DDOS — a Problem Bigger Than You Can Ever Be

I was just read­ing this report from Arbor Networks which has some really valu­able data on the size of DDOS attacks on the Internet.

Data Source

If you don’t know, Arbor Networks makes a DDOS appli­ance that is used by many of the car­ri­ers to detect and mit­ig­ate DDOS attacks at very large scale. Many of the appli­ances installed send inform­a­tion back to Arbor as part of a dis­trib­uted ana­lysis ser­vice. Because of inform­a­tion, appar­ently “obtained from ~100 ISP’s” they have a very good view on a widely dis­trib­uted problem.

Main Points

Here are the scary bits.

That said, to the data… There were 350,367 dis­crete anom­alies repor­ted within the 12-​​month study period, with 20,280 (~5.8%) of these exceed­ing 1 Gbps.

and

With just over 20k attacks lar­ger than 1 Gbps in 2009, we col­lec­ted a registered incid­ent of 1 Gbps or lar­ger roughly every 26 minutes through­out the year, and received a report­able attack every ~90 seconds. Furthermore, we observed a registered 10 Gbps or lar­ger attack roughly every 190 minutes (just over 3 hours).

Observations

Many people think that because they learned about Denial of Service in CCSP train­ing that they have the tools to fix a DDOS attack. A bit of TCP SYN flood pro­tec­tion, some “threat detec­tion” on the Cisco ASA or maybe using an IPS mod­ule isn’t going to be enough when someone can flood your entire Internet con­nec­tion. Even if you can afford a 1 Gigabit con­nec­tion, the Arbor report clearly shows that an attacker can eas­ily exceed that band­width, and you will be down and all your pre­ven­tion will be for nothing.

Evaluating Risk

To gen­er­ate that much traffic means that someone has a strong desire to attack. This would require a bot net and not just a single Internet con­nec­tion and require a reas­on­able amount of intent and organisation.

On the other hand, smal­ler DDOS attacks can be equally effect­ive. A TCP SYN flood to a single address which takes your email server down for a couple of days is still effect­ive even though it might use less than 500 Kbps of bandwidth.

As an example of eval­u­at­ing your secur­ity risks before solv­ing the prob­lem this is a clas­sic secur­ity dilemma. Do you put in expens­ive fire­walls and DDOS defences, or upgrade your band­width. Remember that upgrad­ing your band­width will also improve the response time of your Internet con­nec­tion because the reduced seri­al­isa­tion delay between 100Mbits and 1000Mbits (or even 10Gbps) has a real impact on user performance.

If you go for adding the expens­ive DDOS appli­ances, and the DDOS attack over­runs your band­width, you look stu­pid. If you go for more band­width but skip the expens­ive DDOS gear, you could get taken out by a reas­on­ably small DDOS event.

No win­ners.

Wrap Up

So the DDOS prob­lem is many faceted. It can be big­ger than any band­width than you can reas­on­ably buy, it can be small enough to take down your serv­ers if you don’t buy the right tools. A lose/​lose situation.

Take these com­fort­ing clos­ing words from the Arbor report:

To that point, I sus­pect it would be safe to assume that the prob­ab­il­ity of an effectively-​​sized attack tar­get­ing a given Internet prop­erty today is higher than the prob­ab­il­ity of a fire that affects that enter­prises Internet avail­ab­il­ity and online pres­ence (some­thing I’ll look to qualify) – whilst from a busi­ness con­tinu­ity per­spect­ive the lat­ter is quite likely what the enter­prise val­ues most in today’s ‘con­nec­ted’ world.

“Hey Boss, how much money do we spend on fire prevention ?”

Image Credit

Please rate this post:

(2 votes, average: 7.00 out of 10)

 Loading ...