Effects of DoS

Motivations Bragging rights Disputes Lolz Protest Political Hactivism Monetary Ransom Competition Delivery vector Data Theft Virus/Malware DoS attacks started as a way to lash out over the internet, spiteful torrents of traffic sent to establish dominance, to settle disputes, or for a vandals thrill. *Some attackers combines their efforts into a common purpose, using Denial of Service attacks as a message to further their political goals. *Others organize for financial gain, disrupting a business until a ransom is paid, or gaining profits from the disruptions of a key rival. *Lately we’ve been seeing DoS attacks launched not for disruption, but for distraction. These attacks are used to disguise other malicious traffic, and to manipulate companies into changing their security position to expose the real target.

Network: Capacity High capacity infrastructure 10Gbps/100Gbps Moves the bottle neck Aggregation layer? Firewall? Server? Historically the approach to Denial of Service attacks has been to increase the capacity of the resource under attack. As infrastructure and attacks get more sophisticated, this defense is not always sufficient. Increasing the capacity in one area simply moves the bottleneck and where you are forced to expand again and again. Even with self scaling infrastructure, at some point there will be a resource that a limited scalability, even if this is your wallet.

Network: Tolerance Tolerance < Attack < Capacity remove service vendor blackhole Not all attacks saturate the overall capacity of the system. Within any system there is a point, below the capacity, where we are no longer willing to accept the risk of an ongoing attack. This may be an official figure, or determined in the moment. But once an attack crosses this tolerance threshold, if all other mitigation efforts have failed, the only option is to remove or suspend the target of the attack. Your service providers also have their own tolerance threshold, and if you don’t take action, at some point they will blackhole or suspend service to the target A common strategy of attackers is to hit with a quick burst of traffic, hoping to trigger a blackhole by the service provider in order to take the site down.

Network Effects: Collateral Damage Bottleneck < Attack < Tolerance Slow ramping attacks Targeting specific resources Other attacks take advantage of bottlenecks in the infrastructure, attacking targets where the fail point may be below any thresholds in the hopes that these attacks will be more difficult to detect. Where these resources are shared the attack has the unintended effect of disruption other systems. Service providers are particularly sensitive to any collateral damage in their infrastructure, any resulting blackholes will be long lived.

Solution: Distributed Upstreams Upstream diversity Multiple carriers redundancy capacity Quasi-distributed attacks single origin network traffic shaping Common practice, for those that can afford it, is to configure additional upstreams to add redundancy for coping with outages, and * capacity for withstanding attacks. * Efforts here can be undermined by attacks that originate predominantly from within a single network. * Similarly some networks engage in traffic shaping for performance or cost benefit purposes which ultimately increases the likelihood of an attack dominating a single entry point.

Solution: Distributed Networks Diffuse collateral damage Vulnerable to targeted disruption of key services Distributed networks and cloud based solutions offer new challenges and opportunities for attack. Distributed networks diffuse the risk of collateral damage but can expose new attack surfaces. For example: if an attacker can disrupt your single sign-on service, any dependant services will likewise be disrupted.

Operations - Detection Operations Team Detecting attacks Dealing with anomalies sudden popularity legitimate traffic bursts The other crucial component to your infrastructure is your operations team who operate and maintain these systems. Ideally these are the people who detect the attack (although some reports suggest that over 60% of attacks are reported by end users). Each member of the operations team has their own core competencies and primary focus. If these are not DoS attacks detecting the attacks can be challenging. For example, the following is a traffic graph that contains an attack. *but its not until we start looking at protocols instead of traffic that we see the attack *To further complicate matters, this is not an attack, this is traffic to a particular page of a gambling site during the world cup.

Operations Effects - Fatigue DoS attacks cause stress interruption of duties customers demands management demands Creates openings for attack removing security bottlenecks Denial of Service attacks are stressful, your operations team has a primary focus, certain key duties, and, hopefully, pride in doing what they do well. During an attack they are not doing this. Customers will be calling looking for answers, complaints will be flooding their inboxes and message boards. Inevitably someone very important will call in on an emergency line and demand that you do whatever it takes to get things back up now, and inform you how much money the company looses by the second. This leads to poor choices. Operations teams will be tempted to remove the bottleneck in order to try to restore service. Often this bottleneck is a firewall or other security appliance build to thwart intrusion attempts which cannot withstand the constant barrage of a DoS attack. Once this appliance is removed, services resume, everyone is relieved until some time later when they discover the data theft that was hidden in the denial of service attack which was the real goal, and was just waiting for the security appliance to be removed.

There is no single solution for every attack blended defence of many layers Modern DoS attacks are a series of moves and countermoves responsive, experienced operations team There is no if you will be attacked, only a matter of when have a plan in place

One Solution One solution is to have a dedicated solution that exists separate from your core network. That contains its own security team, security appliances, and proxies to filter for all of your public communication back to your core network.