Security auf allen Ebenen. Roman Borovits Field Systems Engineer Carsten Queisser Sr. Manager, Sales

Transkript

1 Security auf allen Ebenen Roman Borovits Field Systems Engineer Carsten Queisser Sr. Manager, Sales

2 Protecting Against DDoS is Challenging Webification of apps 71% of internet experts predict most people will do work via web or mobile by 2020 Device proliferation 95% of workers use at least one personal device for work 130 million enterprises will use mobile apps by 2014 Evolving security threats 58% of all e-theft tied to activist groups 81% of breaches involved hacking Shifting perimeter 80% of new apps will target the cloud. 72% of IT leaders have or will move applications to the cloud F5 Networks, Inc 2

3 The Evolution of Attackers January 2008 Anonymous executes a series of high-profile DDoS attacks against the Church of Scientology December 2010 WikiLeaks supporters hit PayPal, Visa, Mastercard, and other financial sites with DDoS attacks April 2011 Attackers use a DDoS attack against Sony to mask the theft of millions of customer records April 2012 Anonymous knocks down the sites of the U.S. Dept. of Justice, the CIA, and the British Secret Intelligence Service September 2012 Syrian Cyber Fighters launch Operation Ababil with DDoS attacks on 13 U.S. banks to protest an anti-muslim video Script kiddies The rise of hacktivism Cyber war F5 Networks, Inc 3

4 Attack Types and Targets are Expanding 2012 Attack Type Spear Phishing Physical Access XSS Size of circle estimates relative impact of incident in terms of cost to business May June July Aug Sep Oct Nov Dec 2012 F5 Networks, Inc 4

5 Attack Types and Targets are Expanding 2013 Non Profit EDU Non Profit Industrial Industrial Auto SVC Non Profit SVC News & Media SVC News & Media Edu Svc Food Svc Telco Consumer Electric News & Media E-comm Cnsmr Electric Cnsmr Electric News & Media Utility Software Utility News & Media Telco News & Media Telco Svc Non- Profit Software Software News & Media Edu e Edu News & Media Food Service Edu ing Gaming Retail Education Software Util Telco Gaming Edu Svcs Cnsmr Elec Software Industrial Health News & Media Auto Airport Auto Auto Software Entnment News & Media Retail News & Media Telco DNS Provider DNS Provider DNS Provider Auto DNS Provider Edu Consumer Electronics Global Delivery DNS Provider Attack Type Spear Phishing Physical Access Unknown Size of circle estimates relative impact of incident in terms of cost to business Jan Feb Mar Apr May Jun 2013 F5 Networks, Inc 5

6 F5 mitigation technologies F5 Mitigation Technologies DDoS Mitigation / OSI Layer / BIG-IP Module Increasing difficulty of attack detection OSI stack Physical (1) Data Link (2) Network (3) Transport (4) Session (5) Presentation (6) Application (7) OSI stack Network attacks Session attacks Application attacks SYN Flood, Connection Flood, UDP Flood, Push and ACK Floods, Teardrop, ICMP Floods, Ping Floods and Smurf Attacks DNS UDP Floods, DNS Query Floods, DNS NXDOMAIN Floods, SSL Floods, SSL Renegotiation OWASP Top 10 (SQL Injection, XSS, CSRF, etc.), Slowloris, Slow Post, HashDos, GET Floods BIG-IP AFM SynCheck, default-deny posture, high-capacity connection table, full-proxy traffic visibility, rate-limiting, strict TCP forwarding. Packet Velocity Accelerator (PVA) is a purpose-built, customized hardware solution that increases scale by an order of magnitude above software-only solutions. BIG-IP LTM and GTM High-scale performance, DNS Express, SSL termination, irules, SSL renegotiation validation BIG-IP ASM & APM Positive and negative policy reinforcement, irules, full proxy for HTTP, server performance anomaly detection, authentication, hardened sites F5 Networks, Inc 6

7 Layer 7 Attack / F5 Mitigation Attacks Slowloris XerXes DoS LOIC/HOIC Slow POST (RUDY) #RefRef DoS Apache Killer HashDos Active (Since) Jun 2009 Feb 2010 Nov 2010 Nov 2010 Jul 2011 Aug 2011 Dec 2011 Threat /Flaw HTTP Get Request, Partial Header Flood TCP (8 times increase, 48 threads) TCP/UDP/ HTTP Get floods HTTP web form field, Slow 1byte send Exploit SQLi for recursive SQL ops Overlapping HTTP ranges Overwhelms hash tables of all popular web platforms Java, ASP, Apache, Tomcat. Impact Attack can be launched remotely, Denial of (DOS), Resource Exhaustion, tools and script publicly available Measure LTM/iRule slow request completion *Adaptive Connect Reaper (threshold) ASM slow connect *ASM attack signature irule/ ASM (signature - regexp) irule F5 Networks, Inc 7

8 Data Center Security Architecture Use case Attack Type Spear Phishing Before f5 Firewall Network DDoS Application DDoS Web Access Management XSS Load Balancer Load Balancer & SSL DNS Security Web Application Firewall with f5 Consolidation of firewall, app security, traffic management Protection for data centers and application servers High scale for the most common inbound protocols F5 Networks, Inc 8

9 Data Center Security Consolidation Use case Attack Type Spear Phishing Before f5 Firewall Network DDoS Application DDoS Web Access Management XSS Load Balancer Load Balancer & SSL DNS Security Web Application Firewall with f5 Consolidation of firewall, app security, traffic management Protection for data centers and application servers High scale for the most common inbound protocols F5 Networks, Inc 9

10 The Business Impact of DDoS The business impact of DDoS Cost of corrective action Reputation management F5 Networks, Inc 10

11 More Sophisticated Attacks are Multi-Layer Application SSL DNS Network F5 Networks, Inc 11

12 Cyber Crime / Cyber War Folgen für Zivilgesellschaft Plötzlich war der Strom weg. Der öffentliche Nahverkehr, Flughafen, Bürogebäude - alles stand still. Das Wasser kam nicht mehr aus den Leitungen. Das öffentliche Leben erlag dem Stromausfall. Ein Softwarefehler legte 2003 acht US-Bundesstaaten und Teile Kanadas lahm. Der "Great North-America Blackout" war der zweitgrößte Stromausfall der Weltgeschichte, 50 Millionen Menschen waren betroffen. Der Fall hat gezeigt, wie anfällig die Infrastruktur von modernen Industrienationen sein kann - wie abhängig das öffentliche Leben von Software ist. Nicht auszudenken, was passiert, wenn genau diese Software ins Visier von Hackern gerät. Ein Szenario, das keineswegs abwegig ist. Denn schon seit Jahren warnen Experten genau davor: Cyber-Attacken könnten zu größeren Blackouts in Deutschland führen. Cornelius Witt, Huffingtonpost.de (2014), Cyber Angriffe: Deutsche Angst vor Blackout, de Maiziere will kritische Infrastruktur schützen F5 Networks, Inc 12

13 Cyber Crime / Cyber War - Folgen für Zivilgesellschaft Die Gefahren von Cyber-Angriffen hat Innenminister Thomas de Maizière erkannt: "Mit dem Ersten IT-Sicherheitsgesetz, das in dieser Woche in die Ressortabstimmung geht, sollen die IT-Systeme und digitalen Infrastrukturen Deutschlands zu den sichersten Systemen weltweit werden", schreibt de Maizière in einem Gastbeitrag bei der Huffington Post. Der Gesetzesentwurf soll kritische Infrastrukturen wie Energie- und Telekommunikationsnetze besser vor Cyberangriffen schützen. "Mit dem Gesetz sollen in Deutschland branchenweite Standards für die IT-Sicherheit in den Bereichen der Wirtschaft eingeführt werden, die für das Wohl unserer Gesellschaft von elementarer Bedeutung sind", so de Maizière. Cornelius Witt, Huffingtonpost.de (2014), Cyber Angriffe: Deutsche Angst vor Blackout, de Maiziere will kritische Infrastruktur schützen F5 Networks, Inc 13

14 Auf den Hacker-Angriff folgt der Börsen-Crash Der Versicherungskonzern Zurich warnt vor einer «Cyber-Sub-Crime-Krise»: Die zunehmende Vernetzung von Menschen, Wirtschaft und Staat mit dem Internet berge Systemrisiken, die ähnlich unterschätzt würden wie die Systemrisiken vor der Finanzkrise von 2007/2008. Die zunehmende Vernetzung von Wirtschaft und Gesellschaft mit dem weltweiten Cybernetz könne dazu führen, dass weitflächige Internetausfälle en, Wasserversorger, medizinische Geräte, Autos, Kraftwerke, Trafos oder Staudämme bedrohten, hiess es. Das durchschnittliche Cyberrisiko-Management weise Ähnlichkeiten zum Risikomanagement der Finanzwelt im Jahre 2008 auf, sagte Zurich-Manager Lehmann. Bisher würden sich die IT-Sicherheitsverantwortlichen meist nur auf das eigene Unternehmen konzentrieren. Die Risiken ausserhalb der eigenen vier Wände hätten sie nicht im Blick. Abhängigkeiten würden meist ignoriert. Crash F5 Networks, Inc 14

15 LIVE Demo How does F5 protect against L4 L7 DDoS attacks?

16 Highly accurate L7 DDoS, Anti-Bot and Scanner protection Differentiate between script and browser Inspection of user interaction with browser Distinguish real-user from bot Mitigate automated attacks, scanners, botnets and intellectual property scrappers Detect a persistent scrapper that uses multiple ip addresses or a single request session ASM Website Web Bot User Application Security F5 Networks, Inc 16

17 Demo Aufbau Remote Controlled Rail Network F5 Networks, Inc 17

18 Demo Aufbau Remote Controlled Rail Network Browser Steuerung Win 7 IIS PHP Engine & Java Tier 2 Multiple ISP strategy Legitimate Users DDoS Attacker ISPa/b Leitsystem Frontend Application Bot Kali Linux Threat Feed Intelligence LEGO Infrastruktursteuerung F5 Networks, Inc 18

19 DDoS protection reference architecture Next-Generation Firewall Corporate Users Tier 1 Tier 2 Multiple ISP strategy Network attacks: ICMP flood, UDP flood, SYN flood SSL attacks: SSL renegotiation, SSL flood Financial Legitimate Users DDoS Attacker ISPa/b Cloud Scrubbing Service DNS attacks: DNS amplification, query flood, dictionary attack, DNS poisoning Network and DNS IPS HTTP attacks: Slowloris, slow POST, recursive POST/GET Application E-Commerce Subscriber Threat Feed Intelligence Scanner Anonymous Proxies Anonymous Requests Botnet Attackers Strategic Point of Control F5 Networks, Inc 19

20 DDoS reference architecture Next-Generation Firewall Corporate Users TIER 1 KEY FEATURES Legitimate Users DDoS Attacker Multiple ISP strategy ISPa/b Cloud Scrubbing Service Threat Feed Intelligence Network attacks: ICMP flood, UDP flood, SYN flood DNS attacks: DNS amplification, query flood, dictionary attack, DNS poisoning Tier 1 Tier 2 The first tier at the Network and DNS SSL attacks: perimeter SSL renegotiation, is layer 3 SSL flood and 4 network firewall services Simple load balancing Application to a second tier HTTP attacks: Slowloris, slow POST, recursive POST/GET IP reputation database IPS Mitigates volumetric and DNS DDoS attacks Financial E-Commerce Subscriber Scanner Anonymous Proxies Anonymous Requests Botnet Attackers Strategic Point of Control F5 Networks, Inc 20

21 DDoS protection reference architecture Next-Generation Firewall Corporate Users Tier 1 Tier 2 Multiple ISP strategy Network attacks: ICMP flood, UDP flood, SYN flood SSL attacks: SSL renegotiation, SSL flood Financial Legitimate Users DDoS Attacker ISPa/b Cloud Scrubbing Service DNS attacks: DNS amplification, query flood, dictionary attack, DNS poisoning Network and DNS IPS HTTP attacks: Slowloris, slow POST, recursive POST/GET Application E-Commerce Subscriber Threat Feed Intelligence Scanner Anonymous Proxies Anonymous Requests Botnet Attackers Strategic Point of Control F5 Networks, Inc 21

22 DDoS reference architecture Next-Generation Firewall Corporate Users TIER 2 KEY FEATURES The second tier is for application-aware, Multiple ISP CPU-intensive defense strategy Legitimate Users SSL termination ISPa/b DDoS Attacker mechanisms Web application firewall Mitigate asymmetric Cloud and Scrubbing SSL-based Service DDoS attacks Network attacks: ICMP flood, UDP flood, SYN flood DNS attacks: DNS amplification, query flood, dictionary attack, DNS poisoning Tier 1 Network and DNS IPS SSL attacks: SSL renegotiation, SSL flood HTTP attacks: Slowloris, slow POST, recursive POST/GET Tier 2 Application Financial E-Commerce Subscriber Threat Feed Intelligence Scanner Anonymous Proxies Anonymous Requests Botnet Attackers Strategic Point of Control F5 Networks, Inc 22

23 DDoS Protection - SMB data center deployment Next-Generation Firewall Users leverage NGFW for outbound protection Employees Customers DDoS Attack ISPa Protecting L3 7 and DNS Network Firewall + DNS + Web Application Firewall + Compliance Control Partners DDoS Attack ISPb ISP provides volumetric DDoS service BIG-IP Platform BIG-IP Advanced Firewall Manager BIG-IP Local Traffic Manager BIG-IP Global Traffic Manager BIG-IP Access Policy Manager Simplified Business Models GOOD BETTER BEST BIG-IP Application Security Manager F5 Networks, Inc 23

24 DDoS Protection - Enterprise data center deployment Next-Generation Firewall Users leverage NGFW for outbound protection Employees Customers DDoS Attack ISPa Tier 1: Protecting L3 4 and DNS Network Firewall + DNS + Simple Load Balancing to Tier 2 Tier 2: Protecting L7 Web Application Firewall + SSL Termination Partners DDoS Attack ISPb ISP provides volumetric DDoS service BIG-IP Platform + IP Intelligence (IPI) Module Can inspect SSL at either tier BIG-IP Platform Cloud Scrubbing Service BIG-IP Advanced Firewall Manager BIG-IP Local Traffic Manager BIG-IP Global Traffic Manager BIG-IP Access Policy Manager BIG-IP Application Security Manager Simplified Business Models GOOD BETTER BEST + IP Intelligence F5 Networks, Inc 24

25 DDoS protection - Large FSI data center deployment Customers DDoS Attack ISPa Tier 1: Protecting L3 4 and DNS Network Firewall + Simple Load Balancing to Tier 2 AFM L LTM Tier 2: Protecting L7 Web Application Firewall + SSL Termination ASM LTM Partners DDoS Attack ISPb Multiple ISP strategy VIPRION Platform + IP Intelligence (IPI) Module DNS BIG-IP Platform Network HSM (FIPS-140) SSL re-encryption GTM SSL inspection at either tier Cloud Scrubbing Service BIG-IP Platform BIG-IP Advanced Firewall Manager BIG-IP Local Traffic Manager BIG-IP Global Traffic Manager Simplified Business Models GOOD BETTER BEST BIG-IP Application Security Manager + IP Intelligence F5 Networks, Inc 25

26 DDoS Solution Definition Workshop PREPARE Gather information about your current architecture and identify people in your organisation to participate in workshop. ANALYSE Workshop participants discuss and agree on current-state DDoS architecture, including perceived performance, and assess potential risks and challenges. ARCHITECT The workshop team, comprised of your team and F5 subject matter experts, engineer future DDoS architecture with focus on business and design goals and any prioritised technical requirements. PLAN F5 consultants lead discussion on best approach for transitioning from your current architecture to proposed architecture and produce a high-level plan to document assessed risk, timelines, and budgetary requirements. REPORT At the conclusion, you will receive a report and summary presentation outlining attack vectors and mitigating DDoS. F5 Networks, Inc 26

27 Key Benefits of the DDoS Reference Architecture Maintain application availability Protect network infrastructure Safeguard your brand reputation Defend against targeted attacks Stay one step ahead Save money for your company ALL BACKED BY WORLD-CLASS SUPPORT AND PROFESSIONAL SERVICES F5 Networks, Inc 27

28 Explore Key Resources The F5 DDoS Protection Reference Architecture F5.com/architectures all Reference Architectures Placemat: DDoS Protection Reference Architecture White paper: The F5 DDoS Protection Reference Architecture Best Practices: F5 DDoS Protection Recommended Practices F5 Networks, Inc 28

29