Drew Reinders | GSEC Principal Solutions Engineer Defending Your Castle

©2014 AKAMAI | FASTER FORWARD TM THREAT LANDSCAPE

©2014 AKAMAI | FASTER FORWARD TM Daily Attack Size 150 Gbps Source: Akamai

©2014 AKAMAI | FASTER FORWARD TM 2014e Attacks Are Growing in Size Modern attacks harness the scale of growing botnets Gbps Mpps

©2014 AKAMAI | FASTER FORWARD TM Attack Types – Last 30 Days Source: Akamai

©2014 AKAMAI | FASTER FORWARD TM Avoid data theft and downtime by extending the security perimeter outside the data-center and protect from increasing frequency, scale and sophistication of web attacks. Targeting Applications for Data Theft Increasing number of attacks focused on data and financial theft SQL injection is the primary culprit in 30% of data breaches Source: Veracode 3 out of 4 will be targeted by Web application exploits Web applications are responsible for 54% of hacking-based data breaches

©2014 AKAMAI | FASTER FORWARD TM Avoid data theft and downtime by extending the security perimeter outside the data-center and protect from increasing frequency, scale and sophistication of web attacks. Cost of Data Breach Cost per Record Breached ~$ Brand and Loyalty Impact is Significant Breaches Impact Business Operations Remediation Activity is Costly Top Executives have been Replaced Data Breach Risk Can’t be Transferred Ponemon Institute: ABCNews: Cost per Record * Number of Records = Cost of Breach

©2014 AKAMAI | FASTER FORWARD TM Attackers Using Old and New Techniques Recent Techniques Application Attack, Reconnaissance - Prolific Vulnerability Scanning Application Attack - Skipfish RFI/LFI to Compromise Host Application Attack - Injection Attacks Capacity Attack – Targeting DNS Capacity Attack - DNS Reflection & Amplification Capacity Attack – Request Floods (DirtJumper) Capacity Attack - NTP Amplification (366x amplification factor) Capacity Attack - Resource Intensive Requests (Search, Login, etc.) Extortion – DDoS Pay and Stop, for a while Fraud - Account Checkers and Harvesters Defense MUST Adapt to Evolving Landscape

©2014 AKAMAI | FASTER FORWARD TM MULTI PERIMETER

©2014 AKAMAI | FASTER FORWARD TM Application Defense

©2014 AKAMAI | FASTER FORWARD TM Avoid data theft and downtime by extending the security perimeter outside the data-center and protect from increasing frequency, scale and sophistication of web attacks. Multiple Perimeters for Internet-facing Applications Internet Web Retrieving content and data Origin Supporting infrastructure and other applications User DNS Finding the application

©2014 AKAMAI | FASTER FORWARD TM Layered Defense

©2014 AKAMAI | FASTER FORWARD TM Nine Layers of Cloud Security 1. Cloud security platform with massive scale 2. Reverse proxy automatically drops network-layer attacks 3. Geo-based blocking 4. Validating attackers against known lists 5. Adaptive rate controls provide rapid and automated response 6. Web application firewall with an Evolving Rule Set 7. Natural resiliency through caching 8. Leverage visibility of evolving attack vectors 9. Require cloud service providers to meet FedRAMP requirements

©2014 AKAMAI | FASTER FORWARD TM There are no rules of architecture for castles in the clouds. -Gilbert K. Chesterton-Gilbert K. Chesterton