A presentation from the Jisc security conference 2018 by Lee Harrigan-Green

1. DDoS 2017/18 review
Lee Harrigan-Green
Chief security architect

2. DDoS 2018/17 review 2
What to expect
1. DDoS by numbers!
2. Changing DDoS threat landscape
and War stories
3. New DDoS protection services

3. DDoS attacks over the last year
Oct Nov Dec Jan Feb Mar Apr May Jun Jul Aug Sep Oct
2016/17 2017/18
DDoS 2018/17 review 3

4. DDoS attacks over the last year
Oct Nov Dec Jan Feb Mar Apr May Jun Jul Aug Sep Oct
2016/17 2017/18
DDoS 2018/17 review 4

5. DDoS attacks by traffic volume (Gbps)
Under 1 Gbps 1-5 Gbps 5-10 Gbps 10-15 Gbps 15-20 Gbps 20-30 Gbps 30-40 Gbps Above 40 Gbps
2016/17 2017/18
DDoS 2018/17 review 5

6. DDoS attacks by packet rates (PPS)
0-125K 125K-250K 250K-500K 500K-750K 750K-1M 1M-1.5M 1.5M-2M 2M-3M 3M-4M 4M-5M > 5M
2016/17 2017/18
DDoS 2018/17 review 6

7. DDoS attacks by time of day12AM
1AM
2AM
3AM
4AM
5AM
6AM
7AM
8AM
9AM
10AM
11AM
12PM
1PM
2PM
3PM
4PM
5PM
6PM
7PM
8PM
9PM
10PM
11PM
2016/17 2017/18
DDoS 2018/17 review 7

8. DDoS attacks by sector
FE
HEI
School or Council
Science & Research
Other
2016/17 2017/18
DDoS 2018/17 review 8

9. Sector breakdown over the last year
Nov-17 Dec-17 Jan-18 Feb-18 Mar-18 Apr-18 May-18 Jun-18 Jul-18 Aug-18 Sep-18 Oct-18
Attacks
FE HEI School or Council Other Science & Research
DDoS 2018/17 review 9

10. Sector breakdown over the last year
Nov-17 Dec-17 Jan-18 Feb-18 Mar-18 Apr-18 May-18 Jun-18 Jul-18 Aug-18 Sep-18 Oct-18
Attacks
FE HEI School or Council Other Science & Research
DDoS 2018/17 review 10

11. The changing DDoS threat landscape
DDoS 2018/17 review 11

12. Attack vector breakdown
Nov-17 Dec-17 Jan-18 Feb-18 Mar-18 Apr-18 May-18 Jun-18 Jul-18 Aug-18 Sep-18 Oct-18
Attacks
TCP SYN/ACK Amplification UDP
IP Fragmentation TCP SYN
NTP Amplification Memcached Amplification
DNS Amplification Chargen
CLDAP
DDoS 2018/17 review 12

13. Nov-17 Dec-17 Jan-18 Feb-18 Mar-18 Apr-18 May-18 Jun-18 Jul-18 Aug-18 Sep-18 Oct-18
Attacks
TCP SYN/ACK Amplification UDP
IP Fragmentation TCP SYN
NTP Amplification Memcached Amplification
DNS Amplification Chargen
CLDAP
Attack vector breakdown (Memcached)
13
Nov-17 Dec-17 Jan-18 Feb-18 Mar-18 Apr-18 May-18 Jun-18 Jul-18 Aug-18 Sep-18 Oct-18
Attacks
TCP SYN/ACK Amplification UDP
IP Fragmentation TCP SYN
NTP Amplification Memcached Amplification
DNS Amplification Chargen
CLDAP
DDoS 2018/17 review

14. Nov-17 Dec-17 Jan-18 Feb-18 Mar-18 Apr-18 May-18 Jun-18 Jul-18 Aug-18 Sep-18 Oct-18
Attacks
TCP SYN/ACK Amplification UDP
IP Fragmentation TCP SYN
NTP Amplification Memcached Amplification
DNS Amplification Chargen
CLDAP
Attack vector breakdown (DNS Amplification)
DDoS 2018/17 review 14

15. Nov-17 Dec-17 Jan-18 Feb-18 Mar-18 Apr-18 May-18 Jun-18 Jul-18 Aug-18 Sep-18 Oct-18
Attacks
TCP SYN/ACK Amplification UDP
IP Fragmentation TCP SYN
NTP Amplification Memcached Amplification
DNS Amplification Chargen
CLDAP
Attack vector breakdown (DNS Amplification)
DDoS 2018/17 review 15

16. Nov-17 Dec-17 Jan-18 Feb-18 Mar-18 Apr-18 May-18 Jun-18 Jul-18 Aug-18 Sep-18 Oct-18
Attacks
TCP SYN/ACK Amplification UDP
IP Fragmentation TCP SYN
NTP Amplification Memcached Amplification
DNS Amplification Chargen
CLDAP
Attack vector breakdown (CLDAP)
DDoS 2018/17 review 16

17. Nov-17 Dec-17 Jan-18 Feb-18 Mar-18 Apr-18 May-18 Jun-18 Jul-18 Aug-18 Sep-18 Oct-18
Attacks
TCP SYN/ACK Amplification UDP
IP Fragmentation TCP SYN
NTP Amplification Memcached Amplification
DNS Amplification Chargen
CLDAP
Attack vector breakdown (CLDAP)
DDoS 2018/17 review 17

18. Internet
Internet
Direct Peering
DDoS 2018/17 review 18
Janet

19. Nov-17 Dec-17 Jan-18 Feb-18 Mar-18 Apr-18 May-18 Jun-18 Jul-18 Aug-18 Sep-18 Oct-18
Attacks
TCP SYN/ACK Amplification UDP
IP Fragmentation TCP SYN
NTP Amplification Memcached Amplification
DNS Amplification Chargen
CLDAP
Attack vector breakdown (TCP SYN)
DDoS 2018/17 review 19

20. Nov-17 Dec-17 Jan-18 Feb-18 Mar-18 Apr-18 May-18 Jun-18 Jul-18 Aug-18 Sep-18 Oct-18
Attacks
TCP SYN/ACK Amplification UDP
IP Fragmentation TCP SYN
NTP Amplification Memcached Amplification
DNS Amplification Chargen
CLDAP
Attack vector breakdown (TCP SYN)
DDoS 2018/17 review 20

21. Nov-17 Dec-17 Jan-18 Feb-18 Mar-18 Apr-18 May-18 Jun-18 Jul-18 Aug-18 Sep-18 Oct-18
Attacks
TCP SYN/ACK Amplification UDP
IP Fragmentation TCP SYN
NTP Amplification Memcached Amplification
DNS Amplification Chargen
CLDAP
Attack vector breakdown (TCP SYN/ACK Amplification)
DDoS 2018/17 review 21

22. Nov-17 Dec-17 Jan-18 Feb-18 Mar-18 Apr-18 May-18 Jun-18 Jul-18 Aug-18 Sep-18 Oct-18
Attacks
TCP SYN/ACK Amplification UDP
IP Fragmentation TCP SYN
NTP Amplification Memcached Amplification
DNS Amplification Chargen
CLDAP
Attack vector breakdown (TCP SYN)
DDoS 2018/17 review 22

23. Cybersecurity portal and enhanced DDoS services
DDoS 2018/17 review 23

24. Enhanced DDoS Service (Cyber security portal)
• Real-time information on any alerts, attacks and mitigations.
• Network-wide perspective on the frequency and impact of alerts.
• Regular DDoS reporting (PDF via email)
• Download a sample of attack traffic (In development)
cybersecurity.jisc.ac.uk
DDoS 2018/17 review 24

25. DDoS 2018/17 review 25

26. Enhanced DDoS service (Response time)
DDoS 2018/17 review 26
Foundation
mitigation
Protecting your network connection.
Mitigation is manually applied by security analysts.
Mon-Fri 9am – midnight. Sat/Sun 9am – 5pm.
Fast Automated mitigation. High level threat alerts trigger rerouting
and mitigation within 4 minutes.
Service available 24/7.
Instant Permanent mitigation. All traffic is permanently routed via
mitigation ensuring no mitigation delay in the event of an attack.
Service available 24/7.

27. Response speed – Fast
DDoS 2018/17 review 27
Time
Mbps
Total Traffic
Filtered Traffic
Passed Traffic
Attack
Launched
Automatic response
~4 mins

28. Response speed – Instant
DDoS 2018/17 review 28
Time
Mbps
Attack
Launched
Total Traffic
Filtered Traffic
Passed Traffic

29. Enhanced DDoS service (Customisation)
DDoS 2018/17 review 29
Foundation
mitigation
Protecting your network connection.
Mitigation is manually applied by security analysts.
Mon-Fri 9am – midnight. Sat/Sun 9am – 5pm.
Pre-
configured
Choose from one of a selection of pre-configured service
profiles. Alert triggers and mitigation responses are designed by
Jisc security analysts to be suitable for many services.
Bespoke With the help of a security analyst adjust parameters of an alert
or mitigation in order to create a bespoke mitigation to protect
your unique services. Advanced reporting via the portal.

30. Enhanced DDoS service (Pre-configured profiles)
DDoS 2018/17 review 30

31. Enhanced DDoS service (Order process)
DDoS 2018/17 review 31
Assessment call
Proposal and quotation
Acceptance/order
Implementation call
Implement mitigation

32. Enhanced DDoS service
(Assessment call)
DDoS 2018/17 review 32
The mandatory assessment call is essential
for us to understand your concerns,
performance requirements, technical
configurations and work through all the
options to offer the most economic and
appropriate solution.
???

33. If testing or “go-live” isn’t
feasible during normal
working hours we can
arrange an out-of-hours test
and switch on.*
*There is a £500 charge for this service
Enhanced DDoS service (Implementation call)
During the implementation
call we configure the system
using the details you’ve
gathered.
We recommend testing the
mitigation system during this
process to ensure the
configuration is performing
correctly.
DDoS 2018/17 review 33

34. Get in
touch…
Except where otherwise noted,
this work is licensed under CC-BY
Lee Harrigan-Green
chief security architect
Lee.Harrrigan-Green@jisc.ac.uk
Enhanced DDoS enquiries
securityservices@jisc.ac.uk