Four things banks need to know about DDoS attacks
By Avi Rembaum & Daniel Wiley August 5, 2013
- A DDoS attack can bring a business to a full-stop, especially in a bank where online banking is increasingly essential
- CIOs and CISOs need to a broad set of defensive tools that combine on-premise tech and cloud-based scrubbing
TO cope with an increased number of large distributed denial of service (DDoS) attacks, banks must not only have plans in place - they should consider a broad set of defensive tools that combine on-premise technologies and cloud-based scrubbing services.
Financial institutions have been battling waves of large DDoS attacks since early last year. Many of these attacks have been the work of a group called the Qassam Cyber Fighters (QCF), who until recently posted weekly updates on Pastebin reminding readers of the reasons for their efforts and summarising Operation Ababil, their DDoS campaign.
Other hacktivist groups have launched their own DDoS attacks and targeted financial services institutions with focused attacks on web forms and content.
There have also been reports of nation-state-organised cyber assaults on banks and government agencies, along with complex, multi-vector efforts that have combined DDoS attacks with online account tampering and even fraud.
The past year-and-a-half points to a state of hacking activity that consistently increases in intensity and evolves regularly.
The recent incidents against all sizes of banks have shown that there are many kinds of DDoS attacks. These have included traditional SYN and DNS floods, as well as DNS amplification, application layer and content targeted methods.
Denial of Service (DoS) activities that have targeted SSL-encrypted web page resources and content are an additional challenge.
In some instances, the adversaries have moved to a blended form of attack that incorporates harder-to-stop application layer methods alongside ‘cheap,’ high-volume attacks that can be filtered and blocked through simpler means.
To cope with this level of malicious activity, CIOs (chief information officers), CISOs (chief information security officers) and their teams need to have a plan in place and consider a broad set of defensive tools that combine on-premise technologies and cloud-based scrubbing services.
They must also begin to explore and ultimately implement intelligence gathering and distribution methodologies that help lead to a comprehensive DoS mitigation strategy.
1. Have a scrubbing service or similar cleaning provider to handle large volumetric attacks.
The volumes associated with DDoS activity have reached a level where 80 Gbps of DDoS traffic is a normal event. There are even reports of attacks in the range of 300 Gbps. Few, if any, organisations can maintain sufficient bandwidth to cope with attacks of this size.
And, when faced with DDoS incidents this large, the first thing an organisation needs to consider is the option to route its Internet traffic through a dedicated cloud-based scrubbing provider that can remove malicious packets from the stream.
These providers are the first line of defence for large volumetric attacks as they have the necessary
tools and bandwidth to clean network traffic so that DDoS packets are stopped in the cloud and regular business as usual (BAU) traffic is allowed through.
2. Have a dedicated DDoS mitigation appliance to identify, isolate, and remediate attacks.
The complexity of DDoS attacks and the tendency to combine volumetric and application methods require a combination of mitigation methods.
The most effective way to cope with the application and ‘low and slow’ elements of these multi-vector attacks is to leverage on-premise dedicated appliances. Firewalls and intrusion-prevention systems are critical to the mitigation effort, and DDoS security devices provide an additional layer of defence through specialised technologies that identify and block advanced DDoS activity in real-time.
Administrators can also configure their on-premise solutions to communicate with cloud scrubbing service providers to enable automated route away during attack.
3. Organisations need to tune the firewall to handle large connection rates.
The firewall will also be an important piece of networking equipment during DDoS attacks. Administrators should adjust their firewall settings in order to recognise and handle volumetric and application layer attacks.
And, depending on the capabilities of the firewall, protections can also be activated to block DDoS packets and improve firewall performance while under attack.
4. Develop a methodology, or a strategy, to protect applications from DDoS attacks.
Secure technologies can provide robust protections to DDoS activities. But administrators should also think about tuning their web servers, modifying their load balancing and content delivery strategies to ensure the best possible uptime.
Also relevant to such efforts are the incorporation of safeguards against multiple log-in attempts.
Another interesting approach is to block machine-led, automated activities by including web pages with offer details, such as opportunities for interest rate reduction or information on new products, so that users must click on ‘accept’ or ‘no thanks’ buttons in order to continue deeper into website content.
The above methods are crucial to any DDoS mitigation strategy. Organisations must also reach out to service providers and ISPs and work with them to identify novel mitigation techniques.
ISPs (Internet service providers) must be involved in mitigation strategies. DDoS attacks use the same Internet as bank customers, and the ISPs carry both forms of traffic.
Of increasing importance is the need to investigate and implement intelligence gathering and distribution strategies. Such efforts should investigate data within company networks and expand to include other companies that operate in the financial services industry.
Getting more information about who the actor is, motivations behind the attack and methods used, helps administrators anticipate and proactively architect around those attacks.
Attack profile information can range from the protocols used in the attack (SYN, DNS, HTTP), the sources of attack packets, the command and control networks, and the times of day during which attacks began and ended.
While valuable in mitigating attacks, there is no easy way to communicate this data, and regulatory hurdles make it even more difficult to share attack information.
Right now, information-sharing consists of friends talking to friends. Information sharing needs to evolve into an automated system where organisations can log in to a solution and see correlated and raw log data that provide clues into attacks that have ended and that are in progress.
Such systems could also be used to share attack intelligence and distribute protections.
An industry information-sharing capability would help elevate financial services companies’ abilities to cope with DDoS activity and bring the industry as a whole to a new level of preparedness.
Avi Rembaum is director of 3D consulting and Daniel Wiley is a senior security consultant at Check Point Software Technologies.
Related Stories:
Cyber-attacks greater national threat than physical attacks: Survey
Big data approach can help shore up cyber-defence: RSA
Interpol lays out response blueprint for global cybercrime war
Korean banks and media agencies under cyber-attack: Trend Micro
For more technology news and the latest updates, follow @dnewsasia on Twitter or Like us on Facebook.
