& cplSiteName &

When Size Matters

Carol Wilson
10/18/2013
50%
50%

It is easy to get lost in the numbers when discussing distributed denial of service (DDoS) attacks and other network breaches but the figures Arbor Networks released this week regarding DDoS attacks are worthy of special note. They are a strong indication of new threats for which network operators need to be prepared. (See Arbor Sees Alarming Rise in Size of DDoS Attacks.)

Those numbers come from the 275 network operators that are customers of Arbor Networks 's Atlas network security system and regularly report troublesome activity. They show that larger bit-per-second attacks are back in vogue, and have grown so rapidly they threaten to not only cause massive problems for their targeted companies but also for networks in general.

For the past couple of years, larger packet-per-second attacks were more the norm, says Darren Anstee, solutions architect team manager for Arbor. Those tend to exhaust forwarding performance.

Last March, however, the largest single cyber-attack to date was launched against the servers of Spamhaus, a non-profit agency that battles spam. Since that attack, the trend has been to ever larger bit-per-second attacks. The Spamhaus attack, which hit 300 Gbit/s, affected Internet traffic globally and hurt many businesses in the process.

And here are the staggering numbers: There has been more than 350 percent growth in the number of attacks monitored at greater than 20 Gbit/s so far this year, as compared to 2012. The average DDoS attack in 2013 is currently measured at 2.64 Gbit/s, up 78 percent from last year.

That's of particular concern to service providers because attacks of that size will not only swamp the resources of the target company but can also swamp aggregation routers serving that company and others, and create major congestion issues for the network in general.

"There is a much broader range of organizations that are going to get their Internet connectivity completely saturated by an average attack," says Anstee. "They will be dependent on their service providers or on cloud-based protection to deal with that."

These attacks are being launched either by cyber-criminals, who use them as distractions for other activity or as "take-outs" for extortion or other purposes, or by so-called "hacktivists," who for a variety of ideological reasons, target various companies or web operations for attack to make a political point.

Two suspects have been arrested in the Spamhaus attack, for example, one a Dutch participant in countercultural ISP and one a UK schoolboy who was apparently making considerable money from Internet activity. They targeted Spamhaus because of its efforts to identify and stop spam email that poses security threats.

Because it's harder to predict where attacks will come from next, it's become much more important to prepare for them, Anstee says. And that means making sure there are solutions in place to help customers who are attacked, as well as protection for the service providers' infrastructure to prevent or respond to collateral damage from these massive attacks.

"Since we are seeing more very large attacks -- we saw a 191Gbits/sec attack in August -- service providers also need to be looking at capacity planning models for their mitigation infrastructure," he warns. As the size of average and peak attacks grows, network operators must make sure they can deal with these larger threats.

As I said at the outset, it's easy to get lost in such staggering figures, but the latest warnings are not something to glaze over. There have been many other warnings as well, and expressions of concern that service providers aren't taking the rapidly growing threats seriously. Given that Arbor's numbers come straight from the networks themselves, this is proof of what lies ahead, ready or not. (See Security Threat Intensifies for Service Providers.)

— Carol Wilson, Editor-at-Large, Light Reading

(6)  | 
Comment  | 
Print  | 
Newest First  |  Oldest First  |  Threaded View        ADD A COMMENT
pdonegan67
50%
50%
pdonegan67,
User Rank: Light Sabre
10/21/2013 | 4:37:48 AM
Re: Are we shock-proof?
I started researching the service provider security space three or four years ago and was immediately struck by the confluence of proven incidents of attacks that have had truly devastating effects alongside some positively steaming shovels full of fear-mongering bullshit on the part of some security vendors. The two really do co-exist.

As my research has gone on, I've found that the pitching of security solutions into the service provider space is typically quite a lot more sober than it is into the enterprise.

Very few service providers fall for the histrionics-based sell, in my experience This is either because they're highly security-savvy and know how to categorize risks according to the threat level they represent.

Or (as is still too often the case) it's because they can't differentiate different threat levels, can't be bothered to, and don't much care about anything beyond the next quarter's revenue target. In the case of these guys, if they invested in the right security solutions they might find that a couple of unexplained outages which suspended their ability to bill during the quarter were actually caused by malicious attacks but hey, why let that interfere with sound accountant-led thinking, right?

I'm actually struck by how sober and business-case oriented most pitching of security solutions to service providers is these days. I'm also struck, not coincidentally, by the relatively high rate of failure among the minority of security solution vendors who shriek with scant evidence that the sky is falling in. They often find that it's actually them that the sky subsequently falls in on where service provider business is concerned.

Where Arbor Networks is concerned I've an interest to declare in that I've done quite a bit of work with them. They have laced my palm with silver. They're one of the sponsors of Light Reading's second Mobile Network Security conference that I'm chairing in New York on December 5th, for example (see our LIve Events listing).

So take this with a pinch of salt if you will, but when I talk to service providers, the feedback I get about Arbor is that they are one of a select few companies whose opinions and solutions for service provider security are nearly always taken very seriously pretty much anywhere in the world.

Better still, ask around yourself, and see if you encounter a different pattern. I'd be very surprised.
Carol Wilson
50%
50%
Carol Wilson,
User Rank: Blogger
10/18/2013 | 7:35:35 PM
Re: Are we shock-proof?
Hacktivists are organizations with a political ax to grind - think Anonymous or Wikileaks -- and their wanna-bes - who launch attacks to make a point, and not necessarily for profit. 

That is a trend we should possibly be following more closely. 
Carol Wilson
50%
50%
Carol Wilson,
User Rank: Blogger
10/18/2013 | 7:33:54 PM
Re: Are we shock-proof?
I actually did a rather extensive search of the SpamHaus attack and never saw anything that said it was a PR hoax. A number of respected tech sites took this very seriously so if it is a hoax, it was wildly successful, fooling Cnet, Cisco, slashdot, zdnet, reddit and nextweb. 

I assume the organization you are criticizing is Cloudflare? I did find two reports criticizing them for exaggerating the potential impact of the SpamHaus attack, claiming it could have "broken" the Internet. But even critics admit this was a serious attack. 

Arbor isn't saying these larger attacks are breaking the Internet and yes, they have something to sell toe service providers but no one is hiding that, and being aware of ever larger DDoS attacks is still a good idea. 
prtrumpsreality
50%
50%
prtrumpsreality,
User Rank: Light Beer
10/18/2013 | 5:58:27 PM
Re: Are we shock-proof?
You shuld check facts better.  The SpamHaous attack was so small, that nobody (except spamhaus) noticed.

The publicity campaign that was kicked off by the comapny they hired to fix their problem however, made up some numbers so crazy, that everyone saw "largets in history", and that PR has now replaced the truth.

the Spamhaus ISP published their traffic logs for the period in question in response, showing that there was no discernable peak or spike in data.  

It seem nothing can beat a good PR advertising campaign though :-(
pzernik
50%
50%
pzernik,
User Rank: Light Sabre
10/18/2013 | 5:34:53 PM
Re: Are we shock-proof?
Hi Carol.  What exactly are hacktivist groups and what are their motives?  Can LR do an article on this subject? 
Carol Wilson
50%
50%
Carol Wilson,
User Rank: Blogger
10/18/2013 | 3:47:42 PM
Are we shock-proof?
Arbor has been tracking this stuff longer than most and while they usually have some shocking numbers to share, this current report is truly disturbing. 
More Blogs from Rewired
AT&T and Verizon are vying for the status of biggest OpenStack champion, a stunning reversal for the open source software and a sign of things to come.
FCC proposes forcing broadband ISPs to get explicit consent from customers before using browsing data, ignoring the real online privacy threats.
Forget the 'Thrilla in Manila'; the competitive battle among open MANO groups will more likely be fought with Manila folders than fisticuffs.
Done well, targeted video ads based on Internet browsing history wouldn't be such a bad thing, but there are trust and transparency issues to address.
Virtualization is critical to telecom's future but it could open up a new can of net neutrality worms – the time to talk about that is now.
Light Reading’s Upskill U is a FREE, interactive, online educational resource that delivers must-have education on themes that relate to the overall business transformation taking place in the communications industry.
NEXT COURSE
Wednesday, July 27, 1:00PM EDT
The Changing Face of the Data Center World
Rodney M. Elder, Senior Solutions Architect, Equinix
UPCOMING COURSE SCHEDULE
Wednesday, August 3, 1:00PM EDT
The Central Office Re-Architected as a Data Center
Guru Parulkar, Executive Director, Open Networking Research Center, Open Networking Lab
Wednesday, August 10, 1:00PM EDT
Telcos & Open Source 101
Phil Robb, Senior Technical Director, OpenDaylight
Friday, August 12, 1:00PM EDT
The Role of Open Source in NFV
Jim Fagan, Director, Cloud Practice, Telstra
in association with:
From The Founder
In the first episode of a four-part series, Light Reading Founder and CEO Steve Saunders and Calix President and CEO Carl Russo drive around town discussing the disruptive mega-changes in the communications industry and where hope lies for service providers to meet the escalating demands of the cloud.
Flash Poll
Live Streaming Video
Charting the CSP's Future
Six different communications service providers join to debate their visions of the future CSP, following a landmark presentation from AT&T on its massive virtualization efforts and a look back on where the telecom industry has been and where it's going from two industry veterans.
Women in Comms Introduction Videos
Fujitsu Sales Leader Shares Lessons Learned

7|27|16   |   5:12   |   (0) comments


As Fujitsu's only female sales leader, Annie Bogue knows the importance of asking for what you want, being flexible (she's been relocated five times), keeping a meticulous calendar, 'leaning in,' working harder than everyone else around you, being aware and more.
Telecom Innovators Video Showcase
VeEX Test & Measurement Solutions

7|25|16   |   08:57   |   (0) comments


Cyrille Morelle, president and CEO of VeEX Inc., talks test and measurement with Light Reading's Steve Saunders at BCE 2016. This includes innovative products such as VeSion Cloud-Based platform for network monitoring; MTTplus Modular Test platform for Access, Business, Carrier Ethernet, Transport and Core services; and OPX-BOX+ for Fiber Optics.
LRTV Custom TV
VeEX: Live From BCE 2016

7|25|16   |   03:20   |   (0) comments


VeEX's Senior Director of Business Development, Perry Romano, explains how VeEX provides tools to help install, maintain, monitor and manage network infrastructure efficiently and effectively. The portfolio of products on display include the RXT-6000, MTTplus and TX300s.
LRTV Custom TV
Real-Time Telemetry & Analytics for Intelligent SDN Orchestration

7|25|16   |   03:09   |   (0) comments


Packet Design CEO Scott Sherwood discusses how real-time network telemetry and analytics are enabling a new breed of SDN orchestration applications.
From the Founder
The Russo Report: Driving Disruption

7|25|16   |   07:44   |   (0) comments


In the first episode of a four-part series, Light Reading Founder and CEO Steve Saunders and Calix President and CEO Carl Russo drive around town discussing the disruptive mega-changes in the communications industry and where hope lies for service providers to meet the escalating demands of the cloud.
LRTV Custom TV
NetScout: Maximizing Enterprise Cloud for Digital Transformation

7|20|16   |   04:53   |   (0) comments


Light Reading Editor Mitch Wagner talks to NetScout CMO Jim McNiel about maximizing the benefits of enterprise cloud and digital transformation while minimizing potential pitfalls with a proper monitoring and instrumentation strategy.
Women in Comms Introduction Videos
Ciena's VP Offers a Career Crash Course

7|20|16   |   4:14   |   (2) comments


How did Ciena's Vice President of Sales, Angela Finn, carve out her career path? Simple, she tells WiC. She stayed true to her company, customers and principles. She shares her advice for women on how to be authentic and credible, as well as for companies that want to make a real change to their culture and practices.
LRTV Custom TV
NFV in 2016: Part 2 – Climbing the Virtualization Maturity Curve

7|19|16   |   06:56   |   (0) comments


Many of the initial use case implementations are single-vendor and self-contained. The industry is still climbing the virtualization maturity curve, needing further clarity and stability in the NFV infrastructure (NFVi) and greater availability and choice of virtualized network functions (VNFs). Interoperability between NFVis and VNFs from different vendors ...
Telecom Innovators Video Showcase
Versa Networks' Kumar Mehta on SD-WAN Managed Services

7|19|16   |     |   (0) comments


In Silicon Valley, Steve Saunders sits down with Versa's Kumar Mehta for an interview focused on why service providers are building SD-WAN managed services, and how Versa's telco customers are innovating.
LRTV Custom TV
Juniper Networks & The Evolution of NFV

7|19|16   |   06:01   |   (0) comments


Senior Juniper Networks executives talk to Light Reading Founder & CEO Steve Saunders about NFV developments and the recent independent evaluation by test lab EANTC of Juniper's Cloud CPE solution.
LRTV Interviews
CenturyLink Goes Beyond Managed WiFi

7|19|16   |     |   (0) comments


CenturyLink's managed WiFi allows enterprises, such as retailers and resorts, to track guest WiFi usage in order to help them better communicate with customers.
LRTV Interviews
AT&T Launches Network Functions on Demand

7|17|16   |   05:26   |   (0) comments


Roman Pacewicz, Senior Vice President, Offer Management & Service Integration, AT&T Business Solutions, discusses the operator's launch of its Network Functions on Demand service.
Upcoming Live Events
September 13-14, 2016, The Curtis Hotel, Denver, CO
September 27, 2016, Philadelphia, PA
November 3, 2016, The Montcalm Marble Arch, London
November 30, 2016, The Westin Times Square, New York City
December 6-8, 2016,
May 16-17, 2017, Austin Convention Center, Austin, TX
All Upcoming Live Events
Infographics
Five of the Top 10 most targeted countries in Check Point Software Technologies' global Malware & Threat Index for Q1 2016 are in Africa.
Hot Topics
Verizon Sports Big Plans for Yahoo
Alan Breznick, Cable/Video Practice Leader, Light Reading, 7/26/2016
Kevin Lo's Move to Facebook: Sign of Things to Come?
Patrick Donegan, Chief Analyst, Heavy Reading, 7/20/2016
Verizon's Next With VNFs
Carol Wilson, Editor-at-large, 7/21/2016
Facebook Gets Its Drone On
Ray Le Maistre, Editor-in-chief, 7/22/2016
Ericsson Ejects CEO Vestberg
Ray Le Maistre, Editor-in-chief, 7/25/2016
Like Us on Facebook
Twitter Feed
BETWEEN THE CEOs - Executive Interviews
There's no question that, come 2020, 5G technology will turn the world's conception of what mobile networking is on its head. Within the world of 5G development, Dr. ...
I've enjoyed interviewing many interesting people since I rejoined Light Reading, but William A. "Bill" Owens certainly takes the biscuit, as we say where I come from.
Animals with Phones
Live Digital Audio

Our world has evolved through innovation from the Industrial Revolution of the 1740s to the information age, and it is now entering the Fourth Industrial Revolution, driven by technology. Technology is driving a paradigm shift in the way digital solutions deliver a connected world, changing the way we live, communicate and provide solutions. It can have a powerful impact on how we tackle some of the world’s most pressing problems. In this radio show, Caroline Dowling, President of Communications Infrastructure & Enterprise Computing at Flex, will join Women in Comms Director Sarah Thomas to discuss the impact technology has on society and how it can be a game-changer across the globe; improving lives and creating a smarter world. Dowling, a Cork, Ireland, native and graduate of Harvard Business School's Advanced Management Program, will also discuss her experience managing an international team focused on innovation in an age of high-speed change.