1. Financial Services Sector Coordinating Council (FSSCC) 1 Current DDoS landscape - Potential Impact Solutions – ISP v.s Carrier Agnostic Solutions – Fundamental Architecture Designs Long Range Vision Committee - 2/1/2011 Threat Viewpoint – Distributed Denial of Service (DDoS) Threat Intelligence Committee

2. Financial Services Sector Coordinating Council (FSSCC) Current DDoS Landscape Recent Increase in activity o Summer 2010 – North Korea DDOS attack on 3 global banks and US Government web sites o Fall 2010 – Wikileaks supporter attacks on financial services and airlines web sites Activists becoming more involved – Mastercard, Visa and Paypal attack 3,000 participants and use of 30,000 node Botnet o The publicity of the Wikileaks attacks, and the tool used, make this type of attack available to anyone with a cause to champion. Expect broader and more frequent DDOS attacks o Simple to use DDOS attack tools available on the public internet, some preconfigured to attack specific sites – simply point and click (ex. next page) Availability of BOTnets to perform attacks becoming a commodity on the internet o $9.14 per 100 bots per hour is a recently quoted blackmarket rate AT&T CISO testifies to congress #1 concern is DDOS attacks. Observed spam attack by an activist group based on their disagreement with an advertising campaign. Impact of attack against e-commerce systems would be significant. especially for businesses providing direct to consumer business services Long Range Vision Committee - 2/1/2011 Threat Viewpoint – Distributed Denial of Service (DDoS) Threat Intelligence Committee 2

3. Financial Services Sector Coordinating Council (FSSCC) Sample of DDoS Tool Simplicity Long Range Vision Committee - 2/1/2011 Threat Viewpoint – Distributed Denial of Service (DDoS) 3

4. Financial Services Sector Coordinating Council (FSSCC) Solutions – Carrier Agnostic Carrier Agnostic Solution – Benefits o Single solution regardless of number of ISP’s used by the company. o Simplifies incident management and coordination of mitigation efforts. o Provides Cross-ISP correlation for incident detecting, reporting and mitigating attacks. o Mitigation efforts can be performed closer to point of attack. o Dedicated staff for DDOS only – core competency. o Provides both network and application layer attack protection. o Typically Cloud based solutions with ample resources should adjustments be required. o Costs anticipated to be lower than combination of multiple ISP solutions.Costs are variable in the event overages of GPS volumes are reached. Carrier Agnostic Solution – Considerations o Requires configuring edge routers to forward netflow or snmp data to vendor for analysis and monitoring. o Off-Ramping solution requires re-routing ALL webzone traffic through vendor network to be filtered. NOTE: Concerns about re-directing all traffic through a third party environment o Costs are variable in the event overages of allocated protection volumes are reached. Long Range Vision Committee - 2/1/2011 Threat Viewpoint – Distributed Denial of Service (DDoS) 4 Threat Intelligence Committee

5. Financial Services Sector Coordinating Council (FSSCC) Solutions – Carrier Agnostic Long Range Vision Committee - 2/1/2011 Threat Viewpoint – Distributed Denial of Service (DDoS) 5 Threat Intelligence Committee

6. Financial Services Sector Coordinating Council (FSSCC) Solutions – ISP ISP Solution- Benefits oISP uses own netflow data for analysis, eliminating need to configure edge routers to forward traffic to vendor. oISP internally redirects traffic to filtering mechanisms, no change required to reroute traffic to vendor during incident. oFiltering can be restricted to specific host(s) traffic, filtering of entire class B traffic is not required. oCosts are NOT variable in the event overages of allocated volumes are reached. ISP Solution- Considerations oMultiple implementations required, one for each ISP providing internet service to webzone environment. oUnsure if all ISPs used offer DDOS protection services oIncident detecting, reporting and mitigating attacks is limited to single ISP environment. Increases complexity for incident management. oMitigation efforts can be performed closer to point of attack only if within ISP network. oTypically use shared security resources, staff is not dedicated solely for DDOS support – not company core competency. oProvides only network layer attack protection, not application layer attacks. oCombined costs of multiple ISP solutions is anticipated to be higher than single combination of multiple ISP solutions. Long Range Vision Committee - 2/1/2011 Threat Viewpoint – Distributed Denial of Service (DDoS) 6 Threat Intelligence Committee

7. Financial Services Sector Coordinating Council (FSSCC) Solutions – ISP Long Range Vision Committee - 2/1/2011 Threat Viewpoint – Distributed Denial of Service (DDoS) 7 Threat Intelligence Committee

8. Financial Services Sector Coordinating Council (FSSCC) Executive Summary Threat Scope of Potential ImpactRisks & ConsiderationsPotential Outcomes CountermeasuresResource StrategyCommunication StrategyFollow-Up Actions Long Range Vision Committee - 2/1/2011 8 Threat Viewpoint Summary – Distributed Denial of Service (DDoS)

9. Financial Services Sector Coordinating Council (FSSCC) Long Range Vision Committee - 2/1/2011 Open Discussion 9 Next Committee Meeting March 1, 2011