Backbone and Campus Security Threats/Trends

1
Backbone and Campus Security Threats/Trends

• Craig Labovitz labovit_at_arbor.net
• Danny McPherson danny_at_arbor.net

2
Background

• Monitoring anomalous routing and traffic data
  from 100 tier1/2 and campus/enterprise networks
• Represent most of North America and EMA transit
  bandwidth
• Anonymized detailed attack statistics from 40
  deployments
• Includes I2 backbone and several GigaPoPs
• Bi-annual surveys of 50 ISP and
  Campus/Enterprise networks
• The survey was targeted at obtaining an
  understanding of some of the operational security
  aspects occurring in large Internet networks
  today
• The findings of this survey are reflects in the
  following slides

3
(2005 H2) Primary Threat Concerns

• Brute force bandwidth (pps) remain largest threat
• Little perceived threat from routing or more
  complex attack vectors

4
Attack Targets

• Core infrastructure and customer links rarely
  targeted - specific customers primary target
• Services such as DNS second target choice

5
Customer Impacting Attacks

• An average of 40 actionable customer impact
  attacks per month were reported

6
Infrastructure Impacting Attacks

• Infrastructure impacting attacks were far less
  common, on the order of 1-2 per month on average
• These attacks were both directly at the
  infrastructure, as well as a result of collateral
  damage from customer attacks

7
Largest Attacks Observed

• Attacks greater than 10 Gbps sustained bandwidth
  were reported
• Not a large differential in largest attack ever
  v. largest in past six months - perhaps
  indicative of worsening problem

8
Mitigation Techniques

• Lack of scalable management tools and concern
  over card support for ACLs
• So, the primary mitigation techniques employed by
  operators involve effectively completing the
  attack!

9
Law Enforcement Referrals

• Referrals limited by
• Lack of forensics detail
• Belief in utility
• Customer privacy request
• Too many attacks to bother
• Only 29 of respondents believe LEOs have the
  power and means to to act upon information
  provided about attacks

10
ISPs and Future Threats

• 31 believe ISPs are NOT in a position to
  mitigate future Internet threats
• 69 believe are, but
• Only in limited deployment for MS customers
• Who else can do it - customers cant
• Yes - but cost model is VERY tough
• Not with todays margins
• Position, yes, paid to do so - NO!