Jak zwiększyć bezpieczeństwo i wysoką dostępność aplikacji wg Jak zwiększyć bezpieczeństwo i wysoką dostępność aplikacji wg. F5 Networks Andrzej Kroczek a.kroczek@f5.com

“Software defined” everything Technology Shifts Are Creating Opportunity Advanced threats “Software defined” everything Internet of Things SDDC/Cloud Mobility HTTP is the new TCP

Frequency of attacks - 2014 Script kiddies The rise of hacktivism Feb 05 Bitly – Outage as result of DDoS attack Feb 11 Elance Freelance Job Site – NTP Reflection Attack; temporary website disruption Feb 11 oDesk – Temporary website disruption as result of DDoS attack Feb 20 Namecheap – Simultaneous attack on 300 websites it registers Mar 04 Meetup Event Planning – NTP Amplification attack carried out by extortionists Mar 11 GitHub Code Host – UDP based Amplification attack Mar 17 Royalty Free Stock Images – DDoS attack by extortionists Mar 20 Hootsuite – DDoS attack by extortionists Mar 24 Basecamp – DDoS attack by extortionists Mar 27 SurveyGizmo – DDoS attack; Site down 2 days; ISP abandoned recovery 2014 Script kiddies The rise of hacktivism Cyber war

The business impact of DDoS Cost of corrective action Reputation management

Which DDoS technology to use? Cloud/Hosted Service Completely off-premises so DDoS attacks can’t reach you Amortized defense across thousands of customers DNS anycast and multiple data centers protect you Strengths On-Premises Defense Direct control over infrastructure Immediate mitigation with instant response and reporting Solutions can be architected to independently scale of one another Strengths Customers pay, whether attacked or not Bound by terms of service agreement Solutions focus on specific layers (not all layers) Weaknesses Many point solutions in market, few comprehensive DDoS solutions Can only mitigate up to max inbound connection size No other value. Only providing benefit when you get attacked. (excludes F5)

Which DDoS technology to use? HyBRID Model Cloud and On-Prem Combined on-premises and cloud solution to stop all attacks Amortized defense across thousands of customers DNS anycast and multiple data centers protect you Immediate mitigation with instant response and reporting Direct control over on-premises infrastructure Solutions can be architected to independently scale of one another Strengths

Securing applications can be complex Ownership Challenges with security team making the dev team fix vulnerabilities Attack visibility Is often lacking details to truly track and identify attacks and their source, and ensure compliance and forensics Changing threats increasing in complexity that requires intelligence and on- going learning Webification Impossible to build safeguards into applications in a timely manner Scalability and performance Needed to ensure services are available during the onset of aggressive attacks Compliance Maintaining compliance with government standards

F5 Offers Comprehensive DDoS Protection Threat Intelligence Feed Next-Generation Firewall Corporate Users Scanner Anonymous Proxies Anonymous Requests Botnet Attackers Cloud Network Application Network attacks: ICMP flood, UDP flood, SYN flood SSL attacks: SSL renegotiation, SSL flood Financial Services Multiple ISP strategy Legitimate Users Cloud Scrubbing Service E-Commerce ISPa/b Network and DNS Application DNS attacks: DNS amplification, query flood, dictionary attack, DNS poisoning HTTP attacks: Slowloris, slow POST, recursive POST/GET DDoS Attackers Volumetric attacks and floods, operations center experts, L3-7 known signature attacks Subscriber IPS Strategic Point of Control

Consolidated datacenter protection Use case Before f5 Network DDoS Protection Application DDoS Protection Web Access Management Attackers Load Balancing Load Balancing w/ SSL User Firewalls DNSSEC Rising Security Threats/Attacks with f5 Load balancing multiple firewalls Load balancing application s Separate approaches to securing against attacks

Consolidated datacenter protection App Servers Classic Server Network DDoS Application DDoS Web Access Management Before f5 Firewall Load Balancer & SSL Load Balancer with f5 DNS Security Web Application Firewall Access Security App Servers Classic Server Data Center Firewall Application  Security User Consolidation of firewall, app security, traffic management Protection for data centers and application servers High scale for the most common inbound protocols