Attacks/Breaches
1/12/2016
02:00 PM
Rene Paap
Rene Paap
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

A DDoS Learning Curve for Universities, Government & Enterprises

Distributed Denial of Service attacks are easy, cheap and too often, effective. But they're not unstoppable.

There’s no getting around it -- DDoS attacks are growing in frequency, size, severity, sophistication, and even persistence each year. These tenacious, effective attacks can last anywhere from hours to months. They can be launched from botnets, use multiple protocols, and even disguise themselves with SSL encryption. Protecting yourself against DDoS isn’t a matter of stopping one attack but a multitude, sometimes all at once.

Even worse, IT departments may not realize an attack is underway, thinking a failing server or application is responsible.

Rutgers University, for example, recently fell prey to its sixth known DDoS attack in a single year -- and Rutgers is not an outlier. Thousands of DDoS attacks hit universities, enterprises, government organizations, and banks every day—some successful, some not. One thing is for sure: no one is safe, and attacks will continue because DDoS attacks are easy, cheap and, too often, effective. But they’re not unstoppable.

Universities and other organizations can take steps to prepare for and minimize the effect of even the most sophisticated assaults:

Step 1. Have a good monitoring system in place

Security teams have many ways to get insight into their network, including flow sampling, in-path detection and mirrored data packets. Here’s a brief breakdown of the pluses and minuses:

  • Flow sampling: The router samples packets and exports datagrams on them. While scalable, this method leaves out large quantities of information because it only samples one packet out of thousands. This allows some “slow and low” attacks to fly under the detection radar, or take a long time to trigger an alert.
  • In-path detection: A high-performance DDoS mitigation device continuously processes all incoming traffic and possibly outgoing traffic. The device can take immediate action with sub-second mitigation times. One concern is ensuring the mitigation solution can scale with the uplink capacity during multi-vector attacks.
  • Mirrored data packets: Full detail for analysis is provided, while not necessarily in the path of traffic. This method can be a challenge to set up, but allows for fast detection of anomalies in traffic and is a centralized place for analysis and mitigation.

Step 2. Keep an eye on performance metrics and scalability

When it comes to DDoS, everything happens on a large scale: the number of attacking computers, the bandwidth they consume and the connections they generate. To fight back, organizations need a combination of high-performance, purpose-built hardware that can mitigate common, yet large-scale attacks effectively, and intelligent software that can inspect traffic at the highest packet rates. For instance, an effective combination might include leveraging dedicated network traffic processors (e.g. FPGAs) to handle the common network-layer attack in combination with powerful, multi-core CPUs to mitigate more complex application-layer attacks. What’s key here is to ensure there is enough processing headroom to prepare networks for future generations of DDoS attacks.

Step 3. Invest in a security awareness program

Mitigation of next-generation DDoS attacks starts with training -- especially to recognize normal network behavior and spot anomalies. For instance, companies that have started their migration to IPv6 must have security specialists in place that know IPv6 well enough to recognize attacks when they happen, and then to know how to use available tools to properly fight them off. Proper training allows organizations to be proactive versus reactive. Security policies take time to devise, so universities and other organizations shouldn’t wait for the IT support staff to raise a red flag before they decide to take action.

For more on this topic read IPv6 and the Growing DDoS Danger

Rene Paap is a networking professional with over 15 years of experience. Through previous roles as a technical marketing engineer, he developed a thorough understanding of networking technologies. Rene's specialties include product assessment, position analysis, Ethernet, ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Janice, I think I've got a message from the code father!
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.