Risk
9/11/2013
04:30 PM
Connect Directly
RSS
E-Mail
50%
50%

Federal DDoS Warnings Are Outdated

We shouldn't be relying on sporadic government warnings about potential distributed denial of service attacks. Having a comprehensive DDoS plan already in place is security 101.

Iris Scans: Security Technology In Action
Iris Scans: Security Technology In Action
(click image for larger view)
It's always the same: Government cybersecurity experts learn of pending distributed denial of service attacks, especially around the anniversary of Sept. 11, and issue warning after warning after warning, as though security is something we can do on a "per-warning" basis.

I really don't understand this way of approaching security or why government agencies believe such warnings are helpful. I'm not saying we shouldn't be warned -- not at all. What I'm saying is that we shouldn't wait for a warning before we do something about security.

On Aug. 5, for instance, the FBI issued a warning that the same groups behind the unsuccessful Operations USA and Operation Israel attacks in May were planning a new DDoS attack. Their recommendations leave me perplexed. For instance, they suggest:

-- Implement backup and recovery plans. Really? We're supposed to wait for a warning on a 9/11 DDoS threat to know that we need to do this? We're in serious trouble if that's the case.

[ Yes, the National Security Agency snoops on cell phones. Here's how: NSA Vs. Your Smartphone: 5 Facts. ]

-- Scan and monitor emails for malware. Again, really? This is a recommendation? Is there truly anyone out there who still doesn't do this? And, if there is, they deserve whatever happens to their network, I say.

-- Outline DDoS mitigation strategies. Finally, something a bit more relevant. I know for a fact that most companies aren't putting much thought into DDoS defense strategy. Unfortunately, if you're hosting a server with public access, you've no choice but to consider this with the utmost seriousness. Just how seriously, you ask? Well, that all depends on how much of your company's livelihood hinges on that server.

It's an undeniable fact of our Internet life that these things will keep happening. No matter if it's 9/11 or OpUSA or a private single hacker from Russia or China. They'll continue to happen, and we all understand the need to be prepared.

DDoS preparedness is accomplished as a strategy. It involves hardware, large bandwidth, ISP collaboration, remote redundancy and other possible strategies for defense and elusion. This isn't anti-malware. You can't create a signature or heuristic against DDoS. This is sheer brute force in that you win if you're stronger, or if you're the more elusive, so they can't really get you.

And that's precisely why you need a strategy, and you need to plan it now. You can also purchase hardware -- but make it part of a strategy. Don't expect it to be the one and only thing you need to do to fend off a DDoS attack.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
solardalek
50%
50%
solardalek,
User Rank: Apprentice
9/16/2013 | 2:44:10 PM
re: Federal DDoS Warnings Are Outdated
>> DDoS warnings seem to fall in the same category of the color coded
terrorist alert warnings that DHS started issuing after 9/11. Some
action seems more defensible than no action.

You sure about that? Have you noticed that we've been in "orange" forever?

Rather than wait for some slow committee-driven alert, why not look for DDoS signs from your own systems? Get something like SolarWinds "Log & Event Manager", then watch for high alert traffic volumes or specific messages about IP lockouts, ridiculous connection attempts and other signals of an attack yourself.

To misquote Donnie from "Mystery Alaska": This is log analysis, OK? It's not rocket surgery."
WKash
50%
50%
WKash,
User Rank: Apprentice
9/12/2013 | 9:16:43 PM
re: Federal DDoS Warnings Are Outdated
DDoS warnings seem to fall in the same category of the color coded terrorist alert warnings that DHS started issuing after 9/11. Some action seems more defensible than no action.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5619
Published: 2014-09-29
The Sleuth Kit (TSK) 4.0.1 does not properly handle "." (dotfile) file system entries in FAT file systems and other file systems for which . is not a reserved name, which allows local users to hide activities it more difficult to conduct forensics activities, as demonstrated by Flame.

CVE-2012-5621
Published: 2014-09-29
lib/engine/components/opal/opal-call.cpp in ekiga before 4.0.0 allows remote attackers to cause a denial of service (crash) via an OPAL connection with a party name that contains invalid UTF-8 strings.

CVE-2012-6107
Published: 2014-09-29
Apache Axis2/C does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVE-2012-6110
Published: 2014-09-29
bcron-exec in bcron before 0.10 does not close file descriptors associated with temporary files when running a cron job, which allows local users to modify job files and send spam messages by accessing an open file descriptor.

CVE-2013-1874
Published: 2014-09-29
Untrusted search path vulnerability in csi in Chicken before 4.8.2 allows local users to execute arbitrary code via a Trojan horse .csirc in the current working directory.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
In our next Dark Reading Radio broadcast, we’ll take a close look at some of the latest research and practices in application security.