Upload
apnic
View
254
Download
0
Tags:
Embed Size (px)
Citation preview
Worldwide Infrastructure Security Report
C F Chui, Arbor Networks
Tenth Year of WISR…..
`The more things change, the more they stay the same.’
Ten years of surveying the operational security community on threats, concerns, mitigation/detection strategies and technologies.
Significant broadening in both survey scope and respondent mix over this time period
Some clear, ongoing trends and some new insights every year
Valuable repository of data on the evolution of threats and our means of combating them
Infrastructure Survey Demographics
• Survey conducted in October 2014
• 287 total respondents across different market segments
• 60% Internet Service Providers
Key Findings
• Continued growth in peak attack sizes
• Huge number of VERY large attacks reported / monitored
• Attack frequency jumps up again
• More respondents see cloud services being hit
• Intelligent DDoS Mitigation Solutions (IDMS) usage moves ahead of ACLs for the first time
DDoS in 2014:
A Time of Reflection…
• ISP and Enterprise/Government/Education (EGE) data this year
• Only half of respondents at least reasonably prepared for an incident
• DDoS a top threat for both ISP and EGE respondents
• Nearly half of EGE respondents saw DDoS attacks, with a significant proportion of attacks saturating connectivity
• APT a top concern for EGE going forward
Corporate Network Security
Key Findings
• Traffic growing strongly, but still not significant
• Nearly three-quarters of service providers now have some customers utilizing IPv6 services
IPv6
• Big increase in those seeing revenue loss due to DDoS
• Almost two thirds reported DDoS attacks, 38% see attacks exceed total Internet bandwidth
• Big rises in use of IDMS and ACLs
Data Center
• Worrying trend indicating a decrease in focus on DNS security
• Lower number of respondents see customer visible outagesDNS
• Most respondents have dedicated resources, but hiring / retaining still an issue
• Concerning reductions in anti-spoofing and DDoS incident rehearsal
Security Practices
• LTE being pervasively deployed
• Fewer respondents see customer visible outage due to a security incident
• Attacks targeting infrastructure up, but down against Gi/SGi
Mobile
ATLAS Demographics
• ATLAS provides invaluable data to Arbor customers and the broader operational security community
• 330+ participating customers
– 32% Europe
– 24% North America
– 17% Asia
– 9% South America
– 9% Global
• Tracking a peak of over 120Tbps
Substantial Growth in Largest Attacks
• Largest reported attacks ranged from 400Gbps at the top end, through 300Gbps, 200Gbps and 170Gbps
• Some saw multiple events above 100Gbps but only reported largest
2014 Q3/Q4 attacks summary :
BPS : 117.15Gbps / 31.26Mpps, NTP reflection (port 22), 15 mins.
APAC DDoS attacks summary
Period Average Attack size % Change Peak Attack Size % Change
Q3 588.74Mbps +10.98% 98.89Gbps -22.2%
Q4 500.68Mbps -15% 117.15Gbps +18%
Attack traffic size - APAC Q3 2014
>20Gbps
10-20Gbps
5-10Gbps
2-5Gbps
1-2Gbps
500Mbps-1Gbps
<500Mbps
Attack traffic size - APAC Q4 2014
>20Gbps
10-20Gbps
5-10Gbps
2-5Gbps
1-2Gbps
500Mbps-1Gbps
<500Mbps
2014, A Time of Reflection….. (part 1)
2014, A Time of Reflection….. (part 2)
• NTP significant throughout 2014
– 93 attacks over 100Gbps, 5 over 200Gbps.
• DNS has historically been the ‘leading’ protocol used for reflection amplification
• SSDP significant post Q3
– 25K attacks per month in Q4
– Largest at 131Gbps
• Other protocols still a concern
APAC – Reflection/Amplification attacks seen
Protocols for Amplification
Given the huge storm of NTP reflection
activity, there has been some focus on
other protocols that can be used in this
way.
Looking at attacks with source-ports of
services used for reflection.
DNS has been used by attackers for
several years.
Significant growth in attacks with source
port 1900 (SSDP)
2.1% of total attacks in Q4 are
SSDP
Max attack seen – 49Gbps
Exploited Protocol % Q1 % Q2 % Q3 % Q4 Max attack size (Gbps)
DNS (53) 0.7 2.4 3.6 1.3 97
NTP (123) 3.5 1.1 1.1 3.5 127
SSDP (1900) <0.1 <0.1 0.7 2.1 49
Chargen (19) 0.3 0.5 1.0 1.0 25
SNMP (161) <0.1 <0.1 <0.1 <0.1 4.8
ATLAS – Unprecedented Flood of Attacks
• Peak monitored attack at 325Gbps, up 32% on last year
– Attacks larger than 2013 peak in January, February, August and December 2014
• ATLAS also monitored more than 4x the number of attacks over 100Gbps in 2014, as compared to 2013
Large DDoS attacks seen in 2014 APAC
Peak Attack Growth trend in Gbps
235.6
127.16
98.89117.15
0
50
100
150
200
250
Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec
Peak Monthly Gbps of Attacks
Q1 Q2 Q3 Q4
235Gbps / 63Mpps to India, NTP reflection attacktargeting port 80, 21 min
23 sec
127Gbps / 34Mpps to Malaysia , NTP reflection
attack targeting port 52606, 29 min
99Gbps / 26Mpps to India, NTP reflection attack
targeting port 80, 31 min
117Gbps / 31Mpps to India, NTP reflection
attack targeting port 22, 15 min 37 sec
Large Attacks Analysis
28 events over 50Gb/sec in Q4,
this gives 132 for year 2014.
Q4 saw numbers of larger events
trend down from Q4.
0.13% above 10Gbps,
compared to 0.22% in Q3
Large DDoS attacks analysis – 2014 APAC
NTP reflection attacks trending
down over the quarter (in terms of
large attacks): 3.51% of events overall (1.14% in
Q3)
2.11% of events (NTP reflection
attacks) over 10Gbps (5.34% in Q3)
0
100
200
300
400
500
600
700
800
Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec
no of events of attack size >10Gbps
>10Gbps
DDoS : Who is being hit?
• End users and e-commerce are top two targets, as last year
• Finance moves down to fifth, behind government and gaming
• Customers of respondents most common targets of attacks
• Percentage of attacks targeting Infrastructure continues to rise
DDoS : Attack Types
• HTTP and DNS are top targets of application-layer attacks
• Drop in proportion of respondents seeing attacks targeting HTTPS
• Two-thirds of attacks are volumetric, up slightly
– No surprise given reflection storm
• 90% of respondents report seeing application-layer attacks
– 4% fall in proportion of application-layer attacks
ATLAS attack types stats Q4 2014 APAC
Dest Port Break-Out (Q4)
Port 80 (HTTP) stays at number 1,
with 17% of events
Roughly the same as Q3 (17%)
Fragment stays at number 2 with
7%
Slightly decrease from 10% in Q3
Attacks targeting port 53 (DNS) in
top 3 for the past 6 months.
8% Q3, 4% Q4
Attack dest ports - APAC Q3 2014
80
NIF
53
32768-65535
ICMP
0-32767
7000
others
Attack dest ports - APAC Q4 2014
80
fragment
53
7000
ICMP
443
32768-65535
others
DDoS : Why? And, How Often?
• Significant increase in proportion of respondents seeing more than 21 attacks per month
– Up to 38% from 25% last year
• Top 3 motivations stay the same, but order changes
– Ideological hacktivism knocked off top spot!
• Continued increase in extortion, market manipulation or disguise as motivations
DDoS : A Top Priority for ISP Customers
• 70% of service providers see increased demand for DDoS detection and mitigation services from their customers
• Cloud / Hosting providers top vertical interested in DDoS services– Not surprising given big jump in
proportion of respondents seeing attacks targeting cloud (29%, up from 19%)
• Finance, Government and e-commerce also top list
ISP Threat Detection and Mitigation
• NetFlow analyzers are the most effective and most commonly deployed detection mechanism
• Firewall logs, the 2nd most commonly deployed detection mechanism rank 6th in terms of effectiveness
• IDMS moves ahead of ACLs as most common mitigation mechanism
• Firewalls fall back again
• Proportion of respondents able to mitigate in < 20 mins up to 60%
Data Center DDoS, Attacks & Impact
• Almost two thirds reported DDoS attacks, down from last year
• Most common attack target is now customer, rather than service infrastructure
• 38% see attacks exceed total Internet bandwidth, same as last year
• As last year 81% see increased operational expenses as top issue
• Big increase in proportion seeing revenue loss, from 27% to 44%
Protecting the Data Center
• Firewalls, application firewalls and IPS are still top three deployed security technologies
• Big rises in use of IDMS, 6% to 48%, and ACLs, 13% to 30%
• 49% see firewalls fail due to DDoS
• 37% offer DDoS protection services to their customers, either as standard or as an option. 21% offer multiple tiers of service
DNS, Still not a Security Focus
• Proportion of respondents with NO security group with formal responsibility for DNS continues to rise, now 33%
• Only 17% of respondents of respondents saw a customer visible outage due to DDoS, down from 36% last year
– Maybe due to attacker focus on other protocols
• Layer 7 visibility improved to 41% from, 37% last year and 27% in 2012
Best Current Practices
• 94% of respondents have dedicated security resources
• The challenges facing organizations in building out teams remain the same - hiring / retaining skilled personnel is a key issue
• The proportion of respondent implementing anti-spoofing has fallen
– This is a big concern given reflection amplification attacks
• The proportion of respondents who practice DDoS defense continues to fall
MNOs : LTE Becoming Pervasive
• 68% of respondents who operate mobile networks have over 1 million subscribers
– 22% have more than 25M
• LTE deployments becoming pervasive
• 80% of MNOs do NOT support IPv6 in either subscriber devices or mobile infrastructure
Mobile Security
• 36% experienced poorly implemented mobile applications impacting service
• 17% of respondents indicated that they have suffered a customer-visible outage due to a security incident
• Three quarters of respondents cannot detect a compromised subscriber on their networks
• iACLs and NAT/PAT are still the most common defensive measures used by MNOs, but there have also been big increases in the use of other technologies
DDoS in the MNO
• 36% of respondents see attacks against their mobile users, RAN, back-haul or packet core, up from 25% last year
• Only 7% see attacks on the Internet (Gi) Infrastructure, down from 24% last year
– 57% still don’t know due to lack of visibility
– External firewalls top attack target
Conclusions
• Arbor has been conducting the WISR now for 10 years, and there have been some big changes
– Networks, and the way in which we use them, have changed
– Massive increase in respondents
– More diverse respondent mix
– Broader range of question topics
• The WISR represents a hugely valuable repository of the observations, experiences and concerns of the OpSec community
– Identifies ongoing trends
– Unexpected shifts in behavior
• Goals remain the same
– Educate the broader community
– Share solutions to common issues
Thank You