Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

9/11/2013
04:30 PM
50%
50%

Federal DDoS Warnings Are Outdated

We shouldn't be relying on sporadic government warnings about potential distributed denial of service attacks. Having a comprehensive DDoS plan already in place is security 101.

Iris Scans: Security Technology In Action
Iris Scans: Security Technology In Action
(click image for larger view)
It's always the same: Government cybersecurity experts learn of pending distributed denial of service attacks, especially around the anniversary of Sept. 11, and issue warning after warning after warning, as though security is something we can do on a "per-warning" basis.

I really don't understand this way of approaching security or why government agencies believe such warnings are helpful. I'm not saying we shouldn't be warned -- not at all. What I'm saying is that we shouldn't wait for a warning before we do something about security.

On Aug. 5, for instance, the FBI issued a warning that the same groups behind the unsuccessful Operations USA and Operation Israel attacks in May were planning a new DDoS attack. Their recommendations leave me perplexed. For instance, they suggest:

-- Implement backup and recovery plans. Really? We're supposed to wait for a warning on a 9/11 DDoS threat to know that we need to do this? We're in serious trouble if that's the case.

[ Yes, the National Security Agency snoops on cell phones. Here's how: NSA Vs. Your Smartphone: 5 Facts. ]

-- Scan and monitor emails for malware. Again, really? This is a recommendation? Is there truly anyone out there who still doesn't do this? And, if there is, they deserve whatever happens to their network, I say.

-- Outline DDoS mitigation strategies. Finally, something a bit more relevant. I know for a fact that most companies aren't putting much thought into DDoS defense strategy. Unfortunately, if you're hosting a server with public access, you've no choice but to consider this with the utmost seriousness. Just how seriously, you ask? Well, that all depends on how much of your company's livelihood hinges on that server.

It's an undeniable fact of our Internet life that these things will keep happening. No matter if it's 9/11 or OpUSA or a private single hacker from Russia or China. They'll continue to happen, and we all understand the need to be prepared.

DDoS preparedness is accomplished as a strategy. It involves hardware, large bandwidth, ISP collaboration, remote redundancy and other possible strategies for defense and elusion. This isn't anti-malware. You can't create a signature or heuristic against DDoS. This is sheer brute force in that you win if you're stronger, or if you're the more elusive, so they can't really get you.

And that's precisely why you need a strategy, and you need to plan it now. You can also purchase hardware -- but make it part of a strategy. Don't expect it to be the one and only thing you need to do to fend off a DDoS attack.

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
solardalek
50%
50%
solardalek,
User Rank: Apprentice
9/16/2013 | 2:44:10 PM
re: Federal DDoS Warnings Are Outdated
>> DDoS warnings seem to fall in the same category of the color coded
terrorist alert warnings that DHS started issuing after 9/11. Some
action seems more defensible than no action.

You sure about that? Have you noticed that we've been in "orange" forever?

Rather than wait for some slow committee-driven alert, why not look for DDoS signs from your own systems? Get something like SolarWinds "Log & Event Manager", then watch for high alert traffic volumes or specific messages about IP lockouts, ridiculous connection attempts and other signals of an attack yourself.

To misquote Donnie from "Mystery Alaska": This is log analysis, OK? It's not rocket surgery."
WKash
50%
50%
WKash,
User Rank: Apprentice
9/12/2013 | 9:16:43 PM
re: Federal DDoS Warnings Are Outdated
DDoS warnings seem to fall in the same category of the color coded terrorist alert warnings that DHS started issuing after 9/11. Some action seems more defensible than no action.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Introducing 'Secure Access Service Edge'
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  7/3/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5607
PUBLISHED: 2020-07-10
Open redirect vulnerability in SHIRASAGI v1.13.1 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVE-2020-15001
PUBLISHED: 2020-07-09
An information leak was discovered on Yubico YubiKey 5 NFC devices 5.0.0 to 5.2.6 and 5.3.0 to 5.3.1. The OTP application allows a user to set optional access codes on OTP slots. This access code is intended to prevent unauthorized changes to OTP configurations. The access code is not checked when u...
CVE-2020-15092
PUBLISHED: 2020-07-09
In TimelineJS before version 3.7.0, some user data renders as HTML. An attacker could implement an XSS exploit with maliciously crafted content in a number of data fields. This risk is present whether the source data for the timeline is stored on Google Sheets or in a JSON configuration file. Most T...
CVE-2020-15093
PUBLISHED: 2020-07-09
The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicate a valid signature in order to circumvent TUF requiring a minimum threshold of unique signatures before the metadata is considered valid. A ...
CVE-2020-15299
PUBLISHED: 2020-07-09
A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remote attackers to trick a victim into submitting an install_online_preset AJAX request containing base64-encoded JavaScript (in the kc-online-preset-data POST parameter) that is execu...