A Guide About DDoS Attacks Understanding and anticipating DDoS - - PowerPoint PPT Presentation

a guide about ddos attacks understanding and anticipating
SMART_READER_LITE
LIVE PREVIEW

A Guide About DDoS Attacks Understanding and anticipating DDoS - - PowerPoint PPT Presentation

A Guide About DDoS Attacks Understanding and anticipating DDoS Guillaume Valadon guillaume.valadon@ssi.gouv.fr RIPE 70 - May, 11 2015 ANSSI - http://www.ssi.gouv.fr/guide-ddos & https://goo.gl/UL8M1 1/12 ANSSI Created on July 7th 2009,


slide-1
SLIDE 1

A Guide About DDoS Attacks Understanding and anticipating DDoS

Guillaume Valadon guillaume.valadon@ssi.gouv.fr RIPE 70 - May, 11 2015

ANSSI - http://www.ssi.gouv.fr/guide-ddos & https://goo.gl/UL8M1 1/12

slide-2
SLIDE 2

ANSSI

Created on July 7th 2009, the ANSSI is the national cyberde- fence agency Main missions:

  • Prevention
  • Defence of information systems

One of its priorities is the Internet resilience. http://www.ssi.gouv.fr/en/

ANSSI - http://www.ssi.gouv.fr/guide-ddos & https://goo.gl/UL8M1 2/12

slide-3
SLIDE 3

A guide about DDoS attacks ?

slide-4
SLIDE 4

Why ?

Goal

Give an overview of the existing DDoS protection solutions:

  • Describe each solution
  • Give its scope, and its possible limitations

Target

Mainly for customers of network operators

ANSSI - http://www.ssi.gouv.fr/guide-ddos & https://goo.gl/UL8M1 4/12

slide-5
SLIDE 5

Who ?

Written in cooperation with French network operators

Companies and network operators involved

  • Acorus Networks
  • Bouygues Telecom
  • Cyber Test Systems
  • France-IX
  • Free / Online
  • Jaguar-Network
  • Orange France
  • SFR
  • Zayo France

ANSSI - http://www.ssi.gouv.fr/guide-ddos & https://goo.gl/UL8M1 5/12

slide-6
SLIDE 6

Where ?

Only in French so far

Links

  • Offjcial guide, http://www.ssi.gouv.fr/guide-ddos
  • Light PDF,

https://transfer.sh/11Sij4/guide-ddos.light.pdf

  • Google Translate, https://goo.gl/UL8M1d

ANSSI - http://www.ssi.gouv.fr/guide-ddos & https://goo.gl/UL8M1 6/12

slide-7
SLIDE 7

What is inside ?

  • 1. DDoS attacks
  • What is a DDoS attack ? Who can be targeted ?
  • 2. How to defend against DDoS attacks ?
  • Filtering (at the edge of the network, in the cloud)
  • Dedicated protection services
  • 3. How to react in case of attack ?
  • Attack detection and reaction
  • Incident notifjcation
  • 4. How to avoid participating in a DDoS attack ?
  • Reduce the attack surface, traffjc fjltering

ANSSI - http://www.ssi.gouv.fr/guide-ddos & https://goo.gl/UL8M1 7/12

slide-8
SLIDE 8

How to defend against DDoS attacks ?

Describe each solution, give its scope and limitations

Edge fjltering

  • Limitations of fjrewalls / load balancers
  • Benefjts of dedicated DDoS fjltering equipments, and their lim-

itations as observed by network operators

Filtering capabilities of network operators Dedicated protection services

  • Describe existing traffjc redirection methods (DNS based, rerout-

ing via BGP)

ANSSI - http://www.ssi.gouv.fr/guide-ddos & https://goo.gl/UL8M1 8/12

slide-9
SLIDE 9

How to react to an attack ?

During the attack

  • Identify the target and the nature of the attack (volumetric or

application level attack, protocols used …)

  • Find the sources of the attack (is it possible to list the sources
  • f the attack ? Is it coming from a single provider / transit
  • perator ?)

After the attack

Who to contact in order to declare the incident and to fjle a complaint ?

ANSSI - http://www.ssi.gouv.fr/guide-ddos & https://goo.gl/UL8M1 9/12

slide-10
SLIDE 10

How to avoid participating in a DDoS attack ?

Recalls the best practices ! Disable unused services Harden the confjguration of exposed services (examples : NTP, SNMP) Keep frameworks and CMS up to date. Follow development best practices Filter outbound traffjc to prevent IP address spoofjng

ANSSI - http://www.ssi.gouv.fr/guide-ddos & https://goo.gl/UL8M1 10/12

slide-11
SLIDE 11

Conclusion

Shall it be translated to English ?

How did it work ?

  • Good feedbacks from French NOG
  • Some parts were discussed then fjxed

Please send comments to:

guide.ddos_at_ssi.gouv.fr

ANSSI - http://www.ssi.gouv.fr/guide-ddos & https://goo.gl/UL8M1 11/12

slide-12
SLIDE 12

Questions?

English version at https://goo.gl/UL8M1d

ANSSI - http://www.ssi.gouv.fr/guide-ddos & https://goo.gl/UL8M1 12/12