In the face of an ever-evolving cybersecurity landscape, researchers at Radware® (NASDAQ: RDWR), a leading provider of application delivery and application security solutions for virtual and cloud data centers, have identified a number of new attack methods representative of today’s increasingly sophisticated and severe distributed denial of service (DDoS) threat. Radware’s 2012 Global Application and Network Security Report highlights server-based botnets and encrypted layer attacks as just two of the new attack tools challenging organizations during DDoS attacks. Most recently, these tactics were leveraged by perpetrators in the attacks against U.S. financial institutions that have been ongoing since September 2012.
Prepared by Radware’s Emergency Response Team (ERT) which actively monitors and mitigates attacks in real-time, the in-depth research report also found that while security organizations have focused their efforts and attention on the pre and post-phases of defense, attackers now launch prolonged attacks that last days or weeks. This has created a vulnerable blind-spot as defenders lack the capabilities and resources to mitigate attacks in the “during” phase which attackers can exploit to their advantage.
“The Radware ERT sees hundreds of DoS/DDoS attacks each year, and we’ve found attacks lasting more than one week have doubled in frequency during 2012,” says Avi Chesla, chief technology officer at Radware. Through empirical and statistical research coupled with front-line experience, our team identified trends that can help educate the security community.
“Through highlighting significant trends found in this report, our goal is to provide actionable intelligence to ensure organizations can better detect and mitigate these threats that plague their network infrastructure,” adds Chesla.
Click through for findings from a cyber security report, published by Radware.
The shift from single-server attacks to the use of multiple servers in different geographic locations has allowed attackers to quickly and effectively launch more powerful DDoS attacks than ever before. Just a few attacking servers can produce the same attack traffic as a large number of client botnets, with the 24/7 availability of servers allowing for greater reliability as well as command-and-control. In 2013, Radware expects this method to gain in popularity, requiring that organizations make sure their defense architecture can withstand these scaled-up attacks. Although effective, several weak points are uncovered and identified.
Radware’s ERT developed the advanced persistent threat (APT) score to quantify and qualify the increasing force, sophistication and persistence of 2012’s attacks. The numbers are staggering – with 58 percent of attacks scoring a 7 or higher in complexity (out of 10), as compared to just 23 percent of attacks in 2011. In 2011, only 30 percent of attacks scored higher than a level of 3 in terms of severity, while in 2012, 70 percent achieved a level of 3 or higher.
In 2012, the growing popularity of HTTPS-based attacks added a new dimension to the security landscape. Though conventionally associated with security on the Web, hackers have managed to weaponize the encryption layer, using it to launch application-level and SSL attacks that can escape detection and remain hidden until it’s already too late. This has become an especially troubling phenomenon for financial services and e-commerce Web sites that rely heavily on HTTPS.
With some of the world’s largest institutions victimized by cyber attacks in 2012, the question remains as to why many of these organizations continue to be vulnerable. The fact remains that less than a quarter of all organizations surveyed invest their efforts in mitigating attacks as they’re happening – a fact exploited by hackers. In 2013, Radware recommends that organizations dedicate resources to creating a “security war room” equipped to dynamically respond to and handle persistent security attacks during all phases of an attack and adopt a three-phased security approach.
The proliferation of “do-it-yourself” sites devoted to enabling hacking schemes has reached commodity market proportions. The supply chain includes tool kits and for-hire services that are available to anyone with minimal coding or advanced hacking skills for as little as $10 for a ransomware attack tool. This has significantly reduced the barrier of entry for individuals or organizations to launch an attack.
The report, which doubles as a resource guide that security professionals can easily reference, also features recommendations that organizations can adopt to safeguard themselves against emerging attack trends and techniques. Chief among these recommendations are:
How to Stop Sophisticated Attack Campaigns. Organizations usually administer a two-phase pre- and post-attack security approach as their defense strategy. Sophisticated campaigns can only be eradicated by setting a third-phase security approach during the attack. A cadre of external on-demand force multiplier teams who can dynamically respond and employ tactics to mitigate future attacks needs to be implemented by an organization. A typical, persistent DDoS attack requires no less than nine security engineers for sufficient defense.
Examine Lines of Defense. Mitigation may have improved, but this has also pushed attackers to invest in finding the weak links in lines of defense. Organizations should ensure that their line of defense is comprehensive. As part of this, a mitigation checklist must be completed, with any missing elements to be addressed.
Carefully Consider Network Architecture. To be effective, a DoS / DDoS mitigation solution must be placed before most of the network elements in the path, which is not the traditional deployment. Additionally, if a content delivery network (CDN) is the primary DDoS mitigation solution, ensure you complement it with a customer premise equipment (CPE) solution for optimal protection.