Richard Bible Security Solution Architect, F5 Networks DDOS EQUALS PAIN

2© F5 Networks, Inc. Bandwidth carriers ISP’s bandwidth Your bandwidth Many: Thread jam Memory exhaustion Many: CPU Database load Thread jam Log attack Memory exhaustion Connection flood State Table: Too many connections State Table: TCP Flood. Negative caching Proxy bypass State Table: IP’s Low & slow Layer 7 – Random Layer 7 – Logical State Table: ACL Perf. Degrade FirewallDDoS applianceAPP acceleratorLoad balancerWeb serversDatabase BANDWIDTH >> PACKET >> CONNECTION >> OS >> HTTP(s) >> APP (PHP/ASP) >>> DB DDoS Attacks Exhaust Network Resources

3© F5 Networks, Inc. “ Sixty-five percent [of surveyed organizations] reported experiencing an average of three – DDoS attacks in the past 12 months, with an average downtime of 54 minutes. – 2012 Ponemon Institute Survey

4© F5 Networks, Inc. Izz ad-din al Quassam CyberFighters DDoS attacks on Bank of America, NYSE, Wells Fargo, PNC, Chase, SunTrust, Capital One and others. Peak attacks 75G, including mix of layer 3, 4, 5 and 7 attacks. Anti-DDoS scrubbers used for network attacks. F5 for Layer 7. Spotlight: Operation Ababil – September 2012 The CyberFighters appeared to have performed extensive network reconnaissance on data centers for each of the targets. Network reconnaissance likely included timing information on all available links and database queries.

5© F5 Networks, Inc. It happens to all of us…

6© F5 Networks, Inc. DDoS Ecosytem

7© F5 Networks, Inc. © F5 Networks, Inc 7 DDoS hides the real threat DDoS Attack on Bank Hid $900,000 Cyberheist Feb 13, 2013

8© F5 Networks, Inc. © F5 Networks, Inc 8 More sophisticated attacks are multi-layer Application SSL DNS Network

9© F5 Networks, Inc. Which DDoS mitigation to use? Content Delivery Network Carrier Service Provider Cloud-based DDoS Service Cloud/Hosted Service Network firewall with SSL inspection Web Application Firewall On-premise DDoS solution Intrusion Detection/Prevention On-Premise Defense

10© F5 Networks, Inc. The answer: “All of the above”

11© F5 Networks, Inc. devcentral.f5.com facebook.com/f5networksinc linkedin.com/companies/f5-networks twitter.com/f5networks youtube.com/f5networksinc