68% 63% 50% 25% 24% 20% 17% Credit Theft. DDoS. Web Fraud. Cross-site Scripting. SQL Injection. Clickjack. Cross-site Request Forgery.

Size: px

Start display at page:

Download "68% 63% 50% 25% 24% 20% 17% Credit Theft. DDoS. Web Fraud. Cross-site Scripting. SQL Injection. Clickjack. Cross-site Request Forgery."

Lora Cox
5 years ago
Views:

2 PRESENTED BY:

4 Credit Theft 68% DDoS 63% Web Fraud 50% Cross-site Scripting SQL Injection Clickjack Cross-site Request Forgery 25% 24% 20% 17% Other 2% F5 Ponemon Survey

6 -Me

8 East-West Traffic Flows

9 App Vulnerability Un secure Stack Shared risk model Internet Pipe with BW Limit Routing Tables Control Plane Router Vulnerabilities Session Tables CPS Threshold Throughput Threshold CPU / Memory SSL TPS Concurrent Connection Threshold Business Logic CPU/Memory CPS Threshold SSL Threshold Concurrent Connection Threshold DB Threshold

10 Stress on the service Best predictive indicator for denial of service is Stress!= Attack Stress = Bad User Experience Stress = DoS

11 When stress on the server is high, the smartest thing to do is 1. Tell the clients to slow down 2. Human vs. BOT 3. Use Dynamic Signatures 4. Drop sessions with heavy URL 5. Drop the slow connections 6. Rate limit heavily used URI 7. Rate limit most active source IP 8. Rate limit based on CPS/TPS/BW

12 Improvement to Traditional Technique : Automate

15 Much better but still equal penalization of good and bad per vector!

16 Auto-Threshold action for each vector when enabled Vector EPS Mitigation Begins Mitigation happens when threshold is crossed and STRESS is HIGH STRESS goes down, because of mitigation Attack ended Acceptable Stress Based on defined Sensitivity Low Sensitivity = 78.3% CPU Medium Sensitivity = 68.3% CPU High Sensitivity = 51.6% CPU STRESS Current EPS Anomaly Detected Expected EPS Calculation every 5 minutes based on History => Baseline Monday Tuesday Wednesday t

Signature ( http.request.method eq GET ) and ( http.uri_file hashes like / ) and ( http.

accept_encoding_header_exists eq true ) and ( http.headers_count eq 10 ) and (http.

Actor Detection Stress Evaluator Mitigations Legitimate Users DDoS Attackers Good Data 1 Signal 2 metering

20 Signature ( http.request.method eq GET ) and ( http.uri_file hashes like / ) and ( http.referer hashes like ) and ( http.accept contains application ) and ( http.accept_encoding_header_exists eq true ) and ( http.headers_count eq 10 ) and (http.browser_type eq chrome) 3 Per SrcIP 4 2 Stress Triggers Signature Generation and enters Attack state Bad Actor Detection Stress Evaluator Mitigations Legitimate Users DDoS Attackers Good Data 1 Signal 2 metering Attack Data 1 Selective Drops Rate Limit Bad Actor Mitigation 5 Signaturebased Mitigation Global Mitigation Application Financial Services E-Commerce Subscriber

22 (Auto) Scaling Capacity Planning Rate limiting App Vulnerability Un secure Stack Business Logic CPU/Memory CPS Threshold SSL Threshold Concurrent Connection Threshold DB Thresholds Process Thresholds

23 Connection Memory Management Eviction Policies SYN Cookie Session Tables Rate limiting CPS Threshold Hardware vector rate limiting Throughput Threshold Firewall ACLs / IP Intelligence Heavy computational mitigations CPU / Memory SSL Hardware Offload SSL TPS Bot mitigation Concurrent Connection API Security Threshold Layer 7 Machine Learning / stress based detection IDS/IPS Before and After encryption (Zero-Day -> IPS/iRules)

24 Internet Pipe with BW Limit Routing Tables Control Plane Router Vulnerabilities Flow memory management Protect less scalable downstream devices Control Plane Policing Bandwidth Rate limiting Layer 3/4/7 ML Can you decrypt here? Do you want to? Flow based detection and mitigation Netflow / RTBH / BGP Flowspec Cloud provider, bad actor signaling

25 Internet Pipe with BW Limit BGP Flowspec BGP Blackhole Scrubbing Redundancy Signaling to cloud providers to block bad actors Cloud scrubbing provider redundancy

26 Am I covered? Is this really a DoS? Who answers the phone? What escalation processes are in place? Contact numbers for escalation

28 -Me

F5 comprehensive protection against application attacks. Jakub Sumpich Territory Manager Eastern Europe

F5 comprehensive protection against application attacks Jakub Sumpich Territory Manager Eastern Europe j.sumpich@f5.com Evolving Security Threat Landscape cookie tampering Identity Extraction DNS Cache