1. Network Presence, LLC SM Innovative Security Solutions SM www.netpr.com Understanding, Planning For, and Responding To Denial of Service Attacks SANS 2001 Robert Brown rjb@netpr.com Barrett Lyon blyon@netpr.com

2. SANS Network Security 2001 Understanding, Planning For, and Responding To Denial of Service Attacks Slide - 2 Denial of Service Attacks – The Game Types of attacks Flood-based Crash-based Difficult problem Network Engineering Information Security Psychology

3. SANS Network Security 2001 Understanding, Planning For, and Responding To Denial of Service Attacks Slide - 3 Denial of Service Attacks – The Game Vulnerability management (or lack thereof) Psychology aspect – what is the attacker trying to accomplish? Legal liability and negligence issues

4. SANS Network Security 2001 Understanding, Planning For, and Responding To Denial of Service Attacks Slide - 4 Denial of Service Attacks – The Game Attacker compromises multiple hosts and configures DDoS clients Attacker utilizes hosts to flood the Internet pipe of your organization Most commonly use ICMP, UDP, and TCP SYN floods New paper measuring attacks shows 4000 DoS attacks per week

5. SANS Network Security 2001 Understanding, Planning For, and Responding To Denial of Service Attacks Slide - 5 Overview of TheShell.com ISP specializing in Unix shell accounts Most users utilize the IRC chat network IRC is a magnet for attack At least one attack per day and 19 serious attacks in a 1 year period

6. SANS Network Security 2001 Understanding, Planning For, and Responding To Denial of Service Attacks Slide - 6 Planning for the Attack – Training Camp Developing an incident response plan is key All players must be identified, brought on board, and taught their assignments Network Engineering Information Security Internet Service Provider

7. SANS Network Security 2001 Understanding, Planning For, and Responding To Denial of Service Attacks Slide - 7 Planning for the Attack – Training Camp Create a form with complete contact information, network information, and responsibilities Ensure ISP engineering contacts are established – this is extremely important!

8. SANS Network Security 2001 Understanding, Planning For, and Responding To Denial of Service Attacks Slide - 8 Planning for the Attack – Training Camp Have a packet sniffer ready to go Ensure that a SPAN port is available on your Internet-facing switch Map existing traffic patterns Implement bandwidth limiting filters at your ISP Implement ISP-side filters for other traffic you don’t want/need

9. SANS Network Security 2001 Understanding, Planning For, and Responding To Denial of Service Attacks Slide - 9 Playing the Game Identify that you are under attack MRTG, syslog, flow logs, Intrusion Detection, Firewall logs, sniffers Identify deviation from normal traffic Determine intent of attacker Immediately look for ICMP pings and traceroute packets – the attacker usually will try to determine if the attack is working

10. SANS Network Security 2001 Understanding, Planning For, and Responding To Denial of Service Attacks Slide - 10 Playing the Game Climb the ladder Port/Service Host IP stack Local segment (switches/routers) Border router ISP router

11. SANS Network Security 2001 Understanding, Planning For, and Responding To Denial of Service Attacks Slide - 11 Playing the Game Take system offline Ask ISP to null route IP or group of IPs Develop local filters to push the traffic up the ladder (and farther away from you) Implement local filters at your border router Ask your ISP to implement the same filters on their side of the link

12. SANS Network Security 2001 Understanding, Planning For, and Responding To Denial of Service Attacks Slide - 12 Sample ISP Contact Policy TheShell.com Qwest Communications NOC: 1-800-860-1020 Press: 1,#,2,2 IP Team: 888-795-0420 Tony: 408-555-6677 Tony Cell: 703-455-6677 CORE: 98765432 ACCT: 44566789 Circuit: 1234567890 email: support@qwestip.net : cmc1@qwest.com

13. SANS Network Security 2001 Understanding, Planning For, and Responding To Denial of Service Attacks Slide - 13 Conclusion Nobody wins this game No easy solution to the problem Best defense lies in organization and policy

14. SANS Network Security 2001 Understanding, Planning For, and Responding To Denial of Service Attacks Slide - 14 Contact: Barrett Lyon Security Consultant blyon@netpr.com Network Presence, LLC 6033 W. Century Blvd., Ste 400 Los Angeles, CA 90045 310-412-8607 Robert Brown Vice President rjb@netpr.com