Risk
9/11/2013
04:30 PM
50%
50%

Federal DDoS Warnings Are Outdated

We shouldn't be relying on sporadic government warnings about potential distributed denial of service attacks. Having a comprehensive DDoS plan already in place is security 101.

Iris Scans: Security Technology In Action
Iris Scans: Security Technology In Action
(click image for larger view)
It's always the same: Government cybersecurity experts learn of pending distributed denial of service attacks, especially around the anniversary of Sept. 11, and issue warning after warning after warning, as though security is something we can do on a "per-warning" basis.

I really don't understand this way of approaching security or why government agencies believe such warnings are helpful. I'm not saying we shouldn't be warned -- not at all. What I'm saying is that we shouldn't wait for a warning before we do something about security.

On Aug. 5, for instance, the FBI issued a warning that the same groups behind the unsuccessful Operations USA and Operation Israel attacks in May were planning a new DDoS attack. Their recommendations leave me perplexed. For instance, they suggest:

-- Implement backup and recovery plans. Really? We're supposed to wait for a warning on a 9/11 DDoS threat to know that we need to do this? We're in serious trouble if that's the case.

[ Yes, the National Security Agency snoops on cell phones. Here's how: NSA Vs. Your Smartphone: 5 Facts. ]

-- Scan and monitor emails for malware. Again, really? This is a recommendation? Is there truly anyone out there who still doesn't do this? And, if there is, they deserve whatever happens to their network, I say.

-- Outline DDoS mitigation strategies. Finally, something a bit more relevant. I know for a fact that most companies aren't putting much thought into DDoS defense strategy. Unfortunately, if you're hosting a server with public access, you've no choice but to consider this with the utmost seriousness. Just how seriously, you ask? Well, that all depends on how much of your company's livelihood hinges on that server.

It's an undeniable fact of our Internet life that these things will keep happening. No matter if it's 9/11 or OpUSA or a private single hacker from Russia or China. They'll continue to happen, and we all understand the need to be prepared.

DDoS preparedness is accomplished as a strategy. It involves hardware, large bandwidth, ISP collaboration, remote redundancy and other possible strategies for defense and elusion. This isn't anti-malware. You can't create a signature or heuristic against DDoS. This is sheer brute force in that you win if you're stronger, or if you're the more elusive, so they can't really get you.

And that's precisely why you need a strategy, and you need to plan it now. You can also purchase hardware -- but make it part of a strategy. Don't expect it to be the one and only thing you need to do to fend off a DDoS attack.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
solardalek
50%
50%
solardalek,
User Rank: Apprentice
9/16/2013 | 2:44:10 PM
re: Federal DDoS Warnings Are Outdated
>> DDoS warnings seem to fall in the same category of the color coded
terrorist alert warnings that DHS started issuing after 9/11. Some
action seems more defensible than no action.

You sure about that? Have you noticed that we've been in "orange" forever?

Rather than wait for some slow committee-driven alert, why not look for DDoS signs from your own systems? Get something like SolarWinds "Log & Event Manager", then watch for high alert traffic volumes or specific messages about IP lockouts, ridiculous connection attempts and other signals of an attack yourself.

To misquote Donnie from "Mystery Alaska": This is log analysis, OK? It's not rocket surgery."
WKash
50%
50%
WKash,
User Rank: Apprentice
9/12/2013 | 9:16:43 PM
re: Federal DDoS Warnings Are Outdated
DDoS warnings seem to fall in the same category of the color coded terrorist alert warnings that DHS started issuing after 9/11. Some action seems more defensible than no action.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, January 2015
To find and fix exploits aimed directly at your business, stop waiting for alerts and become a proactive hunter.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7402
Published: 2014-12-17
Multiple unspecified vulnerabilities in request.c in c-icap 0.2.x allow remote attackers to cause a denial of service (crash) via a crafted ICAP request.

CVE-2014-5437
Published: 2014-12-17
Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php,...

CVE-2014-5438
Published: 2014-12-17
Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computer_name parameter to connected_devices_computers_edit.php.

CVE-2014-7170
Published: 2014-12-17
Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service.

CVE-2014-7285
Published: 2014-12-17
The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.