ISSS prezentace 2018

INBOX

WEBEX

SHAREPOINT

CONCUR

SALESFORCE

WORKDAY

Web App Attacks are the #1 Source of Data Breaches

1%

2%

4%

5%

9%

11%

11%

14%

15%

29%

0% 5% 10% 15% 20% 25% 30% 35%

Denial of Service

Crimeware

Physical Theft and Loss

Payment Card Skimmers

Everything Else

Point of Sale

Miscellaneous Errors

Privilege Misuse

Cyber-Espionage

Web App Attacks 29%

2017 Verizon Data Breach Investigations Report

”Web Application Attacks remains the most prevalent”

“Use of stolen credentials against web applications was the dominant hacking tactic“

“Ransomware Surges Again As

Cybercrime-as-Service Becomes

Mainstream for Crooks”

ZD Net

“Russian Hackers Selling Login

Credentials of UK Politicians,

Diplomats ‒ Report”

The Register

“Rent-a-Botnet Services Making

Massive DDoS Attacks More

Common Than Ever Before”

PC World

“IoT Botnets Are Growing ‒

and Up for Hire”

MIT Technology Review

“Attacker Demands Ransom

After Series of DDoS Attacks

on Poker Site”

Hack Read

“Hacked Yahoo Data Is

for Sale on Dark Web”

New York Times

“93% of breaches in 2016 involved organised crime”Source: Verizon 2017 Data Breach Investigations Report

APP SERVICES

ACCESS

TLS

DNS

NETWORK

CLIENT

THE APPLICATION

IS THE GATEWAY

TO DATA

Understand the application

CLIENT

Man-in-the-browser

Session hijacking

Malware

Cross-site scripting

Cross-site request forgery

DNS hijacking

DNS spoofing

DNS cache poisoning

Man-in-the-middle

Dictionary attacks

DDoS

DNS

Eavesdropping

Protocol abuse

Man-in-the-middle

DDoS

NETWORK

Certificate spoofing

Protocol abuse

Session hijacking

Key disclosure

DDoS

TLS

Credential theft

Credential stuffing

Session hijacking

Brute force

Phishing

ACCESS

API attacks

Injection

Abuse of functionality

Man-in-the-middleDDoS

Malware



APP SERVICES

Known Web Worms

Unknown Web Worms

Known Web Vulnerabilities

Unknown Web Vulnerabilities

Illegal Access to Web-server files

Forceful Browsing

File/Directory Enumerations

Buffer Overflow

Cross-Site Scripting

SQL/OS Injection

Cookie Poisoning

Hidden-Field Manipulation

Parameter Tampering

Layer 7 DoS Attacks

Brute Force Login Attacks

App. Security and Acceleration

ü

ü

ü

ü

ü

ü

ü

ü

ü

ü

ü

ü

ü

ü

ü

ü

Web Application FW

X

X

X

X

X

X

X

X

Network / Next Gen Firewall

Limited

Limited

Limited

Limited

Limited

IPS

Limited

Partial

Limited

Limited

Limited

Limited

Limited

X

X

X

X

ü

X

X

X

X

X

X X

F5 Networks Positioned as a

Leader in 2017 Gartner Magic

Quadrant for Web Application

Firewalls*

F5 is highest in execution within the Leaders Quadrant.

* Gartner, Magic Quadrant for Web Application Firewalls,

Jeremy D’Hoinne, Adam Hils, Claudio Neiva, 7 August 2017

of Internet traffic is automated

of 2016 web application breaches involved

the use of bots

98.6M bots observedSource: Internet Security Threat Report, Symantec, April 2017

Client-Side Attacks

Malware

Ransomware

Man-in-the-browser

Session hijacking



DDoS Attacks

SYN, UDP, and HTTP floods

SSL renegotiation

DNS amplification

Heavy URL

App Infrastructure Attacks

Man-in-the-middle

Key disclosure

Eavesdropping

DNS cache poisoning

DNS spoofing

DNS hijacking

Protocol abuse

Dictionary attacks

Web Application Attacks

API attacks


Injection


Malware


Man-in-the-middle

Credential theft

Credential stuffing

Phishing


Protocol abuse

A common source of many threat vectors

Malware

Ransomware

Man-in-the-browser


Dictionary attacks

SYN, UDP, and HTTP floods

SSL renegotiation

DNS amplication

Heavy URL

API attacks


Injection

Malware


Credential stuffing

Phishing

Web Scraping

Protection

Pro-Active Bot

Prevention

L7 DoS WAF

SOLUTION

PROBLEM

Behavioural analysis to identify malicious bots

Volumetric take-downsConsume bandwidth of target

Network layer attackConsume connection state tables

Application layerConsume application resources

2005

8 Gbps

2013

300 Gbps

2016

1.2 Tbps

Source: How DDoS attacks evolved in the past 20 years, BetaNews

Source: Securelist, Kaspersky Lab, March 2017

Low sophistication, high accessibility

• AccessibleBooters/stressers easy to find

• LucrativeProfit margins of up to 95%

• EffectiveMany DDoS victims pay up

© F5 Networks, Inc 15

Rate Limit to Protect the Server

Detect and Block Bots and Bad Actors

Create and Enforce Dynamic Signatures

Analyze Application Stress and

Continually Tune Mitigations.

Start of Attack

Identify Attackers

Advanced Attacks

Persistent Attacks

Multiple Layers

of Protection

Even basic attacks can take an unprotected

server down quickly.

Persistent attackers will adjust tools, targets,

sources and attack volume to defeat static

DOS defenses.

In the first quarter of 2017, a new specimen of

malware emerged every 4.2 seconds

1 in every 131 emails included malware in 2016

of all breaches in 2016 involved some form of

malware

Sources:

1) Malware trends 2017, G DATA Software

2) Symantec Internet Security Threat Report, April 2017

3) WannaCry Update, Rapid7 Blog, May 2017

4.2 seconds

1 in every 131

Over half (51%)

WAF

Man-in-the-Browser malware

Online users

SOLUTION

PROBLEM

CLIENT

Man-in-the-browser

Session hijacking

Malware



DNS hijacking

DNS spoofing

DNS cache poisoning

Man-in-the-middle

Dictionary attacks

DDoS

DNS

Eavesdropping

Protocol abuse

Man-in-the-middle

DDoS

NETWORK


Protocol abuse

Session hijacking

Key disclosure

DDoS

TLS

Credential theft

Credential stuffing

Session hijacking

Brute force

Phishing

ACCESS

API attacks

Injection


Man-in-the-middleDDoS

Malware



APP SERVICES

USERNAME Credit Card

Data

USERNAME Intellectual

Property

USERNAME Healthcare

Data

USERNAME Passport

Data

USERNAME Financial

Data

USERNAME

USERNAME

USERNAME

USERNAME

USERNAME

USERNAME

USERNAME

USERNAME

USERNAME

USERNAME

USERNAME

USERNAME

USERNAME

USERNAME

Zabezpečený, zjednodušený přístup k Vašim aplikacím nehledě na to, kdejsou provozovány

Challenges

• Complex and varied app access

• Protect assets from fraudulent access

• Password fatigue

• Concerns with user credentials in the cloud

• Prevent data exfiltration from unauthorized

users of cloud apps

• Simplify app access and password fatigue for

end users regardless of location

• Reduce time-consuming and error-prone

access policy management across

clouds/SaaS

Multi-Cloud Benefits

REPORTS ARTICLES BLOGS

“IoT Devices are the Latest Minions in Cyber Weaponry Toolkits”

“Mirai: The IoT Bot That Took Down Krebs and Launched a Tbps Attack on OVH”

“IoT Threats: A First Step into a Much Larger World of Mayhem”

Search by topic, type, tag, and author.

F5Labs.com

Visit Us at F5Labs.com

ISSS prezentace 2018

Documents