Network Security Defence Against Cyber Criminals
While network security attacks have rarely been out of the news in the past few years, the threat is evolving – and not for the better. In its 2005 Global Business Security Index Report, which provided an early look at potential security threats in 2006, IBM anticipated a fundamental shift in cyber crime from pervasive global outbreaks to smaller, stealthier attacks targeted at specific organisations for extortion purposes.
In the past, these attacks have been restricted to commercial organisations – online gambling sites being the most reported category – but their range is spreading. The IBM report commented that ‘high-profile arrests of cyber criminals in the US and around the world pointed to individuals linked to organised crime and motivated to make money. We are seeing organised, committed, and tenacious profiteers enter this space’. One very large financial institution has calculated that network downtimes costs $30m an hour. If that number seems hard to believe, lowering it to a figure of $3m an hour is still a cause for concern for any chief executive.
What kind of threats do financial organisations face? In its service provider infrastructure security survey (published in November 2005), Arbor Networks found that distributed denial of service (DDoS) attacks and the DoS implications of worm attacks were considered by almost 80 per cent of respondents to be the primary network threat. Under a DoS attack, hackers use a botnet (robot network) of compromised computers to overwhelm a company’s website with traffic, making it inaccessible. Depending on the motive, this may result in customers not being able to access online banking or disruptions to inter-bank communications. The proliferation of PCs connected via ‘always-on’ broadband connections is enhancing the ability of compromised devices to function as part of a botnet.
If DDoS packets do reach critical systems, the access network or customer premises, it’s too late to prevent harm. In this event, the only option is to ‘blackhole’ the destination IP address of an attack until it can be brought under control. This means making the organisation’s server unreachable by dropping all traffic – malicious or mission-critical – sent to it. Either way, an attacker has effectively achieved their intended goal.
Cyber criminals are using this threat as part of an ‘extortion racket’ demanding money to prevent the launch of such an attack. Today, the combination of sophisticated cyber criminals and increased broadband penetration – generating a high bandwidth and always connected environment – is creating the perfect scenario for security threats that organisations must prepare for. Any household brand with a reputation to protect, particularly those in the financial services sector, is now at risk.
Network security vendors promote layered security as the best way of dealing with evolving security threats. The difference between this and traditional perimeter security may be compared to that between a mediaeval fortress and a modern airport. In the former, if formidable exterior walls designed to keep everyone out are penetrated, there are no additional defences in place. In the latter, certain areas permit free access, some permit limited access and a few permit only a small number of trusted individuals to enter. Financial organisations need to protect themselves against DDoS attacks with defences built in at various points within the organisation’s overall network infrastructure – including that of its network service provider (NSP).
The need to move defences up the network chain increases as the scale of a potential DDoS attack increases. DDoS mitigation appliances close to mission-critical systems can easily defend small attacks. These can easily be overwhelmed, however, and are not sufficiently robust to handle the kind of attacks we are seeing today. A further layer of security can be achieved by scaling network infrastructure to absorb a potential DDoS attack: to logically segment the network (i.e. by application) and provide a mitigation appliance on each segment. Given the scale of the latest attacks, even this is likely to provide insufficient protection. In fact, the Arbor research found that there were few differences between the largest attacks ever addressed and the largest attacks addressed in the past few months, which indicates that the problem is getting worse.
As a result, organisations need to take a close look at the DDoS protection provided by their NSP. A DDoS protection solution located at the edge of the NSP’s network means they are as close as possible to the source of an attack. This enables the NSP to filter traffic at the network edge, where attacks are most easily detected and stopped. Using this solution, network events are displayed to the NSP’s operations and engineering staff. When incoming traffic exceeds the parameters that define ‘normal’ traffic, an event is displayed in the NSP’s regional network operations centre. Personnel then make the decision to activate protection for that customer and traffic is diverted to the nearest security unit for ‘cleaning’.
The reality of network security today is that a determined individual, armed with the resources and skills of a large criminal organisation, can muster the capabilities to overwhelm even the most sophisticated defences. The best we can do is to make their lives harder – and the fact that thousands of DDoS attacks happen around the world on a weekly basis, with the majority doing no serious damage, indicates that we are making progress. As the potential scale of the attacks increases, however, the various parties involved in network defence, including the bank’s security professionals and their NSP, will have to work more closely together to provide a truly layered approach. Governments have found that co-operation is the only way to fight the war on crime in the physical world: financial sector organisations will find that fighting cyber crime in the digital world is no different.