DDoS Protector Block Denial of Service attacks within seconds Simon Yu Senior Security Consultant CISSP-ISSAP, MBCS, CEH 2012 Check Point Software Technologies Ltd. [PROTECTED] All rights reserved. 2012 Check Point Software Technologies Ltd. [PROTECTED] All rights reserved.
Agenda 1 2 3 4 DDoS Trends Overview DDoS 2.0 Check Point DDoS Protector Multiple Threat Prevention Solution 2
Cybercrime Trends for 2012 44% 35% 33% 32% SQL Injections APTs Botnet DDoS 65% Businesses Experienced Attacks Average $214,000 of Damage Per Attack Ponemon Institute, May 2012 3
DDoS Timeline Summary Graph Attack Risk Vandalism and Publicity CodeRed 2001 Worms Nimda (Installed Trojan) 2001 2011, Radware, Ltd. Blaster 2003 Slammer (Attacking SQL sites) 2003 Financially Motivated Blending Motives Agobot (DoS Botnet) Republican website DoS 2004 Storm (Botnet) 2007 DDoS Srizbi (Botnet) Rustock 2007 (Botnet) 2007 Estonia s Web Sites DoS 2007 Hacktivism Kracken (Botnet) 2009 2010 IMDDOS (Botnet) Google / Twitter Attacks2009 Georgia Web sites DoS 2008 2001 2005 2010 Dec 2010 Operation Payback July 2009 Cyber Attacks US & Korea LulzSec Sony, CIA, FBI Mar 2011 Netbot DDoS Blend DDoS Attacks Gaining Momentum Mar 2011 Codero DDoS / Twitter Israeli sites Mar 2011 Operation Payback II Peru, Chile Mar 2011 DDoS Wordpress.com Time 2012 4
Agenda 1 DDoS Trends 2 3 4 Overview DDoS 2.0 Check Point DDoS Protector Multiple Threat Prevention Solution 5
DDoS Tool Anyone Can Use Simple Interface Focused Payload Script - Killer Attacks Simple Scripting Randomize Attacks Difficult Detection Source: Spiderlabs.com 6
Attackers Use Multi-Layer DDoS Simultaneous Attack Vectors Large-volume network flood attacks SYN flood attack Low and slow DoS attacks (e.g., Socket stress) Application vulnerability High and slow application DoS attacks Web attacks: brute force login locked 1 successful attack vector = No service 7
Agenda 1 DDoS Trends 2 3 4 Overview DDoS 2.0 Check Point DDoS Protector Multiple Threat Prevention Solution 8
Introducing Check Point Check Point DDoS Protector Block Denial of Service Attacks within seconds! 9
Check Point DDoS Protector Customized multi-layered DDoS protection Protects against attacks within seconds Integrated security management and expert support DDoS Protector 10
DDoS Attack Information Network Flood Server Flood Application Low & Slow Attacks High volume of packets High rate of new sessions Web / DNS connectionbased attacks Advanced attack techniques 11
Multi-Layer DDoS Protection Network Flood Server Flood Application Low & Slow Attacks Two patent technologies Fuzzy Logic and real time signature technology Advanced Action Escalation Technology 100% Accurate of mitigating attack traffic, while Behavioral High volume of network packets analysis Automatic and High rate of pre-defined new sessions signatures Web Behavioral / DNS connectionbased DNS HTTP and attacks Advanced Granular attack custom filters techniques passing 100% legitimate traffic. (NSS Lab 2010) Stateless and behavioral engines Protections against misuse of resources Challenge / response mitigation methods Create filters that block attacks and allow users 12
On-the-Fly Signature Creation Protect Applications and Services Automatically Public Network Inputs Network Servers Clients DoS and DDoS Application Level Threats Real-Time Signature Inbound Traffic Inspection Module Behavioral Analysis Closed Feedback Zero-Minute Malware Propagation Abnormal Activity Detection Outbound Traffic Enterprise Network Real-Time Signature Generation Optimize Signature Remove When Attack is Over 13
Appliance Specifications Model DP 506 DP 1006 DP 2006 DP 3006 DP 4412 DP 8412 DP 12412 Capacity 0.5Gbps 1Gbps 2Gbps 3Gbps 4GBps 8Gbps 12Gbps Max Concurrent Sessions Max DDoS Flood Attack Protection Rate Latency 2 Million 4 Million 1 Million packets per second 10 Million packets per second <60 micro seconds Real-Time Signatures Detect and protect against attacks in less than 18 seconds 14
Flexible Deployment Options Ready to Protect in Minutes Fits to Existing Network Topology Optional Learning Mode Deployment Low Maintenance and Support 15
Support IPv6 networks Detect and block IPv6 attacks 16
Deployment Locations Scenarios: 1 2 3 On-Premise Deployment Transparent network device easily DDoS Security Appliance fits into existing network topology (layer 2 bridge) + Off-Site Deployment DDoS Security Appliance 17
Agenda 1 DDoS Trends 2 3 4 Overview DDoS 2.0 Check Point DDoS Protector Multiple Threat Prevention Solution 18
Anti-Bot Software Blade DISCOVER and STOP Bot Attacks Discover Bot infections Multi-tier discovery Prevent Bot damage Stop traffic to remote operators Investigate Bot infections Extensive forensics tools 19
ThreatSpect Engine ThreatSpect Engine Maximum security with multi-gig performance Reputation Detect Command & Control sites and drop zones Over 250 millions addresses in ThreatCloud Real time updates Network Signatures Over 2000 bots family unique communication patterns Dozen of behavioral patterns Suspicious Email Activity Over 2 million outbreaks 20
End to end Mitigation Solution Global Internet On-premises Protection Against Application DDoS Attacks Low & Slow Attacks ISP Anti-Dos Protection Against Volumetric Bandwidth Attacks ISP Core Network ISP Anti-DoS Service (clean pipe) Customer Site 21
Integrated Security Management Unified Logs and Monitoring and Unified Reporting Leverage SmartView Tracker, SmartLog and SmartEvent for historic and realtime security status 22
Summary Blocks DDoS Attacks Within Seconds Customized multi-layered Anti-bot, DDoS protection Ready to protect in minutes Integrated with Check Point Security Management 23
You need to Monitor the flood of IPS, Anti-Bot and Antivirus events around the clock Identify real intrusions and stop them Continually optimize and manage threat prevention policies Develop a response plan to quickly recover from attacks 25
ThreatCloud Security Services Managed Security Service continuously monitors your network and provides actionable alerts, attack protection and Check Point expertise 24/7 Incident Response provides expert assistance during critical security incidents to get you back to business as usual quickly 26
Managed Security Service Threat Prevention Software Blades Check Point Human Expertise Threat Intelligence IPS AV Anti Bot Monitors your Check Point gateways for advanced threats and provides expert resources to optimize your security around the clock 27
Managed Security Service Features Your logs are continually examined by Check Point s analysis engine and security experts Thousands of events distilled into real time, clear, actionable alerts Constant tuning optimizes coverage and performance for Threat Prevention Software Blades 24/7 coverage protects your network with Check Point security Fully Managed / Monitoring services 28
We monitor your logs to turn your flood of events Into Actionable Alerts! Thousands of Events per Day Few Actionable Alerts per Week! 24/7 Analysis by Check Point Experts 29
Do you utilize the latest Intelligence? We access dynamic, global security intelligence from the Check Point ThreatCloud The industry s largest security intelligence collaboration infrastructure delivering real-time protection to security gateways 250 million addresses for Bot discovery 4.5 million malware signatures 300,000 malware-infested websites 30
Managed Security Service Portal provides Global Intelligence view and reports Global benchmarks Blacklists Who is attacking? What attacks? 31
Managed Security Service Levels Monitoring Security Service Fully Managed Service Standard Premium Elite Automated monitoring & alerting Yearly policy tuning Expert monitoring & alerting; Incident tracking Quarterly policy tuning Complete Threat Prevention gateway management On-going tuning; implemented by Check Point SOC Customer owned and deployed Check Point gateways Check Point-provided Gateways with Threat Prevention Software Blades 32
ThreatCloud Security Services Managed Security Service continuously monitors your network and provides actionable alerts, attack protection and Check Point expertise 24/7 Incident Response provides expert assistance during critical security incidents to get you back to business as usual quickly 33
When An Incident Occurs Customer calls incident response hotline Conference call line opened for immediate triage and initial assessment System/network resources analyzed and baseline patterns established Logs/malware analyzed, including full packet capture or binary analysis Recommendations and remediation provided, full report delivered 34
3D Security Analysis Report 2012 Check Point Software Technologies Ltd. [PROTECTED] All rights reserved. [Restricted] ONLY for designated 2012 Check groups Point and Software individuals Technologies Ltd. [PROTECTED] All rights reserved.
3D Security Analysis Report tool 36
Thank You 2012 Check Point Software Technologies Ltd. [PROTECTED] All rights reserved. 2012 Check Point Software Technologies Ltd. [PROTECTED] All rights reserved.