Denial-of-service got Twitter. Is your network next?
On Thursday, Twitter was taken down by a denial-of-service attack, while Facebook suffered related problems. And other social/media sites like Gawker and Live Journal were hampered by attacks as well. These attacks illustrate just how crucial network security is in a world where organized cyberattacks can bring down even the most prominent sites.
While the news cycle is quickly headed to the point of diminishing returns (lots of ruminations on DDoS, where the attacks originated, and how it was done), I've yet to see posts on how such attacks can be prevented.
In light of Twitter's susceptibility, preventing networks from similar attacks must be on the minds of many organizations. How would you go about protecting your company?
I asked Joe Habib from WildPackets about it, and he provided three tips for preventing network attacks:
- Using a network analysis tool, capture all data in one place. All pertinent network traffic can be aggregated to a single location, rather than scattered across the network. Data is captured in a common data format and does not need to be transferred or translated in any way for analysis.
- Set up alerts to isolate questionable behavior and zero in on it. If you see requests for considerable more data being requested than normal, look into the matter. Many network analysis tools today allow you to be notified when thresholds are exceeded. You know the typical or average level, so beware of extending beyond the "norm."
- Use network forensics data mining tools to reconstruct the sequence of events that occurred at the time of the attack. This will give you a complete picture. If you were not able to prevent a particular attack this time, you will at least gain crucial information to prevent a similar attack in the future.
The right tools help IT personnel get to the root of the problem. Having the appropriate tools in place and following the correct procedures helps eliminate or mitigate the effects of an attack. At least that's what John Pescatore, a security analyst at research firm Gartner, said was the hard lesson that Twitter has learned. "It basically just shows that Twitter wasn't spending the money to filter out DDoS attacks," he said, according to an article in the Los Angeles Times.
Follow me on Twitter @daveofdoom.
Dave Rosenberg dishes up "Software, Interrupted" with nearly 15 years of technology and marketing experience that spans from Bell Labs to multiple start-up IPOs to open-source enterprise software companies. He is co-founder of MuleSource and currently serves as the general manager of Hardy Way. He is a member of the CNET Blog Network and is not an employee of CNET. Disclosure. You can contact Dave via e-mail at softwareinterrupted@gmail.com or follow him on Twitter @daveofdoom. 
The reg keys began to disappear. I had to do a full recovery to get back up and running.
Surprise to see company like Twitter don't have anything in place to avoid DOS attack
--
Yogi
www.makedotsimple.com
HA HA HA. They had that one coming.
The US government has a lot on their plate right now, but for years we have done nothing at all as we've watched botnets grow and grow. When we see bot activity we need a fast and efficient way to advise the network and the individual bot owner, and possibly immediately disable the bot's connection.
Unless your name is Charlie Miller, I suspect you may want to leave the l33t claims where they belong. ;)
time to tell why it's so dumb on so many levels. You're such a great hacker, then by all means
hack ME, Sherlock. Or better yet entertain us with stories of fantasy about how you've infected
Macs or Linux machines--without the victim letting you sit in front of their computers and knowledge of their
passwords.
- by Random_Walk August 7, 2009 6:34 AM PDT
- Dave - you kind of forget that most companies are small enough that they only have the following, and damned little else:
- Like this Reply to this comment
-
(18 Comments)* a business DSL line with some ISP, and
* a hosted website somewhere that doesn't do much more than advertise the small business.
...which kinda makes the article useless for them. They can still get along just fine, because the former is often too frickin' big to easily soak for long, and the latter too small to damage the business with if it went down.
That said, one huge weak link involves inbound VPN lines... which weren't even mentioned in the article. Some are web-based (obviously), but unless it's a dedicated set VPN, any of them can be soaked by DDoS in a targeted attack. It's not just about the websites, yanno?