Service Provider Deployment of DDoS Mitigation
•Download as PPTX, PDF•
6 likes•932 views
Distributed denial of service (DDoS) attacks routinely capture mainstream attention, and for years high-bandwidth mitigation fell into the domain of the largest Tier 1 carriers and highly-specialized DDoS mitigation service providers. The evolution of high-bandwidth inline DDoS mitigation solutions has now opened up the opportunity for service providers of all sizes to build out their own mitigation capability, helping to better combat attacks and enable new DDoS mitigation services. This slide deck examines DDoS best practices and new security solutions available for the service provider environment.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Service Provider Deployment of DDoS Mitigation
Similar to Service Provider Deployment of DDoS Mitigation (20)
Recently uploaded
Recently uploaded (20)
Service Provider Deployment of DDoS Mitigation
- 1. Service Provider Deployment of DDoS Mitigation An IHS Infonetics Webinar #DDoS
- 2. © 2015 IHS Today’s Speakers Service Provider Deployment of DDoS Mitigation 2 Dave Larson Chief Operating Officer Corero Network Security Stephen Clark Director, IP Networks Telesystem Allen Tatara Manager, Webinar Events (Moderator) IHS Jeff Wilson Senior Research Director Cybersecurity Technology IHS #DDoS
- 3. © 2015 IHS 1 5 4 2 3 DDoS Attacks and Service Providers Mitigation Architectures for Providers Block Communications Overview Deployment Discussion Sponsor Approach 6 7 Conclusions Audience Q&A #DDoS
- 4. © 2015 IHS 20 Years of DDoS Attacks 4 First Hacktivist event: Zapatista National Liberation Army Packeting for bragging rights MafiaBoy DDoS: Yahoo!, Amazon, Dell, CNN, Ebay, Etrade Spammers discover botnets Organized crime: Extortion Estonia: Parliament, banks, media, Estonia Reform Party Spamhaus attack: Reported to reach 310 Gbps 1993 20131995 1997 1999 2001 2003 2005 2007 2009 2011 DDoS Timeline Anon hits Church of Scientology Panix.net hit with first major DDoS 2015 Coordinated bank attacks: Attack sized to 170 Gbps, continues today 500 Gbps attack in Hong Kong France swarmed after terror attack PlayStation & Xbox hit at Christmas ProtonMail attack
- 5. © 2015 IHS Solution Evolution 5 Primary focus: Tier 1 service providers 2003 2009 2013 2001 2007 2011 2015 Commercial products Cloud scrubbing De-facto standard solution Massive increase in attack volume Massive increase in attack complexity Demand for on-prem New on-prem solutions
- 6. © 2015 IHS The Dirty Secret: Tier 2/3 Peering Connections 6 Source: peeringdb.com
- 7. © 2015 IHS Long-Term Deployment Strategies 7 ‣ We surveyed 25 tier 1 and 2 operators around the globe ‣ On-prem is a no-brainer for tier 1, and becoming a viable option for tier 2 ‣ Even those who won’t deploy 100% on prem plan hybrid deployments 12% 38% 50% 0% 20% 40% 60% Partner for or purchase a hosted DDoS mitigation service Deploy a hybrid solution, with both DDoS mitigation infrastructure on premise and hosted services Build out our own DDoS mitigation infrastructure in our data centers Percent of Service Provider Respondents IHS Infonetics Cloud & Data Center Security Strategies & Vendor Leadership: Global Service Provider Survey; December 2015
- 8. © 2015 IHS Mitigation Capacity 8 ‣ Same 25 operators ‣ 77% expect to have only 50G of on-premise mitigation (or less) IHS Infonetics Cloud & Data Center Security Strategies & Vendor Leadership: Global Service Provider Survey; December 2015 8% 15% 38% 27% 12% 62% 27% 12% 0% 0% 0% 20% 40% 60% 80% >100G 100G 50G 10G 1G Percent of Service Provider Respondents Hosted On-premises
- 9. © 2015 IHS Providers Planning Investments Today 9 ‣ DDoS mitigation is a top investment priority today ‣ Would make capital investments in on-premise DDoS mitigation if the economics work IHS Infonetics Cloud & Data Center Security Strategies & Vendor Leadership: Global Service Provider Survey; December 2015 4% 4% 4% 4% 4% 4% 8% 23% 27% 46% 50% 0% 20% 40% 60% Don’t know Web application firewall UTM Sandboxing/advanced malware protection Intrusion prevention system Integrated network security platform that offers firewall,… Web security gateway Virtual security appliances/ security solutions for… Next gen firewall Firewall DDoS protection system Percent of Service Provider Respondents SecurityPlatforms
- 10. © 2015 IHS DDoS Mitigation Generates Revenue 10 ‣ Providers can turn mitigation infrastructure around and re-sell as a service IHS Infonetics Cloud & Data Center Security Strategies & Vendor Leadership: Global Service Provider Survey; December 2015 46% 46% 46% 50% 58% 65% 69% 88% 96% 0% 20% 40% 60% 80% 100% Incident response Authentication Vulnerability assessment Sandboxing/advanced threat prevention Secure web gateway Secure remote access E-mail/messaging security Firewall/UTM/NGFW DDoS protection Percent of Respondents Hosted/ManagedSecurityServices IHS Infonetics Cloud and CPE Managed Security Services Market Size & Forecasts; March 2015 $0 $500 $1,000 $1,500 CY13 CY14 CY15 CY16 CY17 CY18 CY19 Revenue(US$Millions) DDoS Mitigation Revenue
- 11. © 2015 IHS 1 5 4 2 3 DDoS Attacks and Service Providers Mitigation Architectures for Providers Block Communications Overview Deployment Discussion Sponsor Approach 6 7 Conclusions Audience Q&A #DDoS
- 12. © 2015 IHS Unprotected Customer Attack Traffic Non-Attack Traffic DDoS Detection (NetFlow Collector/Analyzer) Null Route on Destination IP Native Traffic Path All traffic discarded DDoS Defense 1.0 - Null Route 12
- 13. © 2015 IHS Partially Protected Customers DDoS Detection (NetFlow Collector/Analyzer) Non-Attack Traffic Diverted Traffic Path New Route via BGP GRE Tunnel to Customer Native Traffic Path Industry Leader’s Scrubbing Approach DDoS Defense 2.0 - Scrubbing Legacy 13 Attack Traffic Non-Attack Traffic
- 14. © 2015 IHS Attack Traffic Non-Attack Traffic Non-Attack Traffic DDoS Traffic Blocked Inline Completely Protected Customers DDoS Defense 3.0 - Inline, Always-On Real-time Alerting and Reporting 14 In-line Appliance
- 15. © 2015 IHS In-line Appliance In-line Appliance In-line Appliance Always-On, Service Provider Managed Threat Defense Available as a Shared or a Dedicated Threat Defense Service Protected Resource Single Customer 10G 10G DEDICATED 10G THREAT DEFENSE DEDICATED MULTIPLE 10G THREAT DEFENSE 10G Protected Resource Single Customer 10G 10G 10G Protected Resource Customer 1 40G 10M SHARED <10G THREAT DEFENSE Protected Resource Customer 2 1G Protected Resource Customer N 100M 10G 10G Internet 15 In-line Appliance
- 16. © 2015 IHS Example Peering/Transit Point Deployment SP Upstream Provider A In-Line Appliances Deployed on 10G Peering/Transit Connections Upstream Provider B Service Provider Network 16 In-line Appliance In-line Appliance In-line Appliance In-line Appliance
- 17. © 2015 IHS Attack Traffic Non-Attack Traffic Alerting and Reporting Non-Attack Traffic DDoS Traffic Blocked at Subscriber Edge Completely Protected ISP, Hosting, and Enterprise Customers Example Subscriber Edge Deployment 17 In-line Appliance
- 18. © 2015 IHS 1 5 4 2 3 DDoS Attacks and Service Providers Mitigation Architectures for Providers Block Communications Overview Deployment Discussion Sponsor Approach 6 7 Conclusions Audience Q&A #DDoS
- 19. © 2015 IHS Block Communications Overview ‣ Communication, Internet, and Computing Solutions Provider ‣ Block Communications Commercial Telecommunications divisions, Telesystem (www.telesystem.us) and Line Systems (LSI) (www.linesystems.com) offer voice, internet, and cloud computing solutions to thousands of commercial customers extending from the east coast throughout the Midwest 19
- 20. © 2015 IHS Block’s DDoS Mitigation Deployment ‣ Number/size of links protected • TSM – eight (8) 10Gig links being mitigated • LSI – three (3) 10Gigs links being mitigated; two (2) 1Gig links being mitigated • MaxxSouth – Four (4) 10Gig links; expect to be in mitigation mode by end of month ‣ In-line deployment automatic DDoS mitigation on each of the vital interconnects ‣ Eliminate DDoS attack traffic at the peering edge 20
- 21. © 2015 IHS Relief with In-Line Mitigation ‣ Post deployment success. DDoS is handled automatically, and good user traffic flows as intended. 21 Week start date Traffic blocked (GB) 9/27/2015 7935.42 10/4/2015 5442.49 10/11/2015 4515.76 10/18/2015 2040.66 10/25/2015 5280.27 11/1/2015 6018.34 11/8/2015 4506.04 11/15/2015 3903.47 11/22/2015 5833.86 11/29/2015 4941.37 12/6/2015 2457.96 12/13/2015 5262.04 12/20/2015 25005.61 12/27/2015 8610.96 25 terabytes of DDoS attack traffic automatically removed! No human intervention Near saturation attack event on 12/22
- 22. © 2015 IHS 1 5 4 2 3 DDoS Attacks and Service Providers Mitigation Architectures for Providers Block Communications Overview Deployment Discussion Sponsor Approach 6 7 Conclusions Audience Q&A #DDoS
- 23. © 2015 IHS 23 What was your previous DDoS mitigation strategy?
- 24. © 2015 IHS 24 What drove the decision to look at new solutions?
- 25. © 2015 IHS How did you become comfortable with going to in-line mitigation? 25
- 26. © 2015 IHS 26 What other capabilities are you looking to deploy with this new solution?
- 27. © 2015 IHS 1 5 4 2 3 DDoS Attacks and Service Providers Mitigation Architectures for Providers Block Communications Overview Deployment Discussion Sponsor Approach 6 7 Conclusions Audience Q&A #DDoS
- 28. © 2015 IHS Corero SmartWall Network Threat Defense ADVANCED DDOS & CYBER THREAT DEFENSE TECHNOLOGY BUILT ON NEXT GENERATION ARCHITECTURE COMPREHENSIVE ATTACK VISIBILITY & NETWORK FORENSICS SmartWall® Threat Defense System (TDS) Service/hosting providers On-premises or cloud deployments Protection in modular increments of 10 Gbps In-line or scrubbing topologies 28 1/10/20 Gbps 80 Gbps 320 Gbps
- 29. © 2015 IHS Corero Cost Savings Opportunity ‣ From a scrubbing center perspective* - 85% rackspace advantage - 75% power advantage - 4x packet-per-second performance - >85% OPEX savings - >50% CAPEX savings * Per gigabit of scrubbing center capacity 29
- 30. © 2015 IHS DDoS as-a-Service ROI Advantage 30 Types of Customers # of Current Customers Average Monthly Charge Current Monthly Revenue Penetration Rate # of DDoS service Customers % Upcharge New Price For Service New Revenue stream 10Gbps 100 $5,000 $500,000 50% 50 3% $5,150 $7,500 1Gbps 200 $3,000 $600,000 25% 50 4% $3,120 $6,000 100Mbps 500 $500 $250,000 20% 100 8% $540 $4,000 50 Mbps 100 $100 $100,000 10% 100 10% $110 $1,000 Additional monthly DDoS as-a-service revenue - $18,500 Additional annual DDoS as-a-service revenue - $222,000
- 31. © 2015 IHS 1 5 4 2 3 DDoS Attacks and Service Providers Mitigation Architectures for Providers Block Communications Overview Deployment Discussion Sponsor Approach 6 7 Conclusions Audience Q&A #DDoS
- 32. © 2015 IHS 32 DDoS mitigation is everyone’s problem The solutions for in-line mitigation have changed There is opportunity today to save operational and bandwidth cost, and generate new revenue
- 33. © 2015 IHS 1 5 4 2 3 DDoS Attacks and Service Providers Mitigation Architectures for Providers Block Communications Overview Deployment Discussion Sponsor Approach 6 7 Conclusions Audience Q&A #DDoS
- 34. © 2015 IHS Audience Q&A Service Provider Deployment of DDoS Mitigation 34 Dave Larson Chief Operating Officer dave.larson@corero.com Corero Network Security Stephen Clark Director, IP Networks seclark@telesystem.us Telesystem Allen Tatara Manager, Webinar Events (Moderator) Allen.Tatara@ihs.com IHS Jeff Wilson Senior Research Director Cybersecurity Technology Jeff.Wilson@ihs.com IHS #DDoS
- 35. Thank You This webcast will be available on-demand for 90 days. For additional IHS Infonetics events, visit: https://www.infonetics.com/infonetics-events/ Follow us on Twitter at @infonetics and @infoneticsevent #DDoS
Editor's Notes
- 1: attackers have evolved 2: targets have evolved-now everyone is a target 3: mitigation solutions had to evolve UPDATE WITH EVENTS FROM CORERO Cloudflare-after initial attacks were mitigated by cloudflare, attackers went after their bandwidth providers (mostly tier 2 providers, who then foisted the problem onto the tier one providers they buy bandwidth from) Rutgeurs university Thai government 150G capable linux botnet Botnet made up of CCTV camers It never ends, attackers don’t discriminate…any company, any place, for any reason
- 20 years of attacks, but less than 15 years of commercial mitigation solutions…the first solutions came after the wave of public attacks that hit major brands in 1999/2000 The obvious assumption was to build something for tier 1 providers, as the traffic eventually rolled up to their networks, and they had the expertise and manpower to manage. Mitigation was very manual, and focused on volumetric attacks
- Will the Tier 1 providers help tier 2/3 when it really comes down to it? 25K public facility presences, and 15K private presences represents thousands of tier 2 providers: regional telecom providers, hosting shops, small cloud providers, etc. With so much consolidation of data into larger and larger data centers (even for tier 2/3 providers), they have become easier to target, but also have an opportunity to consolidate protection and not rely on upstream providers to fix the problem (on their timeline).
- http://techcrunch.com/2015/03/30/github-continues-to-face-evolving-ddos-attack/
- TSM – eight (8), 10Gig links being mitigated LSI – three (3), 10Gigs links being mitigated; Two (2) 1Gig links being mitigated MaxxSouth – Four (4), 10Gig links; expect to be in mitigation mode by end of month
- Firewall & manual intervention. Identification of attack vectors was difficult and mitigated, when applicable, via targeted null routing.
- Attacks that were targeting ranges as opposed to single addresses were virtually impossible to mitigate. Frequency and scale of attacks increasing. Customer impact escalated form individuals to entire sections of the network mostly due to increased scale.
- Attacks that were targeting ranges as opposed to single addresses were virtually impossible to mitigate. Frequency and scale of attacks increasing. Customer impact escalated form individuals to entire sections of the network mostly due to increased scale.
- Prevents attack traffic from entering the network which eliminates the concern with saturating a link and choking sections of the network. Provides real time monitoring and mitigation as oppose to noticing the attack and reacting after the customer experience is impacted. Provides reporting, alarming, and regular updates of attack vectors and impact – Proof of performance Provides active monitoring by Corero team and quick updates as new attacks scenarios occur This is where you can talk about the possibility of providing protection on the upstream link
- Present the product line in context of the bandwidth requirements. Dave L to mark up Evolutionary deployment for existing customers Existing DDS deployments can be scaled up without a fork lift upgrade with a SmartWall as an added component