ARBOR PRESENTATION - SHARING SESSION - 1.pptx

arbor anti ddos presentation

1. SHARING SESSION ARBOR A NTI – DDOS

2. CYBER SECURITY RESILIENCE Process – People - Technology Process Technology People 2

3. WHY WE NEED ANTI-DDOS? 3 What are DoS? DDoS is Distributed Denial of Service. Hacker use Bots or free proxy servers send large attack traffic for aim-servers and cause the servers deny of service for normal users. DDOS Attacks Characteristics Volumetric : Large botnets or spoofed IP ti generate a lot of traffic. Using UDP-based traffic to take advantage of connectionless protocol. (Flood) State Exhaustion : Using TCP based attack to take advantage stateful nature of TCP. (Buffer overflow) DDOS Affect More DDOS Affect More

4. GENERATION DENIAL OF SERVICE (DOS) 4 Denial of Service (DoS) Distributed Denial of Service (DDoS) Distributed Reflected Denial of Service ( DRDoS )

5. TYPES ATTACK DENIAL OF SERVICE (DOS) Volumetric Attacks TCP State – Exhaustion Attack Application Layer Attacks 5

6. VOLUMETRIC DDOS ATTACKS Volumetric DDoS attacks are designed to overwhelm internal network capacity and even centralized DDoS mitigation scrubbing facilities with significantly high volumes of malicious traffic. Type: ICMP Flood, IP/ICMP Fragmentation, IPSec Flood, UDP Flood, Reflection Amplication Attacks, etc. 6

7. TCP STATE – EXHAUSTION ATTACK State-exhaustion DDoS attacks are primarily focused on taking down services or underlying network infrastructure which is responsible for delivering content to the end users. This might involve an attacker targeting DNS name servers with invalid name queries, thus resulting in increased load on the DNS infrastructure itself, disrupting service as users will no longer be able to connect to the services as the DNS name cannot be resolved to IP addresses. Type: SYN Flood, SSL/TLS Exhaustion, DNS Query/NXDOMAIN Flooding, etc. 7

8. APPLICATION LAYER ATTACKS Application layer DDoS attacks are designed to attack the application itself, focusing on specific vulnerabilities or issues, resulting in the application not being able to deliver content to the user. Application layer attacks are designed to attack specific applications, the most common is web servers, but can include any application such SIP voice services and BGP. Type: BGP Hijacking, Slowloris , Slow Post, Slow Read, HTTP/HTTPS Flooding, Low and Slow Attack, Large Payload POST, Mimicked User Browsing, etc. 8

9. DDOS ATTACK SURFACE 9 ATTACK SURFACE Part if a network or host that is vulnerable to DDoS attack: Surface varies depending on the type of the network. Surface includes all pieces of the network that are exposed to the internet: General Infrastructure (router, switch, load balancer, firewall, etc ) Application. Control plane. Network link. DDoS attack can be crafted to target specific areas of attack surface.

10. FW & IPS BASED SECURITY & DDOS? Firewall and IPS do not solve 100% the DDoS problem because they: Are optimized for other security problems, Can’t detect or stop distributed attack, and Cant’t integrate with in-cloud security problem. 10 Product Family Security Triangle Benefit Firewalls Integrity Enforce network policy to prevent unauthorized access to data. IPS Integrity Block Break-In attempts causing data theft

11. IMPACT OF DDOS ATTACK TO BUSINESS 11 SLA infractions Engineering resources Increased network cost Cleanup cost OPERATIONAL COST Loss of on-line sales Inability to process transaction Customer attrition REVENUE IMPACT Reputation loss Stock value reduction CORPORATE IMAGE

12. EVOLVING TECHNOLOGY TREND 12

13. DDOS GLOBAL ATTACK TRENDS 13

14. THANK YOU 14