Tag Archives: ddos-defense

9 steps that help defend against Distributed Denial of Service (DDoS) Attacks

Most experts agree that agencies can’t defend against and mitigate the impact of denial of service attacks all by themselves, but there are step they can take to strengthen their defenses. Denial of service — DOS — is a blanket term for a variety of types of attacks, carried out in numerous ways, all directed at making online resources unavailable to the public. Attacks can be launched from multiple platforms, creating a distributed denial of service attack, or DDOS. Although they usually do not damage the target systems or compromise data, they can damage reputations, cost money and interfere with carrying out missions. Specifics will vary with each attack, but the U.S. Computer Emergency Readiness Team notes that, “In general, the best practice for mitigating DDOS attacks involves advanced preparation.” Some recommendations for advance preparation from US-CERT include: Develop a checklist for standard operating procedures to follow in the event of an attack, including maintaining a checklist of contact information for internal firewall teams, intrusion detection teams and network teams, as well as for service providers. Identify who should be contacted during an attack, what processes should be followed by each and what information is needed. ISPs and hosting providers might provide mitigation services. Be aware of the service-level agreement provisions. Identify and prioritize critical services that should be maintained during an attack so IT staff will know what resources can be turned off or blocked as needed to limit the effects of the attack. Ensure that critical systems have sufficient capacity to withstand an attack. Keep network diagrams, IT infrastructure details and asset inventories current and available to help understand the environment. Have a baseline of the daily volume, type, and performance of network traffic to help identify the type, target and vector of attack. Identify existing bottlenecks and remediation actions needed. Harden the configuration settings of the network, operating systems and applications by disabling unnecessary services and applications. Implement a bogon (bogus IP address) block list at the network boundary to drop bogus IP traffic. Employ service screening on edge routers where possible to decrease the load on stateful security devices such as firewalls. Separate or compartmentalize critical services, including public and private services; intranet, extranet, and Internet services; and create single-purpose servers for services such as HTTP, FTP, and DNS. Some additional advice for preparing yourself from Marc Gaffan, cofounder of Incapsula: Have the capacity to absorb additional traffic. It might be impractical to provision all the bandwidth needed, and the exact amount to have available will be a business decision. But a good rule of thumb would be to maintain about 150 percent of normally needed capacity. Maintain customer transparency. Ideally, people coming to the site shouldn’t know it is defending itself against an attack. “People don’t like to hang around where something bad is going on,” Gaffan said. And if a bogus connection is suspected, give the user a chance to verify. It might be impractical to use additional security such as Captcha verification for every connection during an attack, but don’t arbitrarily drop every questionable connection. Differentiate between legitimate automated traffic and DOS traffic. There can be a high volume of legitimate automated traffic generated by search engine crawls and management tools that should not be blocked. Knowing what this traffic looks like in advance can help identify DOS traffic. Be prepared to quickly identify and respond to DOS attacks so that defenses can be brought to bear quickly, minimizing downtime. For DDoS protection against your eCommerce site click here . Source: http://gcn.com/Articles/2013/01/24/9-steps-defend-against-DDOS.aspx?Page=2

Originally posted here:
9 steps that help defend against Distributed Denial of Service (DDoS) Attacks

The dark cloud over US bank Distributed Denial of Service (DDoS) Attacks

Some in the US point the finger at Iran. Another group called the Izz ad-Din al-Qassam Cyber Fighters, motivated by the US Government’s inability to remove an anti-Muslim video called the Innocence of Muslims, claimed responsibility for the recent Dedicated Denial of Service (DDoS) attacks which have brought down US banking sites since September. But the identity of the perpetrator behind these recent events is only of secondary concern in this story which has been gracing US headlines for months now. This is because at the moment, for the banks that were attacked, the problem all lies in the Cloud. Since September last year, the attack has affected some of the world’s biggest banking names including Wells Fargo, the Bank of America, Citigroup and HSBC. The attackers did not make away with personal data, or commit any form of fraud but they did move DDoS off of the PC and into the remote server, where they could push forth with new improved artillery, powered by faster performance and better and more network connections. Those who point the finger at Iran say their reason for blame lies in the sophistication of the attack, but security company Imperva’s CTO and co-founder Amichai Shulman says to some extent, launching an attack from the server, especially when the Cloud is involved, can be easier and even more importantly more cost effective. “Basically the attackers still use compromised PCs. They use these PCs to search for vulnerable servers and then exploit these, injecting code into the server so that from that time on, the attackers control the servers from a central location, usually behind an anonymizer,” Shulman says. If the attack only relied on PCs, Shulman says 10 to 100 times more compromised PCs would be required then servers to launch an attack of a similar magnitude. “It is more complex managing 100,000 PCs or even 10,000 than managing those compromised servers. Once they can reduce the management complexity they can reduce costs and increase their ability to launch operations on a more frequent basis.” According to security firm Radware’s VP of Security Solutions Carl Herberger, who was talking with the American Banker, banks have never seen such large-scale DDoS attacks. Radware has been working with banks and cloud computing providers following the attacks, which have risen with the increased uptake of cloud adoption by the financial services industry. Herbenger says one unnamed bank with enough internet capacity to handle 40bn bytes of data saw nearly twice that amount of traffic as a result of the DDoS onslaught. “The multiplying of the flood is unbelievable,” Herberger told American Banker. “Their servers, processors and offloading devices simply could not handle this problem.” Has this not been though of before? Security, you would think, will always be top of concern for a financial services player. But the Cloud has made security much more difficult a promise, according to both Shulman and Herberger. “Cloud increases the risk because it is easier to use by the attackers and harder to mitigate by the bankers,” Shulman says. Herberger says the main problem comes from banks’ leasing of cloud services, an approach that ties together the facilities of the banks and cloud computing providers. This makes it more difficult to block data from a particular internet address when an organization comes under cyber attack. He says eventually such attacks could be used for distraction for more malicious and fraudulent activity. Shulman says in the past, banks (which are no stranger to DDoS attacks) have overcome the DDoS threat by installing higher amounts of bandwidth. “But you cannot over allocate network bandwidth just because there might be the possibility of someone launching a large attack at some time. It is just too costly,” Shulman says. “The bank’s primary risk is its data set, or financial fraud, and they are well prepared for that. But this is another technique coming up, and the threat is a very real threat. One thing to remember though is that while these banks have suffered from the recent attacks, there wasn’t a single attack that actually took down one of the banking applications for an entire day.” A new challenge This could be good news but Shulman says in the world of the hacker it can also mean another challenge – and that, in the long run, means more persistent attacks. Shulman says Imperva has been studying this new trend in its own labs and that every day, he sees attackers targeting a new vulnerable type of server, often finding hundreds and thousands of potential victims. “They keep collecting compromised servers, and in some cases they will lose some – but it means for the industry overall there is clearly a higher risk,” Sulman says. Shulman says the recent attacks highlight the risk to anyone using a web service, right down to the small and medium-sized business user. “If you have a web server or web application in the enterprise, you are going to be the target of attackers, even if you don’t have valuable information in your server. Just having enough bandwidth and the server makes you a target,” In some instances the trade-off for added security, will have to be latency as data travels through more security. “The consequence could be that all traffic going in and out of a compromised server would eventually be blocked by security devices along the way,” Shulman says. The real question then – at least for now – will be how latency stands up to denied access when services are given a long-term view? For DDoS protection against your eCommerce site click here . Source: http://www.datacenterdynamics.com/focus/archive/2013/01/dark-cloud-over-us-bank-ddos-attacks

Excerpt from:
The dark cloud over US bank Distributed Denial of Service (DDoS) Attacks

New White House petition seeks to legitimize Distributed Denial of Service (DDoS) Attacks

This week, a petition was filed on the White House’s “We the People” website that aims to legitimize the use of distributed denial of service attacks (DDoS) as a legitimate form of protest. “It is the equivalent of repeatedly hitting the refresh button on a webpage. It is, in that way, no different than any ‘occupy,’ protest,” the petition states. “Instead of a group of people standing outside a building to occupy the area, they are having their computer occupy a website to slow (or deny) service of that particular website for a short time. As part of this petition, those who have been jailed for DDoS should be immediately released and have anything regarding a DDoS, that is on their ‘records,’ cleared.” Some have speculated that Anonymous is behind the petition—but Anons aren’t the only one making this argument: Evgeny Morozov, a Belarus-born tech author, scholar, and journalist made a similar case back in December 2010. However, he later warned: “Declaring that DDoS is a form of civil disobedience is not the same as proclaiming that such attacks are always effective or likely to contribute to the goals of openness and transparency pursued by Anonymous and WikiLeaks. Legitimacy is not the same thing as efficacy, even though the latter can boost the former. In fact, the proliferation of DDoS may lead to a crackdown on Internet freedom, as governments seek to establish tighter control over cyberspace.” The White House’s “We the People” website opened in 2011 and allows anyone to submit a petition to the government on any topic. If a petition gets 25,000 signatures or more, the Obama Administration will be compelled to provide a formal response. Most responses have been fairly mild, however—save releasing the White House beer recipe in late 2012. Citizens have used the system to criticize its “vapid” responses, to challenge Transportation Security Administration policy, and to encourage the president to veto SOPA, among other things. Still, as of this writing, the DDoS petition only has around 1,255 signatures—23,745 to go. Source: http://arstechnica.com/tech-policy/2013/01/new-white-house-petition-seeks-to-legitimize-ddos-attacks/

More here:
New White House petition seeks to legitimize Distributed Denial of Service (DDoS) Attacks

Distributed Denial of Service (DDoS) Attacks: 2013 Predictions

During the last third of 2012, 10 major U.S. banks were the targets of powerful distributed-denial-of-service attacks apparently launched by a foreign hacktivist group. Some observers predict there will be many more DDoS attacks against financial institutions in 2013. They say hacktivists, organized crime rings and even nation states will be the perpetrators, working collaboratively in some cases and independently in others Financial fraud expert Avivah Litan, an analyst at Gartner Research, says the attacks will continue because they work, especially for criminals. “There is no reason for the criminals to stop,” Litan says. “They are getting away with them and not getting caught. These gangs will just keep escalating the attacks, up the ante and raise the stakes on the banks. The banks will have to find and implement solutions quickly. There really is no other choice.” DDoS attacks often will be used to disguise nefarious schemes aimed at stealing intellectual property and taking over accounts, especially when the attacks are waged against smaller institutions, regulators and security experts warn. John Walker , a member of ENISA’s security experts group and chair of ISACA’s Security Advisory Group in London, says banks won’t be able to fend off all of the attacks that are coming in the new year. “What we are seeing this year is just a tip in the ocean of what is planned for 2013,” he says. To prepare for continuing DDoS attacks, banking institutions should implement incident response strategies and involve staff across multiple lines of business, as well as external partners, regulators and experts say. Banks also should consider due diligence reviews of service providers, including Internet service providers and Web-hosting companies, to ensure they, too, have taken necessary steps to identify and mitigate risks associated with DDoS attacks. PNC, Others Take Hits Since September, the hacktivist group Iz ad-Din al-Qassam Cyber Fighters has grabbed headlines for two DDoS campaigns against banks. But so far, there’s been no evidence of fraud linked to these attacks. The hacktivist group announced Dec. 25 that yet another wave of attacks was coming as part of its second campaign In the latest development, PNC Financial Services, whose customers have suffered sporadic online access issues related to high volumes of traffic during both of the DDoS campaigns, reported it experienced minor site access issues late Dec. 27. But it did not link those issues to traffic connected with a DDoS attack. PNC spokeswoman Amy Vargo says some customers reported having trouble when trying to access the bank’s site during the afternoon of Dec. 27, but “this was a very short term and intermittent issue, and the systems were quickly restored to normal.” In a Dec. 10 post on Pastebin , Iz ad-Din al-Qassam Cyber Fighters announced plans for its second campaign, targeting PNC, U.S. Bancorp, Bank of America, JPMorgan Chase and SunTrust Banks. Since then, the group has posted two subsequent threats and has apparently hit all five targeted institutions as well as Wells Fargo and Citibank, part of Citigroup The hacktivist group says its waging the attacks in protest of a YouTube video deemed offensive to Muslims. The first campaign of attacks, which ran from mid-September to mid-October, targeted all of the institutions hit in the second campaign, as well as Regions Bank, HSBC Holdings and Capital One. Warning to Banks Some security experts, however, are questioning whether Pastebin posts being attributed to Izz ad-Din al-Qassam Cyber Fighters actually came from that group. Anyone could take credit for the posts and the attacks, says Mike Rothman of DDoS prevention provider Securosis. “We’ll likely see lots of folks claiming responsibility for attacks and many doing it to draw attention to their causes,” Rothman says. “Is it really one group or another? Hard to truly tell, and ultimately I don’t think it matters. The attacks will keep happening, sometimes for no apparent reason. Organizations need to be ready, and that doesn’t change, regardless of the adversary.” Smaller banking institutions not targeted by Izz ad-Din al-Qassam Cyber Fighters should guard against a false sense of security, says Bill Nelson , president and CEO of the FS-ISAC. “We saw a year ago that smaller banks and regional banks were being hit [by other DDoS attackers] and many were at a loss about why,” Nelson says. Eventually, investigators confirmed attempts to commit fraud in the background of those attacks. On Dec. 21, the Office of the Comptroller of the Currency issued an alert about the recent wave of DDoS attacks, noting that financial institutions had linked DDoS to fraud and the theft of proprietary information “These attacks by hacktivists are trying to strike terror,” Nelson says. “But cybercriminal groups have been attacking, too, off on their own launching cyberfraud. Rather than striking terror, they’re trying to make it more difficult to detect their fraud, and that’s the worry here.” Year Ahead Securosis’ Rothman says the recent waves of hacktivist attacks have drawn attention to the severity of the DDoS threat. “We have discovered a clear knowledge gap around the denial-of-service attacks in use today and the defenses needed to maintain availability,” Rothman writes in a November paper about DDoS prevention. “There is an all-too-common belief that the defenses that protect against run-of-the-mill network and application attacks will stand up to a DDoS. That’s just not the case.” Rothman says banking institutions of all sizes must start viewing DDoS attacks as instruments for multifaceted attacks. “It’s not news that some of the attackers have been using DDoS attacks to obscure ex-filtration activity,” Rothman says. “They basically work to divert the attention of the security folks with the DDoS while they steal data via other mechanisms.” Rothman says prevention steps recommended by the OCC just reiterate the obvious. “Financial institutions need to have risk management programs, and that would include tactics to mitigate against DDoS attacks as well as leveraging information-sharing networks to keep the flow of information going. If something bad happens, they need to report it and probably disclose it to customers.” Source: http://www.bankinfosecurity.com/ddos-attacks-2013-forecast-a-5396/p-2

View article:
Distributed Denial of Service (DDoS) Attacks: 2013 Predictions

Hacktivist Hints at New Distributed Denial of Service (DDoS) Attacks

The hacktivists are now letting their words speak for their actions. For the third time in one month, a source claiming to be part of the self-proclaimed hacktivist group known as Izz ad-Din al-Qassam Cyber Fighters has granted an interview to discuss the wave of high-profile distributed denial of service attacks on U.S. banks. During the recent interview with Flashpoint Global Partners , an international consulting firm, the hacktivist representative said more attacks would be waged and that methods of attacks would diverge, until a YouTube movie trailer deemed by the group to cast Islam in a negative light is removed from the Internet. “We have done what we had promised,” the source said. “If the film isn’t removed, we’ll use our other abilities according to the new conditions.” No New Attacks Since Sept. 18, the group has taken credit for attacks on 10 leading U.S. banks: Bank of America, JPMorgan Chase, Wells Fargo, PNC, U.S. Bank, CapitalOne, HSBC, SunTrust, Regions and BB&T. No new attacks have been claimed by the group since mid-October. In early November, Webster Bank and Zions Bancorp also suffered from DDoS attacks, which caused intermittent outages to their online-banking sites for several hours. While the attacks were not linked directly to Izz ad-Din al-Qassam, Zions spokesman Rob Brough said the bank did not know who was behind the attack. “There’s no way for us to know if the attack against us was just the next one [in the series of attacks waged by Izz ad-Din al-Qassam] or if it was just a coincidence,” Brough said. “What I can tell you is that we were well-prepared because of the other incidents. When we recognized that it was a DDoS attack, we had plans in place.” DDoS and Fraud? The attacks have been concerning for two reasons: customer frustration with online-banking inaccessibility and the possibility of fraud being perpetrated in the background. On Sept. 17, the Federal Bureau of Investigation, along with the Financial Services Information Sharing and Analysis Center, issued a warning about DDoS being waged to mask incidents of account takeover occurring simultaneously. In their alert, the FBI and FS-ISAC note recent attacks that linked DDoS to fraud. “In some of the incidents, before and after unauthorized transactions occurred, the bank or credit union suffered a distributed denial of service (DDoS) attack against their public Web site(s) and/or Internet Banking URL,” the alert states. “The DDoS attacks were likely used as a distraction for bank personnel to prevent them from immediately identifying a fraudulent transaction, which in most cases is necessary to stop the wire transfer” (see High Risk: What Alert Means to Banks ). So far, no bank has reported fraud linked to DDoS attacks waged by Izz ad-Din al-Qassam, but security experts question what might really be taking place in the background. Questioning Consultants’ Competency The latest interview with Izz ad-Din al-Qassam marks the third time a member claiming affiliation with the group has spoken out on the attacks. On Oct. 31, ABC News was granted an e-mail interview, and on Nov. 7 technology news site Softpedia was given e-mailed insights. During all interviews, alleged members of the Izz ad-Din al-Qassam group stressed the group was not supported by any nation-state, government or other hacktivist group, and that all of its members were merely tech-savvy volunteers with a common mission to see the YouTube video removed (see Hacktivist Speaks Out About DDoS ). In the most recent interview, the respondent defends Izz ad-Din al-Qassam’s purpose as well as the efficacy of its attacks. “Many of [the] technical comments during the attacks have made us doubtful about [the] technical competence of American companies’ security consultants,” the respondent said, when asked by Flashpoint if the botnets it used also have attacked web-hosting companies and Internet service providers. “Many of [the] technical statements about this case are not scientific, reliable or significant,” the source added. Break Suspicious, But Expected An Oct. 23 Pastebin post notes the group’s plans to temporarily halt attacks in honor of a three-day Muslim holiday. Pastebin is the public online forum Izz ad-Din al-Qassam has used to communicate updates about its attacks. The continued break from attacks is curious, says Mike Smith , a security evangelist and DDoS specialist at Web security provider Akamai Technologies. It’s just difficult to know who is behind which attacks, he says. Speculating is pointless, he says. What is clear, however, is that banking institutions and other organizations are continually targeted, and staying ahead of these attacks, regardless of who wages them, is a necessity. “We get two or more large attacks per week against our entire customer base and countless smaller ones,” Smith says. But connecting those to one hacktivist group over another is nearly impossible, he adds. “Some of those targets are financial services, some are not.” Information-sharing shortens response time, he adds. “It’s always tough to be the first target when a new attacker or technique appears because you have to work your way to a diagnosis and implement blocking: things that take time,” Smith says. “However, good incident managers and organizations doing threat intelligence share what they know with each other, so that during subsequent attacks, although of the same magnitude and lethality, the targeted organizations know what indicators there are to the start of the attack and what techniques worked the best in previous attacks.” For DDoS protection against your eCommerce site click here . Source: http://www.bankinfosecurity.com/hacktivist-hints-at-new-ddos-attacks-a-5325/op-1

More here:
Hacktivist Hints at New Distributed Denial of Service (DDoS) Attacks

Protecting Your Network Against Distributed Denial of Service ‘DDoS’ Attacks

As leaders in their field, IT managers are tasked with the burden of not only managing but protecting company networks. Dedicated servers can be adversely affected by DDoS attackers, as their firewalls can be penetrated and flooded with malicious communication requests. Before assessing how you can prevent DDoS attacks it is first important to understand what they are and where they come from. What Are DDoS Attacks? A DDoS attack attempts to render a network or machine inaccessible or unresponsive for any considerable length of time. DDoS attacks typically saturate a network with requests as to slow, disrupt or obstruct communication from the intended user. In some cases, a DDoS attack may overwhelm network firewalls, leaving the problem up to IP providers to fix. Typical symptoms may include the following: a high volume of spam emails, in-accessibility of websites or services or exceptionally slow network performance. Either way, a DDoS attack can adversely affect business by bringing down a website, company application or cloud based computing platform. Here are a few suggestions to go about mitigating the risk associated with DDoS attacks: Preventative Measures Against Attack Properly setup of network firewalls are a must. These days, modern firewalls can be configured to deny unusual protocols from un-identified IP addresses. For instance, if your network firewall is configured to block traffic from sources it can’t identify, it may drop any or all illegitimate service requests as to maintain a normalized bandwidth threshold. Though IP bottlenecks are not always a symptom of DDoS attacks, configuring a firewall to block traffic incoming from specific ports is a form of preventative maintenance. As stated earlier, DDoS attackers may flood a system as to render it unresponsive. Rate limiting switches detect incoming traffic and may filter or slow IPs in such a way that prevents them from flooding the system. Many switches have wide-area-networks fail overs, which adjust incoming IP filtering thresholds automatically. Again, it is important to configure these systems correctly in order for them to remain effective. If system upgrades are in order then IT managers need to weigh the cost against the risk posed by DDoS attacks. Costs To Consider Personnel Costs – If attacked, how many IT workers will it take to address and remedy the problem? Support Calls – Do you really want to be tied up on the phone calling tech support? Factor in the time spent at the help desk Lost Business – If a DDoS attack causes downtime to your website, how much revenue may be lost? Lost Customers – Investing in network protection means you are also investing in consumer confidence. How many customers may be lost due to downtime. Brand Reputation – When network outages occur, brands may suffer damage to their reputation. It is important to consider this last factor. Lastly, it is important to remember that DDoS attacks may also occur by accident. Some sites may experience a denial of service when they experience a high amount of traffic. In any case where a popular website links to a trending event, traffic may suddenly spike creating a unintentional denial of service. Focus your energies on preventing the malicious attacks and it’ll be smooth sailing for your business or enterprise. For DDoS protection against your eCommerce site click here . Source: http://www.colocationamerica.com/blog/protecting-your-network-against-ddos-attacks.htm

Original post:
Protecting Your Network Against Distributed Denial of Service ‘DDoS’ Attacks

Evolving Distributed Denial of Service ‘DDoS’ Attacks Force Defenders to Adapt

Distributed denial-of-service attacks get bigger and combine application-layer exploits requiring defenders to be more agile. n the past, attackers using distributed denial-of-service (DDoS) attacks to take down Web sites or network servers typically adopted one of two tactics: Flooding the site with a deluge of data or overwhelming an application server with seemingly valid requests. Companies concerned about denial-of-service attacks have generally focused more on mitigating data floods, also known as volumetric or infrastructure attacks. Yet, increasingly attackers are using a hybrid approach, using multiple vectors to attack. The attacks that hit financial firms in September and October, for example, often used a massive flood of data packets that would overwhelm a victim’s network connection, while a much smaller subset of traffic would target vulnerable applications functions, consuming server resources. “It is almost like sending a whole squadron of tanks and then have an assault team that can go in and be mores stealthy in taking out their targets,” says Carlos Morales, vice president of global sales engineering and operations for network protection firm Arbor Networks. “It broke the model that people had for stopping these things.” The one-two punch is potent. Many financial firms thought they had the defenses in place to defeat such attacks but had problems staying accessible during the onslaught. Companies prepared to handle application-layer attacks or smaller volumetric attacks could not handle the 20Gbps or more that saturated their Internet connection. Even a gateway that can keep up with 10Gbps connection speed cannot deal with twice as much–or more–traffic sent to the same server. A recent report from network-security firm Prolexic found that the average attack bandwidth had increased to nearly 5Gbps, with 20Gbps attacks quite common. In a year, the average volume of attacks had doubled, the firm found. “The late Senator Ted Stevens got mocked for saying that the Internet is a ‘series of tubes,’” says Matthew Prince, CEO of Cloudflare, a content-delivery and network-security firm. “But the Internet is a series of tubes, and you can only fit so much through it.” Companies must start creating a multi-layered approach to stopping distributed denial-of-service attacks, according to mitigation experts. The greatest amount of attack volume should be stopped inside a provider’s network, away from the company’s links to the Internet. Trying to over-provision your network for the worst case scenario will likely not work and will be very expensive to boot. “Even if you are a large bank in the U.S., you are doing less than 10Gbps of traffic across all the properties of your network combined,” says Cloudflare’s Prince. “If you have to over-provision that by 10x, that is wasting a lot of resources.” By using a service provider to filter out most of the spurious traffic at the edge of the Internet, companies can pay attention to the data that actually enters their network. Collecting information on the traffic can help a company to better develop defenses for future attacks as well, even if a company does not have the resources to identify attacks in real time. Yet, faster detection and more agile response can mean the difference between successful defenses and downtime. “Seeing an impact and understanding that there is an attack happening is not necessarily going to happen at the same time,” says Neal Quinn, chief operating officer for attack-mitigation service Prolexic. For many companies, the threat of attacks is not over, but rather, just beginning. The most recent attacks did not start with the financial industry; other industries have been hit by similar attacks for almost the last year. Companies should not expect it to end there either. The holiday season tends to be a popular time for attackers to attempt to extort money from retailers by threatening denial-of-service attacks. “It is traditionally a very busy time of year for these attacks,” Prolexic’s Quinn says. “If anything, organizations should make themselves more aware of how well they can handle these attacks.” Source: http://www.darkreading.com/security-services/167801101/security/perimeter-security/240142616/evolving-ddos-attacks-force-defenders-to-adapt.html

65% Of Organizations Experience Three Distributed Denial of Service ‘DDoS’ Attacks A Year

Despite the increasing sophistication and severity of cyber attacks, a survey of more than 700 senior IT professionals reveals that organizations are surprisingly unarmed to deal with today’s threat landscape. In a new report titled “Cyber Security on the Offense: A Study of IT Security Experts,” the Ponemon Institute and Radware®, (NASDAQ: RDWR), a leading provider of application delivery and application security solutions for virtual and cloud data centers, found that while 65% of organizations experienced an average of three distributed denial-of-service (DDoS) attacks in the past 12 months, less than half reported being vigilant in monitoring for attacks – much less putting into practice proactive and preventative measures to protect their organizations. “The reality is that cyber threats are outpacing security professionals, leaving most organizations vulnerable and unprepared,” said Avi Chesla, chief technology officer, Radware. “From hacktivists to cyber criminals, companies live under the constant threat of assaults that contribute to lost revenue and serious reputational damage. It’s critical that organizations take immediate action after reading this report. IT managers have to advocate for a multi-layered approach that also takes in account countermeasures to prevent threats before they inflict significant damage.” Key findings from the report include: Availability is the top cyber security priority for organizations today. Gone are the days where companies could solely concern themselves with data leakage and integrity based attacks. Unlike the past few years, where many organizations focused on confidentiality and integrity-based attacks, respondents noted a major shift in their security objectives, ranking denial-of-service (DoS) and DDoS as two of the top three threats their organizations face today. DDoS attacks cost companies 3.5 million dollars every year. Although respondents cited a lack of budget as one of the major impediments to shoring up cyber security, it’s clear that organizations will pay a much higher price for their lack of preparedness. 65% reported experiencing an average of three DDoS attacks in the past 12 months, with an average downtime of 54 minutes per attack. With the cost for each minute of downtime amounting to as much as $100,000 per minute – including lost traffic, diminished end-user productivity and lost revenues – it is no surprise that respondents ranked availability as their top cyber security priority. 63% rate their organization’s offensive countermeasure capabilities as below average. While 60% say they want technology that slows down or even halts an attacker’s computer, the majority of respondents give their organizations an average or below average rating when it comes to their ability to launch counter measures. With 75% of organizations still relying on anti-virus and anti-malware to protect themselves from attacks, it’s clear that the old adage, “the best defense is a good offense” is not being practiced by most firms. Organizations are more vulnerable than ever before. With respondents ranking lack of system visibility (34 percent), mobile/remote employees (32 percent) and negligent insiders (31 percent) as their top three areas of greatest cyber security risk, it’s clear that threats can come from a number of new sources including the Bring Your Own Device (BYOD) movement. Even more frightening, today’s threats are multi-layered, targeting not only networks but the data and application levels as well. “There is a frightening gap that exists between the increasing severity of cyber attacks and the level of preparedness that exists in the industry,” said Larry Ponemon, chairman and founder of the Ponemon Institute. “The report’s findings make clear that now is the time for organizations to begin making critical changes to their security approaches in order to stave off the potentially devastating costs associated with a lack of preparedness and adequate defenses.” To access a complete version of the report, please visit www.ddoswarriors.com, Radware’s in-depth resource for information security professionals. In addition, Radware will host a webinar on November 14 to discuss the report’s findings and provide actionable insights to help any organization properly mitigate attacks in an increasingly hostile threat landscape. Sign up here. About Cyber Security on the Offense: A Study of IT Security Experts The research for Cyber Security on the Offense: A Study of IT Security Experts was co-authored by the Ponemon Institute and Radware. The report surveyed 705 U.S. based IT and IT security practitioners responsible for managing their organization’s cyber security activities. 62% of the respondents surveyed were at the supervisor level or higher with an average of more than 11 years of experience. 65% of respondents were from organizations with a global headcount of more than one thousand and the primary industry segments for the report included financial services and the public sector as well as healthcare and pharmaceuticals. The survey consisted of 35 questions on respondents’ perceptions of and experiences with their organization’s cyber security infrastructure and the types of threats they now face. In addition to the report’s key findings, Cyber Security on the Offense includes: The top ranked negative consequences of cyber attacks Barriers to achieving a strong cyber security posture The technologies most favored by IT security professionals Top methods for performing counter techniques A comparison of attacks across the financial services, healthcare and public sectors About the Ponemon Institute The Ponemon Institute is dedicated to advancing responsible information and privacy management practices in business and government. To achieve this objective, the Institute conducts independent research, educates leaders from the private and public sectors and verifies the privacy and data protection practices of organizations in a variety of industries. Source: http://www.darkreading.com/insider-threat/167801100/security/news/240124966/65-of-organizations-experience-three-ddos-attacks-a-year.html

Follow this link:
65% Of Organizations Experience Three Distributed Denial of Service ‘DDoS’ Attacks A Year

Could Cyber Attacks (Distributed Denial of Service ‘DDoS’ attack) Ruin Christmas for Retailers?

A string of cyber attacks on U.S. financial institutions has created headaches this fall by slowing down or preventing online banking access for millions of Americans. But imagine the real economic damage that similar-style attacks would cause if they struck U.S. retailers this holiday-shopping season, potentially eating into projected online sales of $54 billion. While retailers deserve credit for bolstering their defenses against credit-card-hungry organized crime rings, security professionals believe the industry is vulnerable to this different kind of onslaught aimed at crippling online sales. “The gloves are off in cyber space. The reality is if they want it to get worse, it can get worse,” said Dave Aitel, a former computer scientist at the National Security Agency. “I don’t think people are really prepared mentally to what happens if Amazon goes down.” Unlike the ongoing cyber attacks against U.S. banks, there doesn’t appear to be a specific cyber threat against retailers. Yet there are concerns that retailers aren’t ready for denial-of-service (DDoS) attacks from a powerful state actor like Iran, which many in the U.S. government suspect had a hand in the recent attacks on financial institutions like Bank of America (BAC) and J.P. Morgan Chase (JPM). “The Iranians are in the business of making a point and the bank attacks are not likely to have the impact they need, hence retailers are the next most likely target, especially in the holiday season,” said Aitel, CEO of Immunity, a cyber security firm that works with Fortune 500 companies. Online Sales Exceed $160B It’s hard to overstate the importance of e-commerce in today’s smartphone and social network dominated world. According to comScore (CSOR), annual U.S. retail e-commerce spending has surged 143% since 2004 to $161.52 billion last year. Despite the sluggish domestic economy and tepid retail sales growth, e-commerce spending jumped 13% between 2010 and 2011. Online shopping is crucial during the all-important holiday-shopping season. E-commerce spending rose 14% last holiday season to $37.2 billion, comScore said. In the face of continued economic uncertainty, online spending is projected to climb 17% this season to $54.47 billion, according to MarketLive. “It’s very important for any retailer to have a web presence or you risk being left out in the cold,” said Andrew Lipsman, vice president of industry analysis at comScore, who noted that even in-person purchases typically originate online. Adapting to Shifting Threat Security professionals believe retailers’ cyber defenses are more porous than those of financial institutions — and even some banks succumbed to relentless DDoS attacks this fall. Given their prior experience combating thieves in Russia and elsewhere trying to siphon funds or snatch credit-card numbers, retailers aren’t really positioned to halt massive DDoS attacks from powerful state actors like Iran. “That’s a very different threat and in many ways is more severe,” said Aitel. “They’re not thinking: What if it’s not about the money? What if someone wants to take me out just to take me out?” Cedric Leighton, a former NSA official, said he agrees that retailers are not as well prepared as their financial peers. “I don’t think they’ve gotten to the point where they can truly say their whole cyber supply chain is as well secured as they need to be in this day and age,” said Leighton, CEO of a Washington, D.C.-based risk-management consultancy. Leighton said hackers could also disrupt companies’ supply chains by messing with order quantities and locations, creating costly problems for retailers. Just this week Barnes & Noble (BKS) fell victim to a very sophisticated criminal attack that may have resulted in stolen credit and debit card information at 63 of its stores. Amazon Atop Target List The importance of a robust cyber defense is even more important for online retailers like Amazon.com and Overstock (OSTK). “If they aren’t available online, there is no business. They don’t exist,” said Ronen Kenig, director of security product marketing at Tel Aviv-based security firm Radware (RDWR). In a potential cyber attack on U.S. retailers, Amazon.com would clearly be the biggest prize. The Seattle company generated $17.4 billion in revenue last holiday quarter. “When you attack the United States you don’t attack Topeka, Kansas,” said Aitel. “Amazon is the big boy on the block. They are of course also the best protected.” Amazon.com and Wal-Mart (WMT) declined to comment for this story, while Target (TGT) didn’t respond to a request for comment. “Every company is going to look at what its exposure is. The greater the company is placed at risk, then the more they are going to invest in trying to protect themselves,” said Mallory Duncan, general counsel at the National Retail Federation. Noting that some companies “rely extremely heavily on the Internet,” Duncan said, “When you have a bet-the-company type of situation, they’re going to take extraordinary steps to protect that channel.” Cyber Monday in Focus Aitel suggested the days around Cyber Monday — the first work day after Black Friday — as a time when retailers need to be particularly vigilant about the cyber threat. According to comScore, U.S. e-commerce spending on Cyber Monday rose 22% last year to $1.25 billion, making it the highest online spending day in history. “The attackers always like to choose the worst time for the victim,” said Kenig. Bolstering Cyber Defenses So what specifically should retailers be doing to prevent or mitigate the impact of DDoS attacks this holiday season? Leighton said it’s crucial for companies to implement redundant systems with backups that allow switching from one system to the other when necessary. From a bigger picture standpoint, retailers should strive to install security programs that go above and beyond industry security standards, which Aitel said “are really the bottom bar.” Security professionals have been particularly alarmed by some recent cyber attacks that inflicted damage on physical assets, including a devastating attack unleashed on Saudi Arabia’s state run oil company Saudi Aramco Some believe Iran may have been behind this attack, which destroyed an estimated 30,000 computers. Aitel said, “Companies have to look at what happened to Saudi Aramco and say: What would we do if that happened to us? Until they have a good answer for that, they shouldn’t be sleeping that well.” For advanced DDoS protection against your eCommerce site click here . Source: http://www.foxbusiness.com/industries/2012/10/24/would-cyber-attacks-ruin-christmas-for-retailers/

Taken from:
Could Cyber Attacks (Distributed Denial of Service ‘DDoS’ attack) Ruin Christmas for Retailers?

Distributed Denial of Service ‘DDoS’ Attacks Increasing In Number and Intensity

Businesses are seeing an increase of Distributed Denial of Service (DDoS) attacks in comparison to last year, with attacks becoming shorter but more robust, according to a quarterly report released Oct. 16 by DDoS mitigation company Prolexic. During a DDoS incident, an attacker prevents users from being able to access a website. In order to achieve this, he typically uses malware to infect a network of computers, or botnet. The attacker can control the botnet to overwhelm a website with data and requests, forcing it to crash or become slow to the point of being unusable. For businesses, DDoS attacks can be crippling, resulting in a loss in profit or customer service until the website can be restored. Prolexic’s report found DDoS incidents have increased by 88 percent when compared to the same period of time last year. Perhaps more troubling, the incidents are becoming more intense, using higher bandwidth volumes. Prolexic President Stuart Scholly said that on average the company is seeing attacks with a bitrate of 20 gigabites per second or more every eight days. Few enterprises have networks with the capacity to withstand attacks of that size, he added. China continues to be the top source country for attacks, responsible for about 35 percent, with the United States following with 27 percent, the report found. Although the United States was the source country for only 8.76 percent of attacks last quarter, Scholly said the United States is typically the second-ranked source country after China. “Twenty gigs is the new norm,” he said. “There’s no doubt in my mind that that trend continues.” A DDoS toolkit called “itsoknoproblembro” was responsible for the majority of the high bandwidth floods this quarter, the report stated. The toolkit is especially effective because it targets vulnerable servers instead of individual computers, making the botnet easier to control and yielding a higher bandwidth, Scholly said. “What might have taken 50,000 compromised home machines before might only take a couple thousand servers now,” he said. “And it’s easier to coordinate the activities of a couple thousand high capacity machines.” The toolkit has been linked in reports to the suspected attacks on financial institutions during September, but Scholly would not comment on what companies were attacked, citing customer privacy. “What I can tell you is that this toolset is something that we’ve been observing over the years, and we’ve seen it used in multiple sectors,” he said. “It was has by no means been targeted at one individual sector.” Scholly would also not comment on what actors were responsible for the toolkit. Motivation for attacks can vary from state-sponsored activities, competing companies trying to get an economic advantage, or the overloading a server as a means of social protest, he said. Another continuing trend is the growing popularity of shorter attacks, Scholly said. “The more you expose your botnet during an attack, the greater likelihood that you have for someone to start taking it down,” he said. “So you want to accomplish your goal, and then kind of move on.” For DDoS protection against your eCommerce site please contact us . Source: http://www.nationaldefensemagazine.org/blog/Lists/Posts/Post.aspx?List=7c996cd7-cbb4-4018-baf8-8825eada7aa2&ID=929

View original post here:
Distributed Denial of Service ‘DDoS’ Attacks Increasing In Number and Intensity