1. Backbone and Campus Security Threats/Trends
Craig Labovitz
Danny McPherson

2. Background
Monitoring anomalous routing and traffic data from 100+ tier1/2 and campus/enterprise networks
Represent most of North America and EMA transit bandwidth
Anonymized detailed attack statistics from 40 deployments
Includes I2 backbone and several GigaPoPs
Bi-annual surveys of 50+ ISP and Campus/Enterprise networks
The survey was targeted at obtaining an understanding of some of the operational security aspects occurring in large Internet networks today
The findings of this survey are reflects in the following slides

3. (2005 H2) Primary Threat Concerns
Brute force bandwidth (pps) remain largest threat
Little perceived threat from routing or more complex attack vectors

4. Attack Targets
Core infrastructure and customer links rarely targeted - specific customers primary target
Services such as DNS second target choice

5. Customer Impacting Attacks
An average of 40 actionable customer impact attacks per month were reported

6. Infrastructure Impacting Attacks
Infrastructure impacting attacks were far less common, on the order of 1-2 per month on average
These attacks were both directly at the infrastructure, as well as a result of collateral damage from customer attacks

7. Largest Attacks Observed
Attacks greater than 10 Gbps sustained bandwidth were reported
Not a large differential in largest attack ever v. largest in past six months - perhaps indicative of worsening problem

8. Mitigation Techniques
Lack of scalable management tools and concern over card “support” for ACLs
So, the primary mitigation techniques employed by operators involve effectively completing the attack!

9. Law Enforcement Referrals
Referrals limited by:
Lack of forensics detail
Belief in utility
Customer privacy request
Too many attacks to bother
Only 29% of respondents believe LEOs have the power and means to to act upon information provided about attacks

10. ISPs and Future Threats
31% believe ISPs are NOT in a position to mitigate future Internet threats
69% believe are, but:
“Only in limited deployment for MS customers”
“Who else can do it - customers can’t”
“Yes - but cost model is VERY tough”
“Not with today’s margins”
“$$$”
“Position, yes, paid to do so - NO!”