Welcome www.phoenixdatacom.com Phoenix Datacom, our core - - PowerPoint PPT Presentation

▶
welcome
SMART_READER_LITE
LIVE PREVIEW

Welcome www.phoenixdatacom.com Phoenix Datacom, our core - - PowerPoint PPT Presentation

Jul 23, 2023 23 likes •508 views

Protection from DDoS attack is now your responsibility, but help is at hand Mark Tilston, Senior Cyber-Security Engineer PHOENIX DATACOM 2 nd December 2014 Welcome www.phoenixdatacom.com Phoenix Datacom, our core competencies Now in our 30 th

slide-1
SLIDE 1

www.phoenixdatacom.com

Welcome

Protection from DDoS attack is now your responsibility, but help is at hand

Mark Tilston, Senior Cyber-Security Engineer PHOENIX DATACOM 2nd December 2014

slide-2
SLIDE 2

Solutions to enhance the performance & security of your networks & applications

Phoenix Datacom, our core competencies

Network Data Access for Test, Monitoring & Load Balancing Locating just the data you need in order to see further return from your security and monitoring investments Application Performance Monitoring & Improvement Resolving bottlenecks and other issues before they affect the performance of applications and staff productivity Cyber-Security Protection & Testing Protecting your critical infrastructure from the threats of cyber-crime whilst saving you significant time and money Network Performance Testing & Validation Helping you to build, test, validate and monitor your business-critical cloud, physical and virtual networks

Now in our 30th year, Phoenix Datacom is the UK’s most technically competent provider of solutions and professional services to enhance the performance & security of cloud, physical and virtual networks.

Phoenix Datacom, our core competencies Solutions | Support | Professional Services

We serve customers in : Finance | Enterprises | Government/Defence | Carriers | Mobile Operators

slide-3
SLIDE 3

Solutions to enhance the performance & security of your networks & applications

Solution demonstrations available in our….

slide-4
SLIDE 4

Solutions to enhance the performance & security of your networks & applications

A sample of our customers…

slide-5
SLIDE 5

Solutions to enhance the performance & security of your networks & applications

Hacker/ Intruder

Application Servers (on-site and in the Cloud) Example Hosts

CFO HR Department Remote worker hot-desking CEO CISO Remote Worker Zero-Day Malware & APT Execution 3 x Next-Generation Intrusion Detection and Protection

2

x

Perimeter Firewall: Standard FW rules Finance Legal HR Exchange Intranet

Site

Next-Generation Firewall for Application Control 1 DDoS Protection, Prevention and Mitigation

4

x

Threat Vulnerability Management & Assessment

6

x

Network, LAN and Computer Forensics 5 Stateful Attack Generation

8

Advanced Network & DC Cloaking 7 -

Phoenix Datacom, core security solutions – Monitoring / Mediation / Remediation

Internet/ WAN

slide-6
SLIDE 6

Solutions to enhance the performance & security of your networks & applications

Hacker/ Intruder

Application Servers (on-site and in the Cloud) Example Hosts

CFO HR Department Remote worker hot-desking CEO CISO Remote Worker Perimeter Firewall: Standard FW rules Finance Legal HR Exchange Intranet

Site

DDoS Protection, Prevention and Mitigation Stateful Attack Generation

Phoenix Datacom, core security solutions – Our focus today

Internet/ WAN

slide-7
SLIDE 7

Solutions to enhance the performance & security of your networks & applications

The focus here today…

Agenda:

  • The latest DDoS attack threat spectrum targeting Enterprises, the Government and

Financial Organisations – Arbor Networks

  • How local DDoS protection combined with Carrier protection provides the most effective

incident response and remediation - Arbor Networks

  • The importance of knowing the capability of your DDoS Mitigation measures, as well as

new solutions under consideration – Ixia (BreakingPoint)

  • A live demo of DDoS attacks against the Arbor Networks DDoS Mitigation solution for

Enterprises, the Government and Financial Organisations - Phoenix Datacom.

slide-8
SLIDE 8

Solutions to enhance the performance & security of your networks & applications

Better Protection from DDoS attacks

Darren Anstee, Director of Solution Architects ARBOR NETWORKS

slide-9
SLIDE 9

Solutions to enhance the performance & security of your networks & applications

Threats in the news…

Cost Disruption Loss of Customer Trust

slide-10
SLIDE 10

Solutions to enhance the performance & security of your networks & applications

The threat space is complex…

New Advanced Threat Landscape

Loud & Noisy Quiet & Patient Availability Confidentiality Integrity

Advanced Threat Continuum

slide-11
SLIDE 11

Solutions to enhance the performance & security of your networks & applications

DDoS evolution

Period Average Attack size (bps) % Change Peak Attack Size (bps) % Change Q1 1.12Gbps

  • 325.06Gbps
  • Q2

759.83Mbps

  • 32.2%

154.69Gbps

  • 52.4%

Q3 858.98Mbps +13.05% 264.61Gbps +71.1%

325.05 264.61 50 100 150 200 250 300 350 January April July October January April July October January April July October January April July October January April July

Peak Monthly Gbps of Attacks

slide-12
SLIDE 12

Solutions to enhance the performance & security of your networks & applications

2014, a time for reflection…

slide-13
SLIDE 13

Solutions to enhance the performance & security of your networks & applications

Characteristics of an NTP Reflection/Amplification Attack Abusable NTP Servers

Internet accessible Servers, Routers, Home CPE devices, etc.

slide-14
SLIDE 14

Solutions to enhance the performance & security of your networks & applications

Characteristics of an NTP Reflection/Amplification Attack Attacker sends monlist, showpeers, or

  • ther NTP level-6/-7 administrative

queries with target port and spoofed IP address of target Abusable NTP Servers

slide-15
SLIDE 15

Solutions to enhance the performance & security of your networks & applications

Abusable NTP Servers

Target Port:

UDP/80

Or

UDP/123

NTP services ‘reply’ to the attack target with streams of ~468-byte packets sourced from UDP/123 to the` target; the destination port is the source port the attacker chose while generating the NTP queries Characteristics of an NTP Reflection/Amplification Attack

slide-16
SLIDE 16

Solutions to enhance the performance & security of your networks & applications

2014 ATLAS Initiative : Anonymous Stats, World-Wide Other Protocols for Amplification, Q3

  • Given the huge storm of NTP reflection activity, there

has been some focus on other protocols that can be used in this way.

  • Looking at attacks with source-ports of services used

for reflection.

  • DNS has been used by attackers for several years.
  • Lower proportion of events for SNMP reflection

this quarter compared to last. Chargen grows slightly.

  • Significant growth in attacks with source port

1900 (SSDP)

  • Almost no attacks in Q2
  • 29506 in Q3

Protocol UDP Source Port Percentage

  • f Attacks

in Q3 Max Size Q3 Average Size Q3

SNMP 161 0.03% 14.46Gbps 856Mbps Chargen 19 2% 24.8Gbps 1.05Gbps DNS 53 4% 83.9Gbps 1.7Gbps SSDP 1900 4% 124Gbps 4.04Gbps NTP 123 5% 156.3Gbps 2.99Gbps

slide-17
SLIDE 17

Solutions to enhance the performance & security of your networks & applications

DDoS Evolution

slide-18
SLIDE 18

Solutions to enhance the performance & security of your networks & applications

Ensure Availability – Layered DDoS Defense

ISP 2 ISP 1 ISP n

ISP

SCRUBBING CENTRE

Cloud Signaling

Cloud-based DDoS Protection Perimeter DDoS Protection

Firewall IPS Load Balancer Target Applications & Services DATA CENTER

slide-19
SLIDE 19

Solutions to enhance the performance & security of your networks & applications

Ensure Availability – First Layer of Defense

Internal Network Enterprise Assets Files, Packets & Flow Servers Files, Packets & Flow Enterprise Perimeter Global Internet Global Network Threats

Identify Understand Act

Pravail Availability Protection System (APS)

  • Immediate protection from current

threats.

  • Utilise ATLAS threat intelligence to

protect your organisation from the latest threats.

  • Easy to install and deploy
  • Easy to operationalize and deploy.

Built in bypass functionality. Detailed traffic and reporting for advanced users.

  • (Arbor) Cloud Signaling
  • Integration with cloud based DDoS

protection services to provide the automated, layered protection necessary to deal with multi-vector attacks.

slide-20
SLIDE 20

Solutions to enhance the performance & security of your networks & applications

Ensure Availability – Second Layer of Defense

Internal Network Enterprise Assets Files, Packets & Flow Servers Files, Packets & Flow Enterprise Perimeter Global Internet Global Network Threats

Identify Understand Act

Arbor Cloud

  • Global Tier 1 Footprint
  • Carrier Agnostic
  • 4 Mitigation Centers around the

world.

  • Based on Arbor proven

mitigation technology

  • Transparent operation, clear reporting
  • BGP or DNS diversion options
  • Reporting Portal
  • Highly experienced SOC backed

by ASERT

  • Clean Traffic Pricing Model
  • Subscription to service based on

volume of clean traffic

  • No limit of attack sizes
slide-21
SLIDE 21

Solutions to enhance the performance & security of your networks & applications

Arbor Networks 13+ Years

  • f Innovation
  • The Internet and security is our heritage
  • Founded from a DARPA grant
  • Over 40 networking and security patents
  • Across 60 countries
  • Service Providers, Hosters, Fortune 50 ancials

and online giants

Serving The Most Demanding Networks Trusted Experts Globally

  • Over 400 employees around the globe
  • >50% in Engineering, Service and Support
  • Best in class support experts, global infrastructure

ATLAS / ASERT

  • Unrivalled visibility, analysing 110Tb/sec of data
  • Well regarded security research expertise
  • Threat Intelligence
slide-22
SLIDE 22

Solutions to enhance the performance & security of your networks & applications

Thank you. Any Questions?

Darren Anstee, Director of Solution Architects ARBOR NETWORKS

slide-23
SLIDE 23

Solutions to enhance the performance & security of your networks & applications

Measuring your DDoS defences

Andy Young, Senior Systems Engineer IXIA

slide-24
SLIDE 24

Solutions to enhance the performance & security of your networks & applications

The network has evolved Application Realism

  • Application landscape
  • Network load
  • Cyber security threats.
slide-25
SLIDE 25

Solutions to enhance the performance & security of your networks & applications

Threats have evolved

  • Volumetric DoS Attacks
  • SYN Flood, Ping Flood, LOIC attack, UDP Flood
  • SMURF Attack, Teardrop Attack
  • LAND Attack
  • More Advanced
  • Stateful TCP (three way handshake Only)
  • DNS Request Flooding
  • Fragments that add up to almost a full packet
  • Layer 7 Attacks
  • Slowloris Attack
  • RCV Window 0
  • SlowPOST Attack
  • VoIP Flood
  • IVR Walking
  • RuDY
slide-26
SLIDE 26

Solutions to enhance the performance & security of your networks & applications

Why does realism matter? … inspecting closer When something looks suspicious ! Deep Packet Inspection relies on payload inspection – the deeper the inspection, the slower the traffic Inspection Points slows down traffic

slide-27
SLIDE 27

Solutions to enhance the performance & security of your networks & applications

Impact of realism on DPI performance Example: Real Proxy Device Parsing Realistic Data vs Fake Data

slide-28
SLIDE 28

Solutions to enhance the performance & security of your networks & applications

Ixia BreakingPoint applications … and you have full control to create many application flows using intuitive workflow Best application coverage 240+ applications 1000+ predefined superflows 12,000+ configurable actions

Application Profile

a Collection of SuperFlows

SuperFlow

a Collection of Flows

Flow

a Collection of Actions

slide-29
SLIDE 29

Solutions to enhance the performance & security of your networks & applications

Ixia BreakingPoint uses Markov algorithm to generate Ultimate Realism Example Real Content HTML + Markov + Random CSS Markov + Chat Conversation Markov in Email with ‘target’ word insertion

No other product can perform Markov String Generation! Content NEVER REPEATS and will fully exercise a content aware device!

Markov supports multiple languages

slide-30
SLIDE 30

Solutions to enhance the performance & security of your networks & applications

Ixia BreakingPoint – Security Component

 6,000+ exploits  30,000+ malware  Custom Malware  Mobile Malware  Strike fuzzing  Seeded Values to provide repeatability or uniqueness  180+ Evasions

slide-31
SLIDE 31

Solutions to enhance the performance & security of your networks & applications

Ixia BreakingPoint – Fuzzing Application Protocols Measures stability in face of corrupted traffic Validates integrity of protocol stacks with malformed packets Generates corrupt data by modifying part of the packet

  • Random or user-defined payload
  • Data rates: constant, range, random
  • Bad IP version, checksum, options; bad TCP options, urgent pointer, etc.
  • Pseudo Random Number Generator (PRNG) seed for repeatable testing.
slide-32
SLIDE 32

Solutions to enhance the performance & security of your networks & applications

Pre-built Botnet simulations  Cutwail  Zeus  SpyEye  ZeroAccess  Duqu  BlackEnergy  TDL4  PushDO  TDW  Customisation in Application Editor.

slide-33
SLIDE 33

Solutions to enhance the performance & security of your networks & applications

Case Study - Banking

  • Enterprise NGFW Deployment
  • Target: Single Vendor Deployment
  • Enterprise had four district use cases
  • All vender NGFW advertised as 10Gbps NGFW

TCP baseline test Web Partner Portal Office Trading

Vendor A Vendor B Vendor C

Vendor A Vendor B Vendor C Avg Sec effectiveness * 48% 52% 28%

*BreakingPoint StrikePack 5

3 Days to Quantifiable Data

slide-34
SLIDE 34

Solutions to enhance the performance & security of your networks & applications

Case Study – Financial Exchange

1-Arm Testing BreakingPoint Load Generation DDoS Traffic Volumetric DDoS traffic directed to target web servers Web-based Application Traffic http transactional traffic between BreakingPoint client and target web servers Good Application Traffic Transactional web-based application traffic through DDoS Service Provider DDoS Service Provider Target Web Servers DDoS Traffic Volumetric DDoS Traffic re-directed by DDoS Service Provider

Cloud-Based DDoS Protection DDoS Defense Validation

slide-35
SLIDE 35

Solutions to enhance the performance & security of your networks & applications

Ixia BreakingPoint PerfectStorm Performance - per chassis

960

Gbps

Apps Throughput

Applications 24

Million

TCP CPS

Connection Rate

720

Capacity

Million HTTP CC

12M

SSL Capacity

Concurrent SSL Flows

2.4M

SSL CPS

SSL Connection Rate

240

SSL Throughput

Gbps SSL Throughput

Performance in two-arm mode, With clients and servers simulated on same blade

slide-36
SLIDE 36

Solutions to enhance the performance & security of your networks & applications

Ixia BreakingPoint – PerfectStorm ONE

slide-37
SLIDE 37

Solutions to enhance the performance & security of your networks & applications

Ixia BreakingPoint – keeping current

slide-38
SLIDE 38

Solutions to enhance the performance & security of your networks & applications

Thank you. Any Questions?

Andy Young, Senior Systems Engineer IXIA

slide-39
SLIDE 39

Solutions to enhance the performance & security of your networks & applications

A day in the life of the DDoS attack Mitigator

Mark Tilston, Senior Cyber-Security Engineer PHOENIX DATACOM

slide-40
SLIDE 40

Solutions to enhance the performance & security of your networks & applications

A day in the life of the DDoS attack

DECISION

06:45

Warning WebServer @ 50% of maximum load

07:00 Automatic Report

DECISION DECISION

09:00

DECISION

slide-41
SLIDE 41

Solutions to enhance the performance & security of your networks & applications

A day in the life of the DDoS attack

slide-42
SLIDE 42

Solutions to enhance the performance & security of your networks & applications

A day in the life of the DDoS attack

14:15

slide-43
SLIDE 43

Solutions to enhance the performance & security of your networks & applications

A day in the life of the DDoS attack

What will be the reputational damage to our company? How will this effect our company share prices? Can I still afford to buy that huge yacht?

What are my financial losses?

Is any of our Intellectual property at risk?

No, I don’t recall you putting in for DDoS Protection last year! What impact is this having on our customers?

How could this have happened?

What the hell is DDoS?

Didn’t you test our Security defences?

slide-44
SLIDE 44

Solutions to enhance the performance & security of your networks & applications

A day in the life of the DDoS attack

14:31

slide-45
SLIDE 45

Solutions to enhance the performance & security of your networks & applications

A day in the life of the DDoS attack

slide-46
SLIDE 46

Solutions to enhance the performance & security of your networks & applications

How can you help yourself?

Questions to ask yourself!

  • What is my DDoS Security

strategy and who are the Stakeholders?

  • What would be the

financial impact to my business as a result of a DDoS attack?(Don’t forget call centre costs for flooded calls, loss of customers, loss of revenue, etc)

  • How do I TRULY know our

current DDoS defences are fit for purpose?

Taking the Next Steps!

  • Identify potential security

holes, have the right tools and people in place.

  • Perform business risk

analysis to determine the right budget to allocate.

  • Test your DDoS mitigation

systems and make sure they are capable of detecting and mitigating today’s threats.

  • Install appropriate defences,

train and support users as and when required.

How can Phoenix Datacom help you?

slide-47
SLIDE 47

Solutions to enhance the performance & security of your networks & applications

Taking the Next Steps!

  • Identify potential security

holes, have the right tools and people in place.

  • Perform business risk

analysis to determine the right budget to allocate.

  • Test your DDoS mitigation

systems and make sure they are capable of detecting and mitigating today’s threats.

  • Install appropriate defences,

train and support users as and when required.

The result of which means….

slide-48
SLIDE 48

Solutions to enhance the performance & security of your networks & applications

Thank you. Any Questions?

Mark Tilston, Senior Cyber-Security Engineer PHOENIX DATACOM

Event questionnaire to follow by email Further demonstrations available in/via our