© 2010 Akamai Headlines You May Have Seen

© 2010 Akamai Headlines You DID NOT See POWERING A BETTER INTERNET President Delays Trip Due to Cyber Attacks Independence Day Attacks Paralyze the U.S. Government and Financial Websites Attacked and Taken Down: Stocks Show Concerns

© 2010 Akamai IT Risk In a Complex World

© 2010 Akamai What’s At Risk? NSA's Guide: Defense in Depth - A practical strategy for achieving Information Assurance in today’s highly networked environments Reputation & Brand Dollars & RevenueMission & Trust

Weathering Storms in the Cloud: Analyzing Massive DDoS Attacks to Prepare for the Future R. H. Powell IV Senior Service Line Manager August 10, 2010

© 2010 Akamai Agenda Weathering Storms in the Cloud Is the Threat Worth Considering? Data Collection & Considerations Observations from the Wild July 4 th DDoS Case Study How Do you Analyze This Future Expectations & Innovation

© 2010 Akamai State of Internet Security Today 95% of corporate Web applications have severe vulnerabilities million computers in the U.S. alone may now be part of a botnet. 2 Cybercrime costs businesses $1 trillion a year. 3 In 2008, a Web page was infected every 4.5 seconds. 4 Attack traffic observed from 198 countries in Q1 ‘10, up 291% from 68 countries in Q1 ‘ WASC 2 Georgia Tech Information Security 3 McAfee 4 Sophos 5 Akamai

© 2010 Akamai Targets of Opportunity 2,750 1,875 3, Volume of Vulnerabilities 2, (Web Application Vulnerabilities) (Non-Web Application Vulnerabilities) Source: Symantec Internet Security Threat Report, April 2009

© 2010 Akamai Peak Attack Traffic per year Attack Size - Gbps (Arbor Networks) 49 >200 (Akamai Technologies)

© 2010 Akamai Where Does the Data Come From? Primary Data Sources Auxiliary Data Source Akamai Distributed Agents Publicly Available Reports Akamai Customer Production Traffic Logs

© 2010 Akamai Top Attack Countries (Akamai Agents)

© 2010 Akamai Top Attack Regions (Akamai Agents) Europe 44% Overall Europe 50% of Mobile

© 2010 Akamai A Note On Mobile Connectivity The GSM Association reports that global Mobile Broadband connections roughly doubled during 2009 to 200 million. By the end of 2010, they estimate this will reach 342 million global connections, with 120 million in Europe, 116 million in the Asia Pacific region, and 58 million in North America. 2 1 Akamai 2 GSM Association Global Mobile Providers % > 1 Mbps % > 2 Mbps % > 5 Mbps % > 10 Mbps Average Connection Speed32% 1 13% 1 -- Maximum Connection Speed--76% 1 30% 1 6% 1

© 2010 Akamai July DDoS Attack Observed Attack Profile Type of Attack – Brute Force DDoS The largest coordinated DDoS cyber attack against US Government Websites HTTP Resource Drain attack Sourced primarily from compromised Korean computers Intensity of Attack 1,000,000+ hits per second and ~200 Gbps aggregate attack traffic (US Gov Only) One website received 8 years of traffic in a day All Traffic Logged for Akamai Customers 64 Billion Log Lines 13 TB of uncompressed log data (400+ Gigs of Compressed logs) “Between the volume of the requests and their frustrating nature, a Web site with few servers or limited bandwidth can quickly be taken down. Others with greater physical and financial resources can take the punishment. That may explain why high-volume Web sites such as those belonging to the White House, the Pentagon and the New York Stock Exchange were able to withstand such attacks with barely a hiccup, while the Federal Trade Commission's and the Transportation Department's were knocked offline." - Paul Wagenseil, Fox News

© 2010 Akamai July 4, 2009 DDoS Attack Customer – PROTECTED U.S. Government Customer 1 U.S. Government Customer 2 U.S. Government Customer 3 U.S. Government Customer 4 U.S. Government Customer 5 U.S. Government Customer 6 New U.S. Government Customer Peak Traffic 124 Gbps 32 Gbps 9 Gbps 2 Gbps 1.9 Gbps 0.7 Gbps Times Above Previous Peak Traffic 598x 369x 39x 19x 9x 6x SITE DOWN before Akamai “Between the volume of the requests and their frustrating nature, a Web site with few servers or limited bandwidth can quickly be taken down. Others with greater physical and financial resources can take the punishment. That may explain why high-volume Web sites such as those belonging to the White House, the Pentagon and the New York Stock Exchange were able to withstand such attacks with barely a hiccup, while the Federal Trade Commission's and the Transportation Department's were knocked offline." - Paul Wagenseil, Fox News

© 2010 Akamai Akamai Analysis of Log Data Top Attacking IP Address Over Time July 4 th – Attacks focused on two sites July 5 th – Attacks spread to include 5 other sites. Even traffic spread. July 5 th (late) – Attack shifts bulk of attack to 2 new sites July 7 th (late) – Attack Ends All Targeted US Government Websites (not using Akamai) Went Down!

© 2010 Akamai Unique Hostile IPs Over Time Much Larger Then Any Public Estimates Spike 1 Spike 3 Spike 2 Few common attackers between spikes: (Only 4,284 IP’s Shared Across all Spikes) 97,882 Unique IP’s in 30 mins

© 2010 Akamai Crunching The Data

© 2010 Akamai Future Outlook and Innovation

Thank you

© 2010 Akamai Akamai Architecture Operational View – OV-1 End Users Internet Network Storage Akamai Network 65,000+ Servers Locations 950+ Networks 70+ Countries Compression Akamai Site Shield Network Storage Back-Up Site or Load Balanced Multi-Data Center EDNS Transaction Server DNS Server Directory/ Policy Server Legacy Systems App Servers Database Load Balancer Edge Servers Web Servers Fire Wall Edge Servers Data Center Security Availability Scalability Visibility Resource Savings Performance WAF

© 2010 Akamai Technology The top five anti-virus companies Media & Entertainment 30 of the top 30 M&E companies Retail & Travel Over 400 Global Retailers 50 of the top 50 U.S. Retailers Over 125 Global Online Travel Sites Broad adoption across verticals If you’re on-line you’re using Akamai Finance 9 of top 15 Global Banks

© 2010 Akamai US Government Customers 12 of 15 Cabinet Agencies