Network Presence, LLC SM Innovative Security Solutions SM Understanding, Planning For, and Responding To Denial of Service Attacks SANS 2001 Robert Brown Barrett Lyon

SANS Network Security 2001 Understanding, Planning For, and Responding To Denial of Service Attacks Slide - 2 Denial of Service Attacks – The Game Types of attacks Flood-based Crash-based Difficult problem Network Engineering Information Security Psychology

SANS Network Security 2001 Understanding, Planning For, and Responding To Denial of Service Attacks Slide - 3 Denial of Service Attacks – The Game Vulnerability management (or lack thereof) Psychology aspect – what is the attacker trying to accomplish? Legal liability and negligence issues

SANS Network Security 2001 Understanding, Planning For, and Responding To Denial of Service Attacks Slide - 4 Denial of Service Attacks – The Game Attacker compromises multiple hosts and configures DDoS clients Attacker utilizes hosts to flood the Internet pipe of your organization Most commonly use ICMP, UDP, and TCP SYN floods New paper measuring attacks shows 4000 DoS attacks per week

SANS Network Security 2001 Understanding, Planning For, and Responding To Denial of Service Attacks Slide - 5 Overview of TheShell.com ISP specializing in Unix shell accounts Most users utilize the IRC chat network IRC is a magnet for attack At least one attack per day and 19 serious attacks in a 1 year period

SANS Network Security 2001 Understanding, Planning For, and Responding To Denial of Service Attacks Slide - 6 Planning for the Attack – Training Camp Developing an incident response plan is key All players must be identified, brought on board, and taught their assignments Network Engineering Information Security Internet Service Provider

SANS Network Security 2001 Understanding, Planning For, and Responding To Denial of Service Attacks Slide - 7 Planning for the Attack – Training Camp Create a form with complete contact information, network information, and responsibilities Ensure ISP engineering contacts are established – this is extremely important!

SANS Network Security 2001 Understanding, Planning For, and Responding To Denial of Service Attacks Slide - 8 Planning for the Attack – Training Camp Have a packet sniffer ready to go Ensure that a SPAN port is available on your Internet-facing switch Map existing traffic patterns Implement bandwidth limiting filters at your ISP Implement ISP-side filters for other traffic you don’t want/need

SANS Network Security 2001 Understanding, Planning For, and Responding To Denial of Service Attacks Slide - 9 Playing the Game Identify that you are under attack MRTG, syslog, flow logs, Intrusion Detection, Firewall logs, sniffers Identify deviation from normal traffic Determine intent of attacker Immediately look for ICMP pings and traceroute packets – the attacker usually will try to determine if the attack is working

SANS Network Security 2001 Understanding, Planning For, and Responding To Denial of Service Attacks Slide - 10 Playing the Game Climb the ladder Port/Service Host IP stack Local segment (switches/routers) Border router ISP router

SANS Network Security 2001 Understanding, Planning For, and Responding To Denial of Service Attacks Slide - 11 Playing the Game Take system offline Ask ISP to null route IP or group of IPs Develop local filters to push the traffic up the ladder (and farther away from you) Implement local filters at your border router Ask your ISP to implement the same filters on their side of the link

SANS Network Security 2001 Understanding, Planning For, and Responding To Denial of Service Attacks Slide - 12 Sample ISP Contact Policy TheShell.com Qwest Communications NOC: Press: 1,#,2,2 IP Team: Tony: Tony Cell: CORE: ACCT: Circuit: :

SANS Network Security 2001 Understanding, Planning For, and Responding To Denial of Service Attacks Slide - 13 Conclusion Nobody wins this game No easy solution to the problem Best defense lies in organization and policy

SANS Network Security 2001 Understanding, Planning For, and Responding To Denial of Service Attacks Slide - 14 Contact: Barrett Lyon Security Consultant Network Presence, LLC 6033 W. Century Blvd., Ste 400 Los Angeles, CA Robert Brown Vice President