Matt Sheely Devrin Lewis UC IT DDoS Prevention Research Project

Overview History Problem Statement Hardware/Software Requirements Design Protocol Demo Testing Risk Management Budget Conclusion

History UC IT Attack –Distributed Denial of Service (DDoS) –Crippled UC network –Problem compounded: Blackboard services Outcome –DDoS prevention architecture: NetZentry NetZentry no longer supported –Outdated definition files in use

Problem Statement Currently, the UC IT department is looking for a new, non service based DDoS prevention architecture, either a hardware or software implementation, which performs to and/or exceeds the existing DDoS prevention architecture NetZentry.

Hardware/Software Requirements Vendor Supplied DDoS hardware –IntruGuard IG2000 (fiber) –Radware DefensePro x20 –Radware Absolute Insite ManagePro Cisco Catalyst 6500 Router Cisco 3750G PoE switch Radware Raptor Attack Tool Windows Server 2003 Machine (Management Console) Test Laptops

Design Protocol

Demo

Testing Weighted Value Chart Test StageMultiplier ValueDescription of Multiplier Value Configuration Testing 1.667Configuration testing was deemed lowest importance and will be used in case of a tie between vendor hardware. Baseline Testing 5.000Baseline testing was deemed highest importance in order to maintain legitimate network connectivity. Attack Testing 3.333Attack testing was deemed the second highest importance in order to maintain legitimate network connectivity.

Configuration Results ParametersPoor (1) Average (2) Excellent (3) Difficulty of Vendor Supplied Documentation x User Interfaces for Management x Vendor Availability x Overall configuration x ParametersPoor (1) Average (2) Excellent (3) Difficulty of Vendor Supplied Documentation x User Interfaces for Management x Vendor Availability x Overall configuration x Radware IntruGuard

Baseline Results ParameterVendorBlocks legitimate traffic (0) Fairly certain blocks legitimate traffic (1) Equal to be blocking as not blocking legitimate traffic (2) Fairly certain does not block legitimate traffic (3) Does not block legitimate traffic (6) Certainty of legitimate traffic not being blocked Radware x IntruGuard x

Attack Results Attack TypePass (1) Failed (0) RadwareIntruGuard Single Source, Non-spoofed TCP SYN Attack(21/04/09 14:36/12:18) 11 Single Source, Non- spoofed TCP RST Attack(21/04/09 14:46/12:27) 11 Multi-source, Spoofed TCP SYN attack (22/04/09 1:14)0 (1)1 Multi-source, Spoofed TCP RST attack (22/04/09 1:37)11 Single source, Non-spoofed UDP data flood (22/04/09 1:48)11 Single source, Non-spoofed UDP RTP flood (22/04/09 2:00)(ICMP 8) 11 Multi-source, Spoofed UDP Data flood (22/04/09 2:14)11 Multi-source, Spoofed UDP RTP flood (22/04/09 2:24)(ICMP 8) 11 Single source Non-spoofed ICMP echo request (27/04/09 1:20) (ICMP 8) 11 Single source Non-spoofed ICMP timestamp flood (27/04/09 1:20)(ICMP 8) 11 Multi-source Spoofed ICMP echo request (27/04 2:00)(ICMP 8) 11 Multi-source Spoofed ICMP timestamp flood (27/04 1:20)(ICMP 8) 11 Total attack testing score:1112

Risk Management RiskRisk LevelMitigation Vendor hardware delay and/ hardware failureHigh Maintain contact with vendors in order to anticipate hardware delay, and then have alternative procedures in order to maintain test schedule Vendor decision to withdraw from project. High Retain project with updated scope to compare two vendor hardware setups instead of three Test lab configurationModerate Run preliminary DDoS test on test network before beginning trial tests of hardware Test lab softwareModerate Back up plans for test software including vendor supplied testing software Lab hardware failureModerate Spare parts on hand to replace faulty hardware components. Over extending timelineModerate Develop multiple plans based on 3 or 4 week testing

Budget ProductRetail CostOur CostProvider Lab Resources Two Laptop Computers$ (2*$900) = $3900$2,100UC Lab/Personal Radware Raptor Attack Tool00Vendor Cisco 3750G PoE Switch$5, UC Network Operations Cabling$1.04 x 250ft = $2600UC Lab Vendor Hardware~$20,0000Vendor Visio$ MSDN Office 2007$164.94$10Student Book Store Windows Server 2K3 Machine$ UC Network Operations Labor$40 per hour0 Research hours30h x 2 = 60h0 Hardware installation5h x 3 x 2 = 30h0 Initial Lab setup10h x 2 = 20h0 DDoS Testing5h x 3 x 2 = 30h0 Recommedation report10h x 2 = 20h0 Total hours160h0 Labor costs160h x $40 = $64000 Total cost~$36,833.89$2,110

Conclusion TestRadware/IntruGuardMultiplierWeighted Total Configuration9/ / Baseline3/12515/36 Attack11/ /39.96 Complete Total / The IntruGuard IG2000 receives the recommendation to UCit based on the results of the test parameters as well as the fact that the Radware DefensePro requirement of downgrading to Java Run Time Environment 5.5 could be prohibitive to UCit.

Questions?

Configuration Screens

User Profile Network Administrator –Advanced network and security knowledge –Extensive knowledge of current UC network –Strong troubleshooting skills

Deliverables Installation and configuration process Documentation of configuration Analysis and performance report Recommendation report

For Vendor Responses refer to appropriate attached word documents: Radware_Response IntruGuard_Response