC2 GPUインスタンス最新動向 P3 instance
20171109 Amazon EC2 GPUインスタンス最新動向 P3 instance20171109 Amazon EC2 GPUインスタンス最新動向 P3 instance
20171109 Amazon EC2 GPUインスタンス最新動向 P3 instance
Amazon Web Services Japan
 
Licensing Windows Workloads on AWS - AWS Online Tech Talks
Licensing Windows Workloads on AWS - AWS Online Tech TalksLicensing Windows Workloads on AWS - AWS Online Tech Talks
Licensing Windows Workloads on AWS - AWS Online Tech Talks
Amazon Web Services
 
AWS Step Functions - Dev lounge Express Edition.pdf
AWS Step Functions - Dev lounge Express Edition.pdfAWS Step Functions - Dev lounge Express Edition.pdf
AWS Step Functions - Dev lounge Express Edition.pdf
Amazon Web Services
 
AWS AI Solutions
AWS AI SolutionsAWS AI Solutions
AWS AI Solutions
Amazon Web Services Japan
 

Viewers also liked (8)

Imperva ppt
Imperva pptImperva ppt
Imperva ppt
 
Extend Enterprise Application-level Security to Your AWS Environment
Extend Enterprise Application-level Security to Your AWS EnvironmentExtend Enterprise Application-level Security to Your AWS Environment
Extend Enterprise Application-level Security to Your AWS Environment
 
Database Security, Better Audits, Lower Costs
Database Security, Better Audits, Lower CostsDatabase Security, Better Audits, Lower Costs
Database Security, Better Audits, Lower Costs
 
5 Steps to a Secure Hybrid Architecture - Session Sponsored by Palo Alto Netw...
5 Steps to a Secure Hybrid Architecture - Session Sponsored by Palo Alto Netw...5 Steps to a Secure Hybrid Architecture - Session Sponsored by Palo Alto Netw...
5 Steps to a Secure Hybrid Architecture - Session Sponsored by Palo Alto Netw...
 
20171109 Amazon EC2 GPUインスタンス最新動向 P3 instance
20171109 Amazon EC2 GPUインスタンス最新動向 P3 instance20171109 Amazon EC2 GPUインスタンス最新動向 P3 instance
20171109 Amazon EC2 GPUインスタンス最新動向 P3 instance
 
Licensing Windows Workloads on AWS - AWS Online Tech Talks
Licensing Windows Workloads on AWS - AWS Online Tech TalksLicensing Windows Workloads on AWS - AWS Online Tech Talks
Licensing Windows Workloads on AWS - AWS Online Tech Talks
 
AWS Step Functions - Dev lounge Express Edition.pdf
AWS Step Functions - Dev lounge Express Edition.pdfAWS Step Functions - Dev lounge Express Edition.pdf
AWS Step Functions - Dev lounge Express Edition.pdf
 
AWS AI Solutions
AWS AI SolutionsAWS AI Solutions
AWS AI Solutions
 

Similar to How We Blocked a 650Gb DDoS Attack Over Lunch

D3TLV17- Advanced DDoS Mitigation Techniques
D3TLV17- Advanced DDoS Mitigation TechniquesD3TLV17- Advanced DDoS Mitigation Techniques
D3TLV17- Advanced DDoS Mitigation Techniques
Imperva Incapsula
 
D3TLV17- Keeping it Safe
D3TLV17-  Keeping it SafeD3TLV17-  Keeping it Safe
D3TLV17- Keeping it Safe
Imperva Incapsula
 
Cloud Migration with Confidence: 7 Keys to Success
Cloud Migration with Confidence: 7 Keys to SuccessCloud Migration with Confidence: 7 Keys to Success
Cloud Migration with Confidence: 7 Keys to Success
New Relic
 
Small Cell Forum: Security Briefing
Small Cell Forum: Security BriefingSmall Cell Forum: Security Briefing
Small Cell Forum: Security Briefing
Small Cell Forum
 
Journey to the Modern App with Containers, Microservices and Big Data
Journey to the Modern App with Containers, Microservices and Big DataJourney to the Modern App with Containers, Microservices and Big Data
Journey to the Modern App with Containers, Microservices and Big Data
Lightbend
 
Powering Predictive Mapping at Scale with Spark, Kafka, and Elastic Search: S...
Powering Predictive Mapping at Scale with Spark, Kafka, and Elastic Search: S...Powering Predictive Mapping at Scale with Spark, Kafka, and Elastic Search: S...
Powering Predictive Mapping at Scale with Spark, Kafka, and Elastic Search: S...
Spark Summit
 
How to Use the TICK Stack, CoreOS, & Docker to Make Your SaaS Offering Better
How to Use the TICK Stack, CoreOS, & Docker to Make Your SaaS Offering BetterHow to Use the TICK Stack, CoreOS, & Docker to Make Your SaaS Offering Better
How to Use the TICK Stack, CoreOS, & Docker to Make Your SaaS Offering Better
Deborah Schalm
 
How to Use the TICK Stack, CoreOS, & Docker to Make Your SaaS Offering Better
How to Use the TICK Stack, CoreOS, & Docker to Make Your SaaS Offering BetterHow to Use the TICK Stack, CoreOS, & Docker to Make Your SaaS Offering Better
How to Use the TICK Stack, CoreOS, & Docker to Make Your SaaS Offering Better
DevOps.com
 
The Open Sourcing of Infrastructure
The Open Sourcing of InfrastructureThe Open Sourcing of Infrastructure
The Open Sourcing of Infrastructure
All Things Open
 
PuppetConf 2017 | Adobe Advertising Cloud: A Lean Puppet Workflow to Support ...
PuppetConf 2017 | Adobe Advertising Cloud: A Lean Puppet Workflow to Support ...PuppetConf 2017 | Adobe Advertising Cloud: A Lean Puppet Workflow to Support ...
PuppetConf 2017 | Adobe Advertising Cloud: A Lean Puppet Workflow to Support ...
Nicolas Brousse
 
PuppetConf 2017: Adobe Advertising Cloud: Lean Puppet Workflow to Support Mul...
PuppetConf 2017: Adobe Advertising Cloud: Lean Puppet Workflow to Support Mul...PuppetConf 2017: Adobe Advertising Cloud: Lean Puppet Workflow to Support Mul...
PuppetConf 2017: Adobe Advertising Cloud: Lean Puppet Workflow to Support Mul...
Puppet
 
The Stakes Have Changed – The Changing Security Landscape by Tony Teo
The Stakes Have Changed – The Changing Security Landscape by Tony TeoThe Stakes Have Changed – The Changing Security Landscape by Tony Teo
The Stakes Have Changed – The Changing Security Landscape by Tony Teo
MyNOG
 
A Journey to Modern Apps with Containers, Microservices and Big Data
A Journey to Modern Apps with Containers, Microservices and Big DataA Journey to Modern Apps with Containers, Microservices and Big Data
A Journey to Modern Apps with Containers, Microservices and Big Data
Edward Hsu
 
Cisco Connect 2018 Malaysia - Changing the equation-cybersecurity in digital ...
Cisco Connect 2018 Malaysia - Changing the equation-cybersecurity in digital ...Cisco Connect 2018 Malaysia - Changing the equation-cybersecurity in digital ...
Cisco Connect 2018 Malaysia - Changing the equation-cybersecurity in digital ...
NetworkCollaborators
 
Ansible Case Studies
Ansible Case StudiesAnsible Case Studies
Ansible Case Studies
Greg DeKoenigsberg
 
AI saturdays Nigeria
AI saturdays Nigeria AI saturdays Nigeria
AI saturdays Nigeria
Damon Civin
 
Powering Predictive Mapping at Scale with Spark, Kafka, and Elastic Search wi...
Powering Predictive Mapping at Scale with Spark, Kafka, and Elastic Search wi...Powering Predictive Mapping at Scale with Spark, Kafka, and Elastic Search wi...
Powering Predictive Mapping at Scale with Spark, Kafka, and Elastic Search wi...
Databricks
 
MAE304-Turners Cloud Archive for CNN's Video Library and Global Multiplatform...
MAE304-Turners Cloud Archive for CNN's Video Library and Global Multiplatform...MAE304-Turners Cloud Archive for CNN's Video Library and Global Multiplatform...
MAE304-Turners Cloud Archive for CNN's Video Library and Global Multiplatform...
Amazon Web Services
 
Partner Webinar: Mesosphere and DSE: Production-Proven Infrastructure for Fas...
Partner Webinar: Mesosphere and DSE: Production-Proven Infrastructure for Fas...Partner Webinar: Mesosphere and DSE: Production-Proven Infrastructure for Fas...
Partner Webinar: Mesosphere and DSE: Production-Proven Infrastructure for Fas...
DataStax
 
Airbnb Runs on Amazon Aurora - DAT331 - re:Invent 2017
Airbnb Runs on Amazon Aurora - DAT331 - re:Invent 2017Airbnb Runs on Amazon Aurora - DAT331 - re:Invent 2017
Airbnb Runs on Amazon Aurora - DAT331 - re:Invent 2017
Amazon Web Services
 

Similar to How We Blocked a 650Gb DDoS Attack Over Lunch (20)

D3TLV17- Advanced DDoS Mitigation Techniques
D3TLV17- Advanced DDoS Mitigation TechniquesD3TLV17- Advanced DDoS Mitigation Techniques
D3TLV17- Advanced DDoS Mitigation Techniques
 
D3TLV17- Keeping it Safe
D3TLV17-  Keeping it SafeD3TLV17-  Keeping it Safe
D3TLV17- Keeping it Safe
 
Cloud Migration with Confidence: 7 Keys to Success
Cloud Migration with Confidence: 7 Keys to SuccessCloud Migration with Confidence: 7 Keys to Success
Cloud Migration with Confidence: 7 Keys to Success
 
Small Cell Forum: Security Briefing
Small Cell Forum: Security BriefingSmall Cell Forum: Security Briefing
Small Cell Forum: Security Briefing
 
Journey to the Modern App with Containers, Microservices and Big Data
Journey to the Modern App with Containers, Microservices and Big DataJourney to the Modern App with Containers, Microservices and Big Data
Journey to the Modern App with Containers, Microservices and Big Data
 
Powering Predictive Mapping at Scale with Spark, Kafka, and Elastic Search: S...
Powering Predictive Mapping at Scale with Spark, Kafka, and Elastic Search: S...Powering Predictive Mapping at Scale with Spark, Kafka, and Elastic Search: S...
Powering Predictive Mapping at Scale with Spark, Kafka, and Elastic Search: S...
 
How to Use the TICK Stack, CoreOS, & Docker to Make Your SaaS Offering Better
How to Use the TICK Stack, CoreOS, & Docker to Make Your SaaS Offering BetterHow to Use the TICK Stack, CoreOS, & Docker to Make Your SaaS Offering Better
How to Use the TICK Stack, CoreOS, & Docker to Make Your SaaS Offering Better
 
How to Use the TICK Stack, CoreOS, & Docker to Make Your SaaS Offering Better
How to Use the TICK Stack, CoreOS, & Docker to Make Your SaaS Offering BetterHow to Use the TICK Stack, CoreOS, & Docker to Make Your SaaS Offering Better
How to Use the TICK Stack, CoreOS, & Docker to Make Your SaaS Offering Better
 
The Open Sourcing of Infrastructure
The Open Sourcing of InfrastructureThe Open Sourcing of Infrastructure
The Open Sourcing of Infrastructure
 
PuppetConf 2017 | Adobe Advertising Cloud: A Lean Puppet Workflow to Support ...
PuppetConf 2017 | Adobe Advertising Cloud: A Lean Puppet Workflow to Support ...PuppetConf 2017 | Adobe Advertising Cloud: A Lean Puppet Workflow to Support ...
PuppetConf 2017 | Adobe Advertising Cloud: A Lean Puppet Workflow to Support ...
 
PuppetConf 2017: Adobe Advertising Cloud: Lean Puppet Workflow to Support Mul...
PuppetConf 2017: Adobe Advertising Cloud: Lean Puppet Workflow to Support Mul...PuppetConf 2017: Adobe Advertising Cloud: Lean Puppet Workflow to Support Mul...
PuppetConf 2017: Adobe Advertising Cloud: Lean Puppet Workflow to Support Mul...
 
The Stakes Have Changed – The Changing Security Landscape by Tony Teo
The Stakes Have Changed – The Changing Security Landscape by Tony TeoThe Stakes Have Changed – The Changing Security Landscape by Tony Teo
The Stakes Have Changed – The Changing Security Landscape by Tony Teo
 
A Journey to Modern Apps with Containers, Microservices and Big Data
A Journey to Modern Apps with Containers, Microservices and Big DataA Journey to Modern Apps with Containers, Microservices and Big Data
A Journey to Modern Apps with Containers, Microservices and Big Data
 
Cisco Connect 2018 Malaysia - Changing the equation-cybersecurity in digital ...
Cisco Connect 2018 Malaysia - Changing the equation-cybersecurity in digital ...Cisco Connect 2018 Malaysia - Changing the equation-cybersecurity in digital ...
Cisco Connect 2018 Malaysia - Changing the equation-cybersecurity in digital ...
 
Ansible Case Studies
Ansible Case StudiesAnsible Case Studies
Ansible Case Studies
 
AI saturdays Nigeria
AI saturdays Nigeria AI saturdays Nigeria
AI saturdays Nigeria
 
Powering Predictive Mapping at Scale with Spark, Kafka, and Elastic Search wi...
Powering Predictive Mapping at Scale with Spark, Kafka, and Elastic Search wi...Powering Predictive Mapping at Scale with Spark, Kafka, and Elastic Search wi...
Powering Predictive Mapping at Scale with Spark, Kafka, and Elastic Search wi...
 
MAE304-Turners Cloud Archive for CNN's Video Library and Global Multiplatform...
MAE304-Turners Cloud Archive for CNN's Video Library and Global Multiplatform...MAE304-Turners Cloud Archive for CNN's Video Library and Global Multiplatform...
MAE304-Turners Cloud Archive for CNN's Video Library and Global Multiplatform...
 
Partner Webinar: Mesosphere and DSE: Production-Proven Infrastructure for Fas...
Partner Webinar: Mesosphere and DSE: Production-Proven Infrastructure for Fas...Partner Webinar: Mesosphere and DSE: Production-Proven Infrastructure for Fas...
Partner Webinar: Mesosphere and DSE: Production-Proven Infrastructure for Fas...
 
Airbnb Runs on Amazon Aurora - DAT331 - re:Invent 2017
Airbnb Runs on Amazon Aurora - DAT331 - re:Invent 2017Airbnb Runs on Amazon Aurora - DAT331 - re:Invent 2017
Airbnb Runs on Amazon Aurora - DAT331 - re:Invent 2017
 

More from Imperva

Cybersecurity and Healthcare - HIMSS 2018 Survey
Cybersecurity and Healthcare - HIMSS 2018 SurveyCybersecurity and Healthcare - HIMSS 2018 Survey
Cybersecurity and Healthcare - HIMSS 2018 Survey
Imperva
 
API Security Survey
API Security SurveyAPI Security Survey
API Security Survey
Imperva
 
Beyond takeover: stories from a hacked account
Beyond takeover: stories from a hacked accountBeyond takeover: stories from a hacked account
Beyond takeover: stories from a hacked account
Imperva
 
Research: From zero to phishing in 60 seconds
Research: From zero to phishing in 60 seconds Research: From zero to phishing in 60 seconds
Research: From zero to phishing in 60 seconds
Imperva
 
Making Sense of Web Attacks: From Alerts to Narratives
Making Sense of Web Attacks: From Alerts to NarrativesMaking Sense of Web Attacks: From Alerts to Narratives
Making Sense of Web Attacks: From Alerts to Narratives
Imperva
 
Survey: Insider Threats and Cyber Security
Survey: Insider Threats and Cyber SecuritySurvey: Insider Threats and Cyber Security
Survey: Insider Threats and Cyber Security
Imperva
 
Companies Aware, but Not Prepared for GDPR
Companies Aware, but Not Prepared for GDPRCompanies Aware, but Not Prepared for GDPR
Companies Aware, but Not Prepared for GDPR
Imperva
 
Rise of Ransomware
Rise of Ransomware Rise of Ransomware
Rise of Ransomware
Imperva
 
7 Tips to Protect Your Data from Contractors and Privileged Vendors
7 Tips to Protect Your Data from Contractors and Privileged Vendors7 Tips to Protect Your Data from Contractors and Privileged Vendors
7 Tips to Protect Your Data from Contractors and Privileged Vendors
Imperva
 
SEO Botnet Sophistication
SEO Botnet SophisticationSEO Botnet Sophistication
SEO Botnet Sophistication
Imperva
 
Phishing Made Easy
Phishing Made EasyPhishing Made Easy
Phishing Made Easy
Imperva
 
Imperva 2017 Cyber Threat Defense Report
Imperva 2017 Cyber Threat Defense ReportImperva 2017 Cyber Threat Defense Report
Imperva 2017 Cyber Threat Defense Report
Imperva
 
Combat Payment Card Attacks with WAF and Threat Intelligence
Combat Payment Card Attacks with WAF and Threat IntelligenceCombat Payment Card Attacks with WAF and Threat Intelligence
Combat Payment Card Attacks with WAF and Threat Intelligence
Imperva
 
HTTP/2: Faster Doesn't Mean Safer, Attack Surface Growing Exponentially
HTTP/2: Faster Doesn't Mean Safer, Attack Surface Growing ExponentiallyHTTP/2: Faster Doesn't Mean Safer, Attack Surface Growing Exponentially
HTTP/2: Faster Doesn't Mean Safer, Attack Surface Growing Exponentially
Imperva
 
Get Going With Your GDPR Plan
Get Going With Your GDPR PlanGet Going With Your GDPR Plan
Get Going With Your GDPR Plan
Imperva
 
Cyber Criminal's Path To Your Data
Cyber Criminal's Path To Your DataCyber Criminal's Path To Your Data
Cyber Criminal's Path To Your Data
Imperva
 
Combat Today's Threats With A Single Platform For App and Data Security
Combat Today's Threats With A Single Platform For App and Data SecurityCombat Today's Threats With A Single Platform For App and Data Security
Combat Today's Threats With A Single Platform For App and Data Security
Imperva
 
Hacking HTTP/2 : New attacks on the Internet’s Next Generation Foundation
Hacking HTTP/2: New attacks on the Internet’s Next Generation FoundationHacking HTTP/2: New attacks on the Internet’s Next Generation Foundation
Hacking HTTP/2 : New attacks on the Internet’s Next Generation Foundation
Imperva
 
Gartner MQ for Web App Firewall Webinar
Gartner MQ for Web App Firewall WebinarGartner MQ for Web App Firewall Webinar
Gartner MQ for Web App Firewall Webinar
Imperva
 
More Databases. More Hackers. More Audits.
More Databases. More Hackers. More Audits.More Databases. More Hackers. More Audits.
More Databases. More Hackers. More Audits.
Imperva
 

More from Imperva (20)

Cybersecurity and Healthcare - HIMSS 2018 Survey
Cybersecurity and Healthcare - HIMSS 2018 SurveyCybersecurity and Healthcare - HIMSS 2018 Survey
Cybersecurity and Healthcare - HIMSS 2018 Survey
 
API Security Survey
API Security SurveyAPI Security Survey
API Security Survey
 
Beyond takeover: stories from a hacked account
Beyond takeover: stories from a hacked accountBeyond takeover: stories from a hacked account
Beyond takeover: stories from a hacked account
 
Research: From zero to phishing in 60 seconds
Research: From zero to phishing in 60 seconds Research: From zero to phishing in 60 seconds
Research: From zero to phishing in 60 seconds
 
Making Sense of Web Attacks: From Alerts to Narratives
Making Sense of Web Attacks: From Alerts to NarrativesMaking Sense of Web Attacks: From Alerts to Narratives
Making Sense of Web Attacks: From Alerts to Narratives
 
Survey: Insider Threats and Cyber Security
Survey: Insider Threats and Cyber SecuritySurvey: Insider Threats and Cyber Security
Survey: Insider Threats and Cyber Security
 
Companies Aware, but Not Prepared for GDPR
Companies Aware, but Not Prepared for GDPRCompanies Aware, but Not Prepared for GDPR
Companies Aware, but Not Prepared for GDPR
 
Rise of Ransomware
Rise of Ransomware Rise of Ransomware
Rise of Ransomware
 
7 Tips to Protect Your Data from Contractors and Privileged Vendors
7 Tips to Protect Your Data from Contractors and Privileged Vendors7 Tips to Protect Your Data from Contractors and Privileged Vendors
7 Tips to Protect Your Data from Contractors and Privileged Vendors
 
SEO Botnet Sophistication
SEO Botnet SophisticationSEO Botnet Sophistication
SEO Botnet Sophistication
 
Phishing Made Easy
Phishing Made EasyPhishing Made Easy
Phishing Made Easy
 
Imperva 2017 Cyber Threat Defense Report
Imperva 2017 Cyber Threat Defense ReportImperva 2017 Cyber Threat Defense Report
Imperva 2017 Cyber Threat Defense Report
 
Combat Payment Card Attacks with WAF and Threat Intelligence
Combat Payment Card Attacks with WAF and Threat IntelligenceCombat Payment Card Attacks with WAF and Threat Intelligence
Combat Payment Card Attacks with WAF and Threat Intelligence
 
HTTP/2: Faster Doesn't Mean Safer, Attack Surface Growing Exponentially
HTTP/2: Faster Doesn't Mean Safer, Attack Surface Growing ExponentiallyHTTP/2: Faster Doesn't Mean Safer, Attack Surface Growing Exponentially
HTTP/2: Faster Doesn't Mean Safer, Attack Surface Growing Exponentially
 
Get Going With Your GDPR Plan
Get Going With Your GDPR PlanGet Going With Your GDPR Plan
Get Going With Your GDPR Plan
 
Cyber Criminal's Path To Your Data
Cyber Criminal's Path To Your DataCyber Criminal's Path To Your Data
Cyber Criminal's Path To Your Data
 
Combat Today's Threats With A Single Platform For App and Data Security
Combat Today's Threats With A Single Platform For App and Data SecurityCombat Today's Threats With A Single Platform For App and Data Security
Combat Today's Threats With A Single Platform For App and Data Security
 
Hacking HTTP/2 : New attacks on the Internet’s Next Generation Foundation
Hacking HTTP/2: New attacks on the Internet’s Next Generation FoundationHacking HTTP/2: New attacks on the Internet’s Next Generation Foundation
Hacking HTTP/2 : New attacks on the Internet’s Next Generation Foundation
 
Gartner MQ for Web App Firewall Webinar
Gartner MQ for Web App Firewall WebinarGartner MQ for Web App Firewall Webinar
Gartner MQ for Web App Firewall Webinar
 
More Databases. More Hackers. More Audits.
More Databases. More Hackers. More Audits.More Databases. More Hackers. More Audits.
More Databases. More Hackers. More Audits.
 

Recently uploaded

PCI PIN Basics Webinar from the Controlcase Team
PCI PIN Basics Webinar from the Controlcase TeamPCI PIN Basics Webinar from the Controlcase Team
PCI PIN Basics Webinar from the Controlcase Team
ControlCase
 
Assuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyesAssuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyes
ThousandEyes
 
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdfFIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance
 
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdfFIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance
 
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
Product School
 
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
Product School
 
The Future of Platform Engineering
The Future of Platform EngineeringThe Future of Platform Engineering
The Future of Platform Engineering
Jemma Hussein Allen
 
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Albert Hoitingh
 
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Jeffrey Haguewood
 
JMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and GrafanaJMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and Grafana
RTTS
 
DevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA ConnectDevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA Connect
Kari Kakkonen
 
GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...
GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...
GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...
Sri Ambati
 
Neuro-symbolic is not enough, we need neuro-*semantic*
Neuro-symbolic is not enough, we need neuro-*semantic*Neuro-symbolic is not enough, we need neuro-*semantic*
Neuro-symbolic is not enough, we need neuro-*semantic*
Frank van Harmelen
 
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
Product School
 
Designing Great Products: The Power of Design and Leadership by Chief Designe...
Designing Great Products: The Power of Design and Leadership by Chief Designe...Designing Great Products: The Power of Design and Leadership by Chief Designe...
Designing Great Products: The Power of Design and Leadership by Chief Designe...
Product School
 
GraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge GraphGraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge Graph
Guy Korland
 
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
Product School
 
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
James Anderson
 
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdfFIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance
 
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered QualitySoftware Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Inflectra
 

Recently uploaded (20)

PCI PIN Basics Webinar from the Controlcase Team
PCI PIN Basics Webinar from the Controlcase TeamPCI PIN Basics Webinar from the Controlcase Team
PCI PIN Basics Webinar from the Controlcase Team
 
Assuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyesAssuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyes
 
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdfFIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
 
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdfFIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
 
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
 
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
 
The Future of Platform Engineering
The Future of Platform EngineeringThe Future of Platform Engineering
The Future of Platform Engineering
 
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
 
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
 
JMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and GrafanaJMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and Grafana
 
DevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA ConnectDevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA Connect
 
GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...
GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...
GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...
 
Neuro-symbolic is not enough, we need neuro-*semantic*
Neuro-symbolic is not enough, we need neuro-*semantic*Neuro-symbolic is not enough, we need neuro-*semantic*
Neuro-symbolic is not enough, we need neuro-*semantic*
 
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
 
Designing Great Products: The Power of Design and Leadership by Chief Designe...
Designing Great Products: The Power of Design and Leadership by Chief Designe...Designing Great Products: The Power of Design and Leadership by Chief Designe...
Designing Great Products: The Power of Design and Leadership by Chief Designe...
 
GraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge GraphGraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge Graph
 
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
 
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
 
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdfFIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
 
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered QualitySoftware Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
 

How We Blocked a 650Gb DDoS Attack Over Lunch

  • 1. © 2017 Imperva, Inc. All rights reserved. Blocking a 650 Gbps DDoS Attack Over Lunch Robert Hamilton – Imperva Incapsula Infosecurity Europe – June 2017
  • 2. © 2017 Imperva, Inc. All rights reserved.2 DDoS Attacks Bigger than ever 2009 2012 2014 2016 100 300 500 700 2017 1,000 60 Gbps 300 Gbps 1 Tbps (Dyn) 600 Gbps (Krebs Blog) Data blast equal to 15 HD movies per SECOND
  • 3. © 2017 Imperva, Inc. All rights reserved. DDoS Mitigation It Takes a Monster 3 • A mighty animal • Something of monstrous size • A Behemoth – Massive throughput – Software intensive – Designed and built by us
  • 4. © 2017 Imperva, Inc. All rights reserved. Confidential4 21 December 2016
  • 5. © 2017 Imperva, Inc. All rights reserved. Lunchtime at the NOC, 08:56:00 UTC
  • 7. © 2017 Imperva, Inc. All rights reserved. Confidential7 Let’s Go Back in Time…
  • 8. © 2017 Imperva, Inc. All rights reserved.8 Before Behemoth
  • 9. © 2017 Imperva, Inc. All rights reserved. Performance Challenges Start Measuring Everything as Early as Possible Detection Core Brain 75% CPU Muscle 99% CPU Mitigation Core
  • 10. © 2017 Imperva, Inc. All rights reserved. Mitigation by HW Process packets at line rate using software The “brain” detects and applies the right mitigation policy Brain then offloads mitigation to specially designed hardware
  • 11. © 2017 Imperva, Inc. All rights reserved. Confidential11 Before Behemoth
  • 12. © 2017 Imperva, Inc. All rights reserved. Confidential12 After Behemoth
  • 13. © 2017 Imperva, Inc. All rights reserved. Confidential13 21 December 2016
  • 15. © 2017 Imperva, Inc. All rights reserved. Layered Network • 20 x Local PoPs – 40G – CDN, small/medium size DDoS – Serve limited regions • 10 x Super PoPs – 500G – Large DDoS – Cover gaps and out of region traffic Confidential15 We Optimize for Both CDN and DDoS Europe Network
  • 16. © 2017 Imperva, Inc. All rights reserved. Want the Full Story? Clear here to read the blog “650Gbps DDoS Attack from the Leet Botnet” https://www.incapsula.com/blog/650gbps-ddos-attack-leet-botnet.html Confidential16