際際滷

際際滷Share a Scribd company logo
D畛ch v畛 ph嘆ng ch畛ng t畉n c担ng DDoS
1
2
M畛C L畛C
1. Hi畛n tr畉ng v nguy c董 an ninh m畉ng
2. D畛ch v畛 ph嘆ng ch畛ng DDoS c畛a CMC Telecom
3. Th畛i gian tri畛n khai d畛ch v畛 DDoS
4. Cam k畉t ch畉t l動畛ng d畛ch v畛 DDoS
5. Kh叩ch hng ti棚u bi畛u
Hi畛n tr畉ng v nguy c董 an ninh m畉ng
3
4
Database
Application
Server
Web Page
API
T畉n c担ng th担ng qua Web Application
T畉n c担ng th担ng qua APIs
T畉n c担ng th担ng qua IP Des
DOWN
DOWN
1. DDoS = Distributed Denial of Service  T畉n c担ng t畛 ch畛i
d畛ch v畛 ph但n t叩n.
2. T畉n c担ng DDoS l n畛 l畛c lm ng畛ng ho畉t 畛ng m畛t d畛ch v畛
b畉ng c叩ch lm trn ng畉p n坦 v畛i traffic t畛 nhi畛u ngu畛n.
T畉n c担ng DDoS l g狸?
5
C叩c i畛m th動畛ng b畛 t畉n c担ng DDoS?
Volumetric DDoS
 Qu叩 t畉i 動畛ng truy畛n k畉t n畛i
 10-500 Gbps
T畉n c担ng lm qu叩 t畉i hi畛u xu畉t thi畉t b畛
 M畛c ti棚u l c叩c thi畉t b畛 m畉ng (load balancers, firewalls,
application servers)
 M畛c bng th担ng dao 畛ng 1-10Gbps
Application DDoS
 T畉n c担ng v畛i m畛c bng th担ng th畉p, < 1Gbps, 100+ y棚u c畉u/1s
 Kh担ng 畉nh h動畛ng t畛i h畉 t畉ng m畉ng k畉t n畛i
 Lm qu叩 t畉i c叩c server 畛ng d畛ng, down d畛ch v畛
ISP
Firewall IPS
Load
Balancer
Application
1. Ngu畛n t畉n c担ng DDoS: PC/Lap, IoT, Network Devices.
2. L動u l動畛ng DDoS c坦 th畛 vi trm Mbps 畉n vi trm Gbps
3. C叩c lo畉i t畉n c担ng DDoS
- Smart DDoS
- Volumetric
DATA
CENTER
ISP1
ISP2
ISPn
畛i t動畛ng, nguy c董, 畉nh h動畛ng
C叩c Ng但n hng,
doanh nghi畛p lu担n
l m畛c ti棚u t畉n
c担ng c畛a c叩c
nh坦m t畛i ph畉m
m畉ng
Nguy c董 d畛ch v畛
b畛 gi叩n o畉n,
畉nh h動畛ng t畛i
kinh doanh s畉n
xu畉t.
Ngu畛n l畛c dnh
cho c担ng t叩c gi叩m
s叩t, x畛 l箪 s畛 c畛
m畉t ATTT ang
thi畉u h畛t
Chi ph鱈 畉u t動
h畛 th畛ng b畉o
m畉t chuy棚n bi畛t
gi叩 thnh cao.
 Theo b叩o c叩o c畛a
Verisign, ngnh Ti
ch鱈nh l ngnh th動畛ng
xuy棚n b畛 t畉n c担ng nh畉t
trong 6 th叩ng 畉u nm
2018, chi畉m 57%
(Q1/2018) v 43%
(Q2/2018) trong t畛ng
s畛 c叩c ho畉t 畛ng t畉n
c担ng DDoS
畛i t動畛ng, nguy c董, 畉nh h動畛ng
C叩c xu h動畛ng DDoS
ch鱈nh:
 50% s畛 v畛 t畉n c担ng
l ng畉p l畛t UDP
(User Datagram
Protocol), (56%
Q2/2018)
 26% s畛 v畛 t畉n c担ng
d畛a tr棚n TCP l
h狸nh th畛c t畉n c担ng
ph畛 bi畉n th畛 2.
C叩c h狸nh th畛c t畉n c担ng DDoS ph畛 bi畉n
M畛c t畉n c担ng DDoS:
 User Datagram
Protocol (UDP)
fragment v畛i 42
Gigabits per second
(Gbps) v 3.5 Million
packets per second
(Mpps), k辿o di 3
gi畛
 Multi-vector attack
v畛i 38 Gbps v 4.7
Mpps, k辿o di trong
v嘆ng 2h
C叩c h狸nh th畛c t畉n c担ng DDoS ph畛 bi畉n
C叩c cu畛c t畉n
c担ng DDoS v畛i
nhi畛u h狸nh th畛c,
nhi畛u l畛p v
ph但n t叩n khi畉n
vi畛c ngn ch畉n
kh坦 khn h董n
C叩c h狸nh th畛c t畉n c担ng DDoS ph畛 bi畉n
D畛ch v畛 ph嘆ng ch畛ng DDoS c畛a
CMC Telecom
11
CMC Telecom cung c畉p t畛i kh叩ch hng v畛i c叩c g坦i d畛ch v畛 linh
ho畉t nh動 sau:
 Option1: Smart DDoS  Ch畛ng t畉n c担ng l畛p Application DDoS
 Option2: Volumetric DDoS  Ch畛ng t畉n c担ng Volumetric DDoS
 Option3: Hybrid  Ch畛ng t畉n c担ng Application v Volumetric
DDoS
D畛ch v畛 ch畛ng t畉n c担ng DDoS c畛a CMC Telecom
C叩c g坦i d畛ch v畛 DDoS c畛a CMC Telecom
STT Lo畉i d畛ch v畛 Tri畛n khai 働u i畛m H畉n ch畉
1 Smart DDoS
T畉i site kh叩ch hng ch畛 y畉u
dnh cho ph嘆ng ch畛ng t畉n
c担ng DDoS l畛p 畛ng d畛ng
(Layer 7) nh動 DNS, SMTP,
SIP, HTTP
 Ph嘆ng ch畛ng t畉n c担ng tr棚n
nhi畛u ngu畛n ISP
 CMC Tel v畉n hnh ton h畛
th畛ng
 Th畛i gian tri畛n khai l但u do c畉n th畛i gian
畉t hng t畛 h達ng (6-8 tu畉n)
 Kh担ng ph嘆ng ch畛ng 動畛c lo畉i t畉n c担ng
ng畉p l畛t 動畛ng truy畛n (Volumetric
DDoS) do b畛 ngh畉n bng th担ng 動畛ng
Uplink
2
Volumetric
DDoS
T畉i CMC Telecom DC
ph嘆ng ch畛ng t畉n c畛ng
DDoS theo d畉ng Volumetric
DDoS (Layer 3- Layer 4)
 Tri畛n khai nhanh ch坦ng
 畉u m畛i h畛 tr畛 t畉p trung
 CMC Tel v畉n hnh ton h畛
th畛ng
 Ch畛ng 動畛c t畉n c担ng Layer 3
v 4
 Kh担ng ph叩t hi畛n 動畛c t畉n c担ng Layer
7
 V畛i t畉n c担ng Volumetric DDoS, ch畛 c坦
t叩c d畛ng tr棚n 動畛ng truy畛n do CMC
cung c畉p.
3 Hybrid
T畉i site kh叩ch hng v CMC
Tel DC  Ph嘆ng ch畛ng
動畛c ton di畛n c叩c lo畉i t畉n
c担ng DDoS.
 Ch畛ng t畉n c担ng tr棚n nhi畛u
ngu畛n ISP
 CMC Tel v畉n hnh h畛 th畛ng
 Ph嘆ng ch畛ng t畉n c担ng t畛
Layer 3, 4 v 7
 V畛i t畉n c担ng Volumetric DDoS, ch畛 c坦
t叩c d畛ng tr棚n 動畛ng truy畛n do CMC
cung c畉p
M担 h狸nh tri畛n khai d畛ch v畛 DDoS  Smart DDoS
 Thi畉t b畛 ph嘆ng ch畛ng DDoS s畉
動畛c kh叩ch hng 畉u t動 ho畉c
thu棚 l畉i c畛a CMC Telecom v
畉t On-premise.
 Thi畉t b畛 動畛c ci 畉t ch畉 畛
transparent s畉 th畛c hi畛n l畛c
c叩c cu畛c t畉n c担ng t畛 b棚n
ngoi internet cung c畉p BW
s畉ch 畛 user truy c畉p 畛ng
d畛ng.
 Kh叩ch hng ph嘆ng ch畛ng tr棚n
t畉t c畉 c叩c line internet hi畛n c坦
cho c叩c d畛ch v畛 動畛c public.
 Ph嘆ng ch畛ng 動畛c m畛c t畉n
c担ng l畛p 畛ng d畛ng (l畛p 7)
nh動: DNS, HTTP, SSL,SMTP,
SIP.
ISP
Target
Applications &
Services
Firewall
IPS
Load
Balancer
Arbor APS
User
 Ng動畛i d湛ng h畛p l畛.
DDoS
 Traffic t畉n c担ng.
DATA
CENTER
ISP1
ISPn
CMC
Telecom IP
Core
Firewall IPS
Load
Balancer
Application
DATA
CENTER
Arbor APS
 Gi叩m s叩t, hi畛n th畛, ph叩t
hi畛n v x畛 l箪 t畉n c担ng
DDoS t畉i site kh叩ch
hng theo license BW.
User
 Ng動畛i d湛ng h畛p l畛.
User
 Ng動畛i d湛ng h畛p l畛.
DDoS
 Traffic t畉n c担ng.
DDoS
 Traffic t畉n c担ng.
CMC Telecom SOC
 V畉n hnh v b叩o c叩o
s畛 c畛 cho kh叩ch hng
User
 Ng動畛i d湛ng h畛p l畛.
DDoS
 Traffic t畉n c担ng.
Nguy棚n l箪 ho畉t 畛ng d畛ch v畛 DDoS  Smart DDoS
M担 h狸nh tri畛n khai d畛ch v畛 DDoS  Volumetric DDoS
 L動u l動畛ng s畉 動畛c 動a qua h畛
th畛ng gi叩m s叩t ph嘆ng ch畛ng
DDoS 畉t t畉i DC c畛a CMC
Telecom, s畉 l畛c t畉t c畉 c叩c traffic
DDoS v tr畉 v畛 l動u l動畛ng s畉ch
cho kh叩ch hng
 Vi畛c ph嘆ng ch畛ng DDoS v v畉n
hnh h畛 th畛ng s畉 do chuy棚n gia
c畛a CMC Telecom k畉t h畛p v畛i
chuy棚n gia b畉o m畉t c畛a Arbor
畉m nhi畛m.
 Kh叩ch hng ph嘆ng ch畛ng tr棚n
t畉t c畉 c叩c line internet do CMC
Telecom cung c畉p cho c叩c d畛ch
v畛 動畛c public.
 Ph嘆ng ch畛ng ki畛u t畉n c担ng
Volumetric nh動: TCP/UDP
Flood, TCP SYN.
Firewall
IPS
Load
Balancer
Arbor SP DDoS Detection
 Gi叩m s叩t, hi畛n th畛, ph叩t hi畛n t畉n c担ng DDoS.
 G畛i nh畉n BGP Flowsec.
 Qu畉n l箪 thu棚 bao kh叩ch hng
Arbor TMS DDoS Migration
 X畛 l箪 c叩c cu畛c t畉n c担ng DDoS.
 Tr畉 BW s畉ch v畛 cho kh叩ch hng.
User
 Ng動畛i d湛ng h畛p l畛.
DDoS
 Traffic t畉n c担ng.
DATA
CENTER
ISP2
ISPn
CMC
Telecom IP
Core
Firewall IPS
Load
Balancer
Application
DATA
CENTER
User
 Ng動畛i d湛ng h畛p l畛.
User
 Ng動畛i d湛ng h畛p l畛.
DDoS
 Traffic t畉n c担ng.
DDoS
 Traffic t畉n c担ng.
CMC Telecom SOC
 V畉n hnh v b叩o c叩o
s畛 c畛 cho kh叩ch hng
User
 Ng動畛i d湛ng h畛p l畛.
DDoS
 Traffic t畉n c担ng.
Arbor SP DDoS
Detection
 Nh畉n c畉nh b叩o t畛
router th担ng qua
giao th畛c BGP
Flowsec.
 Qu畉n l箪 thu棚 bao
kh叩ch hng
Arbor TMS DDoS
Migration
 X畛 l箪 c叩c cu畛c t畉n c担ng DDoS.
 Tr畉 BW s畉ch v畛 cho kh叩ch
hng.
Nguy棚n l箪 ho畉t 畛ng d畛ch v畛 DDoS  Volumetric DDoS
CMC
Telecom IP
Core
Firewall IPS
Load
Balancer
Application
DATA
CENTER
User
 Ng動畛i d湛ng h畛p l畛.
User
 Ng動畛i d湛ng h畛p l畛.
DDoS
 Traffic t畉n c担ng.
DDoS
 Traffic t畉n c担ng.
CMC Telecom SOC
 V畉n hnh v b叩o c叩o
s畛 c畛 cho kh叩ch hng
User
 Ng動畛i d湛ng h畛p l畛.
DDoS
 Traffic t畉n c担ng.
Arbor SP DDoS
Detection
 Gi叩m s叩t, hi畛n th畛, ph叩t
hi畛n t畉n c担ng DDoS.
 G畛i nh畉n t鱈n hi畛u
Cloud Signaling.
 Qu畉n l箪 thu棚 bao
kh叩ch hng
Arbor TMS DDoS
Migration
 X畛 l箪 c叩c cu畛c t畉n c担ng DDoS.
 Tr畉 BW s畉ch v畛 cho kh叩ch
hng.
Nguy棚n l箪 ho畉t 畛ng d畛ch v畛 DDoS  Volumetric DDoS
 Ph嘆ng ch畛ng 動畛c c叩c
lo畉i t畉n c担ng DDoS d畉ng
volumetric v application
DDoS.
 Hybrid l s畛 k畉t h畛p gi畛a
On-premise v Cloud
DDoS
 Ph嘆ng ch畛ng 動畛c m畛c
t畉n c担ng l畛p 畛ng d畛ng
nh動: DNS, HTTP,
SSL,SMTP, SIP. Khi
ng動畛ng bng th担ng ch動a
v動畛t 75% BW 畉u vo
c畛a c叩c line internet
 Khi bng th担ng v動畛t
ng動畛ng 75% tr棚n t畛ng
BW internet th狸 l動u l動畛ng
動畛c i畛u chuy畛n v畛
Core DDoS c畛a CMC Tel
畛 ph嘆ng ch畛ng DDoS
d畉ng volumetric.
M担 h狸nh tri畛n khai d畛ch v畛 DDoS  Hybrid
DATA
CENTER
Firewall
IPS
Load
Balancer
Arbor APS
Arbor SP DDoS Detection
 Gi叩m s叩t, hi畛n th畛, ph叩t hi畛n t畉n c担ng DDoS.
 G畛i nh畉n t鱈n hi畛u Cloud Signaling.
 Qu畉n l箪 thu棚 bao kh叩ch hng
Arbor TMS DDoS Migration
 X畛 l箪 c叩c cu畛c t畉n c担ng DDoS.
 Tr畉 BW s畉ch v畛 cho kh叩ch hng.
User
 Ng動畛i d湛ng h畛p l畛.
DDoS
 Traffic t畉n c担ng.
ISP2
ISPn
Nguy棚n l箪 ho畉t 畛ng d畛ch v畛 DDoS  Hybrid
DATA CENTER
Firewall
IPS
Load
Balancer
Arbor APS
CMC Telecom SOC
 V畉n hnh v b叩o c叩o s畛 c畛
cho kh叩ch hng
Arbor APS
 T畛 畛ng g畛i t鱈n hi畛u Cloud
Signaling khi bng v動畛t
ng動畛ng cho ph辿p.
ISP2
ISPn
Arbor Peakflow
SP / TMS-based
DDoS Service
Arbor
Pravail APS
Data
Center
Network
Firewall / IPS / WAF
Public
Facing
Servers
Subscriber Network Subscriber Network
Internet Service Provider
1. Service ho畉t 畛ng
b狸nh th動畛ng
2. C叩c cu畛c t畉n c担ng
s畉 動畛c b畉o v畛 b畛i
thi畉t b畛 On-premise
3. Khi t畉n c担ng v動畛t
ng動畛ng Bandwidth
c畛a thi畉t b畛 APS,
Cloud Signal 動畛c
g畛i t畛 thi畉t b畛 APS
t畛i CMC Tel SP/TMS
4. Traffic t畉n c担ng s畉
動畛c migrate v畛
h畛 th畛ng DDoS
c畛a CMC Tel
Nguy棚n l箪 ho畉t 畛ng d畛ch v畛 DDoS  Hybrid
22
G坦i d畛ch v畛 ph嘆ng ch畛ng DDoS  CMC Telecom
STT M畛c Bng Th担ng M担 h狸nh tri畛n khai
1 100 Mbps
Smart DDoS
Hybrid
2 250 Mbps
Smart DDoS
Hybrid
3 500 Mbps
Smart DDoS
Hybrid
4 1 Gbps
Smart DDoS
Hybrid
5 2 Gbps
Smart DDoS
Hybrid
6 5 Gbps
Smart DDoS
Hybrid
7 10 Gbps
Smart DDoS
Hybrid
8 15 Gbps
Smart DDoS
Hybrid
9 20 Gbps
Smart DDoS
Hybrid
M畛c Bng Th担ng M担 h狸nh tri畛n khai
1 Mbps Volumetric DDoS
23
STT G坦i d畛ch v畛 ph嘆ng ch畛ng DDoS c畛a CMC Telecom
1 S畛 l動畛ng 動畛ng truy畛n k畉t n畛i t畛i ISP 8 line k畉t n畛i
2 M畛c BW s畉ch cam k畉t 20Gbps
3 H狸nh th畛c tri畛n khai
Smart DDoS
Volumetric DDoS
Hybrid
4 V畛 tr鱈 tri畛n khai d畛ch v畛 Internet/WAN
5 動畛ng truy畛n
CMC Telecom cung c畉p t畛i kh叩ch hng 02 動畛ng
truy畛n:
- 1 動畛ng ILL theo m畛c BW ph嘆ng ch畛ng DDoS cam
k畉t.
- 1 動畛ng truy畛n CMC Telecom d湛ng 畛 v畉n hnh d畛ch
v畛 (Smart v Hybrid).
6 Thi畉t b畛
CMC Telecom cung c畉p thi畉t b畛 t畛i kh叩ch hng v畛i d畛ch
v畛 Smart v Hybrid
7 V畉n hnh c畉nh b叩o
CMC Telecom v畉n hnh, v b叩o c叩o hng tu畉n/th叩ng
畛nh k畛 t畛i kh叩ch hng.
G坦i d畛ch v畛 ph嘆ng ch畛ng DDoS  CMC Telecom
Th畛i gian tri畛n khai d畛ch v畛
24
Th畛i gian tri畛n khai d畛ch v畛 On-premise & Cloud Hybrid
C担ng vi畛c Th畛i gian CMC Telecom Kh叩ch hng L動u 
K箪 h畛p 畛ng v load thi畉t b畛 50 Ngy R S
Sau khi kh叩ch hng k箪 h畛p
畛ng
G畉n thi畉t b畛 APS l棚n Rack v 畉u n畛i v畉t l箪,
C畉u h狸nh c叩c th担ng s畛 c董 b畉n
1 Ngy R
Kh叩ch hng c畛 nh但n s畛 h畛
tr畛, ph畛i h畛p
Kh畛i t畉o c畉u h狸nh theo y棚u c畉u 1 Ngy R
Kh叩ch hng c畛 nh但n s畛 h畛
tr畛, ph畛i h畛p
C畉u h狸nh v UAT c叩c rule theo y棚u c畉u c畛a
Kh叩ch hng
4 Ngy R S
Kh叩ch hng c畛 nh但n s畛 h畛
tr畛, ph畛i h畛p
Ch畉y th畛 nghi畛m sau khi ki畛m th畛 UAT 3 Ngy R S
Kh叩ch hng c畛 nh但n s畛 h畛
tr畛, ph畛i h畛p
T畛i 動u l畉i h畛 th畛ng rule sau khi ch畉y th畛
nghi畛m
4 Ngy R S
Kh叩ch hng c畛 nh但n s畛 h畛
tr畛, ph畛i h畛p
Kh畛i t畉o report theo y棚u c畉u c畛a Kh叩ch
hng
1 Ngy R S
Kh叩ch hng c畛 nh但n s畛 h畛
tr畛, ph畛i h畛p
T畉o ti li畛u h動畛ng d畉n monitor cho nh但n s畛
Kh叩ch hng
2 Ngy R S
Kh叩ch hng c畛 nh但n s畛 h畛
tr畛, ph畛i h畛p
o t畉o v畛 d畛ch v畛, m担 h狸nh tri畛n khai v
c叩ch th畛c ph畛i h畛p cho nh但n s畛 Kh叩ch hng
1 Ngy R S
Kh叩ch hng c畛 nh但n s畛 h畛
tr畛, ph畛i h畛p
T畛ng th畛i gian d畛 ki畉n 68 Ngy Hon thnh d畛 叩n
Th畛i gian tri畛n khai d畛ch v畛 Cloud DDoS
C担ng vi畛c Th畛i gian CMC Telecom Kh叩ch hng L動u 
Kh畉o s叩t h畛 th畛ng kh叩ch hng 1 Ngy R S
Sau khi kh叩ch hng k箪 h畛p
畛ng
Tri畛n khai k棚nh truy畛n 2 Ngy R
Kh叩ch hng c畛 nh但n s畛 h畛
tr畛, ph畛i h畛p
Kh畛i t畉o c畉u h狸nh theo y棚u c畉u 0.5 Ngy R
Kh叩ch hng c畛 nh但n s畛 h畛
tr畛, ph畛i h畛p
C畉u h狸nh v UAT c叩c rule theo y棚u c畉u c畛a
Kh叩ch hng
0.5 Ngy R S
Kh叩ch hng c畛 nh但n s畛 h畛
tr畛, ph畛i h畛p
Ch畉y th畛 nghi畛m sau khi ki畛m th畛 UAT 1 Ngy R S
Kh叩ch hng c畛 nh但n s畛 h畛
tr畛, ph畛i h畛p
T畛i 動u l畉i h畛 th畛ng rule sau khi ch畉y th畛
nghi畛m
1 Ngy R S
Kh叩ch hng c畛 nh但n s畛 h畛
tr畛, ph畛i h畛p
Kh畛i t畉o report theo y棚u c畉u c畛a Kh叩ch
hng
1 Ngy R S
Kh叩ch hng c畛 nh但n s畛 h畛
tr畛, ph畛i h畛p
T畛ng th畛i gian d畛 ki畉n 7 Ngy Hon thnh d畛 叩n
R: Responsibility S: Support
Cam k畉t ch畉t l動畛ng d畛ch v畛
27
Cam k畉t ch畉t l動畛ng d畛ch v畛 DDoS - CMC Telecom
STT N畛i dung cam k畉t
Th担ng s畛
cam k畉t
1
Ph叩t hi畛n v c畉nh b叩o t畉n c担ng DDoS 24/7
H狸nh th畛c c畉nh b叩o & th担ng b叩o:
- Phone
- SMS
- Email
24/7
2 Ph嘆ng ch畛ng & x畛 l箪 t畉n c担ng DDos 10 ph炭t
Th担ng b叩o x畛 l箪 t畉n c担ng DDoS 10 ph炭t
X畛 l箪 ngn ch畉n cu畛c t畉n c担ng DDoS 15 ph炭t
3 B叩o c叩o
C坦 b叩o c叩o ph但n t鱈ch, ph叩t hi畛n 畛nh k畛 v畛 d畉u hi畛n, nguy c董, t狸nh tr畉ng t畉n c担ng DDoS
畛i v畛i h畛 th畛ng Kh叩ch hng ho畉c theo y棚u c畉u c畛a Kh叩ch hng.
Hng tu畉n
4 B叩o c叩o x畛 l箪 & nguy棚n nh但n s畛 c畛 sau t畉n c担ng DDoS
Trong 90 ph炭t sau
s畛 c畛
Quy tr狸nh x畛 l箪 d畛ch v畛 DDoS  CMC Telecom
CMC
SOC/NOC
Kh叩ch
hng x叩c
nh畉n d畛ch
v畛 online
CMC Tel x畛
l箪 s畛 c畛
Nh畉n s畛
ti畉p nh畉n
s畛 c畛
*CMC Tel c坦 nh但n s畛 SOC/NOC
tr畛c 24x7x365 k畛 c畉 l畛 t畉t
Kh叩ch Hng
C叩c d畛 叩n ti棚u bi畛u
30
C叩c d畛 叩n ti棚u bi畛u
STT T棚n KH D畛ch v畛 s畛 d畛ng Dung l動畛ng 叩p 畛ng Hi畛n tr畉ng
1 Ng但n hng ABB D畛ch v畛 Smart DDoS
- Ch畛ng t畉n c担ng L7
- BW = 250Mbps
ang s畛 d畛ng d畛ch v畛
2 Ng但n hng ACB D畛ch v畛 Hybrid
- Ch畛ng t畉n c担ng L3/L4
- Ch畛ng t畉n c担ng L7
- BW = 1000Mbps
ang s畛 d畛ng d畛ch v畛
3 B叩o VietnamNet D畛ch v畛 Hybrid
- Ch畛ng t畉n c担ng L3/L4
- Ch畛ng t畉n c担ng L7
- BW = 1000Mbps
ang t動 v畉n
ISP2
ISPn
User
 Ng動畛i d湛ng h畛p l畛.
DDoS
 Traffic t畉n c担ng.
Target
Applications &
Services
Firewall
IPS
Load
Balancer
Arbor APS
Disaster Recovery
Target
Applications &
Services
Firewall
IPS
Load
Balancer
Arbor APS
DATA CENTER  BW = 250Mbps theo
nng l畛c thi畉t b畛 畉t
t畉i site
 Ph嘆ng ch畛ng t畉n
c担ng DDoS L7 tr棚n
c叩c line internet hi畛n
c坦.
 Ph嘆ng ch畛ng t畉n
c担ng vo c叩c server
畛ng d畛ng nh動:
 Web Servers 
HTTP.
 SSL Secured
Services
 SIP Servers
 DNS Servers
 CMC Telecom v畉n
hnh v b叩o c叩o cho
kh叩ch hng.
C叩c d畛 叩n ti棚u bi畛u
ISP2
ISPn
User
 Ng動畛i d湛ng h畛p l畛.
DDoS
 Traffic t畉n c担ng.
 BW = 1000Mbps theo nng
l畛c thi畉t b畛 畉t t畉i site
 Ph嘆ng ch畛ng t畉n c担ng
DDoS L7 tr棚n c叩c line
internet hi畛n c坦.
 Ph嘆ng ch畛ng Volumetric
DDoS
 CMC Telecom v畉n hnh v
b叩o c叩o cho kh叩ch hng.
Target
Applications &
Services
Firewall
IPS
Load
Balancer
Arbor APS
DATA CENTER
C叩c d畛 叩n ti棚u bi畛u
ISP2
ISPn
NGFW
Firewall
Web App
Server Cluster
Load
Balancer
WAF Database
Server Clutser
Load
Balancer
vAPS
CMC Telecom
Managed services
VietNamNet
IT Team
CMC Cloud
User
 Ng動畛i d湛ng h畛p l畛.
DDoS
 Traffic t畉n c担ng.
C叩c d畛 叩n ti棚u bi畛u
35
THANK YOU
D畛ch v畛 ch畛ng t畉n c担ng DDoS c畛a CMC Telecom

More Related Content

Similar to CMC DDoS_Tai lieu gioi thieu cho noi bo_Final_20200406.pptx (20)

Bao cao th畛c t畉p i畛n to叩n 叩m m但y
Bao cao th畛c t畉p i畛n to叩n 叩m m但yBao cao th畛c t畉p i畛n to叩n 叩m m但y
Bao cao th畛c t畉p i畛n to叩n 叩m m但y
Vn n Ph畉m
Gi畉i ph叩p qu畉n tr畛 v v畉n hnh h畛 th畛ng CNTT theo ti棚u chu畉n ITIL/ ISO 20000
Gi畉i ph叩p qu畉n tr畛 v v畉n hnh h畛 th畛ng CNTT theo ti棚u chu畉n ITIL/ ISO 20000Gi畉i ph叩p qu畉n tr畛 v v畉n hnh h畛 th畛ng CNTT theo ti棚u chu畉n ITIL/ ISO 20000
Gi畉i ph叩p qu畉n tr畛 v v畉n hnh h畛 th畛ng CNTT theo ti棚u chu畉n ITIL/ ISO 20000
THK Associates
Qo s tr棚n windows
Qo s tr棚n windows Qo s tr棚n windows
Qo s tr棚n windows
Le Quyen
Giai phap chong tan cong ddos Arbor
Giai phap chong tan cong ddos ArborGiai phap chong tan cong ddos Arbor
Giai phap chong tan cong ddos Arbor
huudoanh
T狸m Hi畛u WLAn, Giao Th畛c Radius, Mikrotik Router
T狸m Hi畛u WLAn, Giao Th畛c Radius, Mikrotik RouterT狸m Hi畛u WLAn, Giao Th畛c Radius, Mikrotik Router
T狸m Hi畛u WLAn, Giao Th畛c Radius, Mikrotik Router
Le Trung Hieu
Case study tri畛n khai auto qo s voip
Case study tri畛n khai auto qo s voipCase study tri畛n khai auto qo s voip
Case study tri畛n khai auto qo s voip
VNG
Case study tri畛n khai auto qos voip
Case study tri畛n khai auto qos voipCase study tri畛n khai auto qos voip
Case study tri畛n khai auto qos voip
VNG
Nh坦m 55_Nghi棚n c畛u, th畛c hi畛n t畉n c担ng DDoS v c叩ch ph嘆ng ch畛ng.pptx
Nh坦m 55_Nghi棚n c畛u, th畛c hi畛n t畉n c担ng DDoS v c叩ch ph嘆ng ch畛ng.pptxNh坦m 55_Nghi棚n c畛u, th畛c hi畛n t畉n c担ng DDoS v c叩ch ph嘆ng ch畛ng.pptx
Nh坦m 55_Nghi棚n c畛u, th畛c hi畛n t畉n c担ng DDoS v c叩ch ph嘆ng ch畛ng.pptx
NgaNguyn759946
Data network
Data networkData network
Data network
L動董ng Duy Kh叩nh
An ton v b畉o m畉t trong i畛n to叩n 叩m m但y
An ton v b畉o m畉t trong i畛n to叩n 叩m m但yAn ton v b畉o m畉t trong i畛n to叩n 叩m m但y
An ton v b畉o m畉t trong i畛n to叩n 叩m m但y
PhamTuanKhiem
Datasheet mis 701
Datasheet mis 701Datasheet mis 701
Datasheet mis 701
Nguy畛n Ng畛c Ti棚n
i棚n to叩n 叩m m但y
i棚n to叩n 叩m m但yi棚n to叩n 叩m m但y
i棚n to叩n 叩m m但y
Tue Nguyen Dinh
Vdc intro final
Vdc intro finalVdc intro final
Vdc intro final
besuhao
Gi畛i thi畛u v畛 gi畉i ph叩p IDS Damballa
Gi畛i thi畛u v畛 gi畉i ph叩p IDS DamballaGi畛i thi畛u v畛 gi畉i ph叩p IDS Damballa
Gi畛i thi畛u v畛 gi畉i ph叩p IDS Damballa
huudoanh
00050001334
0005000133400050001334
00050001334
vanliemtb
T狸m hi畛u v畛 m畉ng ri棚ng 畉o VPN-Virtual Private Network
T狸m hi畛u v畛 m畉ng ri棚ng 畉o VPN-Virtual Private Network T狸m hi畛u v畛 m畉ng ri棚ng 畉o VPN-Virtual Private Network
T狸m hi畛u v畛 m畉ng ri棚ng 畉o VPN-Virtual Private Network
AskSock Ng担 Quang 畉o
[Cisco Connect 2018 - Vietnam] Vib 15 min hn cisco connect 2018
[Cisco Connect 2018 - Vietnam] Vib 15 min hn cisco connect 2018[Cisco Connect 2018 - Vietnam] Vib 15 min hn cisco connect 2018
[Cisco Connect 2018 - Vietnam] Vib 15 min hn cisco connect 2018
Nur Shiqim Chok
Nghien cuu ma nguon mo openvpn
Nghien cuu ma nguon mo openvpnNghien cuu ma nguon mo openvpn
Nghien cuu ma nguon mo openvpn
peterh18
B叩o c叩o th畛c t畉p tu畉n 6
B叩o c叩o th畛c t畉p tu畉n 6B叩o c叩o th畛c t畉p tu畉n 6
B叩o c叩o th畛c t畉p tu畉n 6
Qu但n Qu畉t Mo
Bao cao th畛c t畉p i畛n to叩n 叩m m但y
Bao cao th畛c t畉p i畛n to叩n 叩m m但yBao cao th畛c t畉p i畛n to叩n 叩m m但y
Bao cao th畛c t畉p i畛n to叩n 叩m m但y
Vn n Ph畉m
Gi畉i ph叩p qu畉n tr畛 v v畉n hnh h畛 th畛ng CNTT theo ti棚u chu畉n ITIL/ ISO 20000
Gi畉i ph叩p qu畉n tr畛 v v畉n hnh h畛 th畛ng CNTT theo ti棚u chu畉n ITIL/ ISO 20000Gi畉i ph叩p qu畉n tr畛 v v畉n hnh h畛 th畛ng CNTT theo ti棚u chu畉n ITIL/ ISO 20000
Gi畉i ph叩p qu畉n tr畛 v v畉n hnh h畛 th畛ng CNTT theo ti棚u chu畉n ITIL/ ISO 20000
THK Associates
Qo s tr棚n windows
Qo s tr棚n windows Qo s tr棚n windows
Qo s tr棚n windows
Le Quyen
Giai phap chong tan cong ddos Arbor
Giai phap chong tan cong ddos ArborGiai phap chong tan cong ddos Arbor
Giai phap chong tan cong ddos Arbor
huudoanh
T狸m Hi畛u WLAn, Giao Th畛c Radius, Mikrotik Router
T狸m Hi畛u WLAn, Giao Th畛c Radius, Mikrotik RouterT狸m Hi畛u WLAn, Giao Th畛c Radius, Mikrotik Router
T狸m Hi畛u WLAn, Giao Th畛c Radius, Mikrotik Router
Le Trung Hieu
Case study tri畛n khai auto qo s voip
Case study tri畛n khai auto qo s voipCase study tri畛n khai auto qo s voip
Case study tri畛n khai auto qo s voip
VNG
Case study tri畛n khai auto qos voip
Case study tri畛n khai auto qos voipCase study tri畛n khai auto qos voip
Case study tri畛n khai auto qos voip
VNG
Nh坦m 55_Nghi棚n c畛u, th畛c hi畛n t畉n c担ng DDoS v c叩ch ph嘆ng ch畛ng.pptx
Nh坦m 55_Nghi棚n c畛u, th畛c hi畛n t畉n c担ng DDoS v c叩ch ph嘆ng ch畛ng.pptxNh坦m 55_Nghi棚n c畛u, th畛c hi畛n t畉n c担ng DDoS v c叩ch ph嘆ng ch畛ng.pptx
Nh坦m 55_Nghi棚n c畛u, th畛c hi畛n t畉n c担ng DDoS v c叩ch ph嘆ng ch畛ng.pptx
NgaNguyn759946
An ton v b畉o m畉t trong i畛n to叩n 叩m m但y
An ton v b畉o m畉t trong i畛n to叩n 叩m m但yAn ton v b畉o m畉t trong i畛n to叩n 叩m m但y
An ton v b畉o m畉t trong i畛n to叩n 叩m m但y
PhamTuanKhiem
i棚n to叩n 叩m m但y
i棚n to叩n 叩m m但yi棚n to叩n 叩m m但y
i棚n to叩n 叩m m但y
Tue Nguyen Dinh
Vdc intro final
Vdc intro finalVdc intro final
Vdc intro final
besuhao
Gi畛i thi畛u v畛 gi畉i ph叩p IDS Damballa
Gi畛i thi畛u v畛 gi畉i ph叩p IDS DamballaGi畛i thi畛u v畛 gi畉i ph叩p IDS Damballa
Gi畛i thi畛u v畛 gi畉i ph叩p IDS Damballa
huudoanh
00050001334
0005000133400050001334
00050001334
vanliemtb
T狸m hi畛u v畛 m畉ng ri棚ng 畉o VPN-Virtual Private Network
T狸m hi畛u v畛 m畉ng ri棚ng 畉o VPN-Virtual Private Network T狸m hi畛u v畛 m畉ng ri棚ng 畉o VPN-Virtual Private Network
T狸m hi畛u v畛 m畉ng ri棚ng 畉o VPN-Virtual Private Network
AskSock Ng担 Quang 畉o
[Cisco Connect 2018 - Vietnam] Vib 15 min hn cisco connect 2018
[Cisco Connect 2018 - Vietnam] Vib 15 min hn cisco connect 2018[Cisco Connect 2018 - Vietnam] Vib 15 min hn cisco connect 2018
[Cisco Connect 2018 - Vietnam] Vib 15 min hn cisco connect 2018
Nur Shiqim Chok
Nghien cuu ma nguon mo openvpn
Nghien cuu ma nguon mo openvpnNghien cuu ma nguon mo openvpn
Nghien cuu ma nguon mo openvpn
peterh18
B叩o c叩o th畛c t畉p tu畉n 6
B叩o c叩o th畛c t畉p tu畉n 6B叩o c叩o th畛c t畉p tu畉n 6
B叩o c叩o th畛c t畉p tu畉n 6
Qu但n Qu畉t Mo

CMC DDoS_Tai lieu gioi thieu cho noi bo_Final_20200406.pptx

  • 1. D畛ch v畛 ph嘆ng ch畛ng t畉n c担ng DDoS 1
  • 2. 2 M畛C L畛C 1. Hi畛n tr畉ng v nguy c董 an ninh m畉ng 2. D畛ch v畛 ph嘆ng ch畛ng DDoS c畛a CMC Telecom 3. Th畛i gian tri畛n khai d畛ch v畛 DDoS 4. Cam k畉t ch畉t l動畛ng d畛ch v畛 DDoS 5. Kh叩ch hng ti棚u bi畛u
  • 3. Hi畛n tr畉ng v nguy c董 an ninh m畉ng 3
  • 4. 4 Database Application Server Web Page API T畉n c担ng th担ng qua Web Application T畉n c担ng th担ng qua APIs T畉n c担ng th担ng qua IP Des DOWN DOWN 1. DDoS = Distributed Denial of Service T畉n c担ng t畛 ch畛i d畛ch v畛 ph但n t叩n. 2. T畉n c担ng DDoS l n畛 l畛c lm ng畛ng ho畉t 畛ng m畛t d畛ch v畛 b畉ng c叩ch lm trn ng畉p n坦 v畛i traffic t畛 nhi畛u ngu畛n. T畉n c担ng DDoS l g狸?
  • 5. 5 C叩c i畛m th動畛ng b畛 t畉n c担ng DDoS? Volumetric DDoS Qu叩 t畉i 動畛ng truy畛n k畉t n畛i 10-500 Gbps T畉n c担ng lm qu叩 t畉i hi畛u xu畉t thi畉t b畛 M畛c ti棚u l c叩c thi畉t b畛 m畉ng (load balancers, firewalls, application servers) M畛c bng th担ng dao 畛ng 1-10Gbps Application DDoS T畉n c担ng v畛i m畛c bng th担ng th畉p, < 1Gbps, 100+ y棚u c畉u/1s Kh担ng 畉nh h動畛ng t畛i h畉 t畉ng m畉ng k畉t n畛i Lm qu叩 t畉i c叩c server 畛ng d畛ng, down d畛ch v畛 ISP Firewall IPS Load Balancer Application 1. Ngu畛n t畉n c担ng DDoS: PC/Lap, IoT, Network Devices. 2. L動u l動畛ng DDoS c坦 th畛 vi trm Mbps 畉n vi trm Gbps 3. C叩c lo畉i t畉n c担ng DDoS - Smart DDoS - Volumetric DATA CENTER ISP1 ISP2 ISPn
  • 6. 畛i t動畛ng, nguy c董, 畉nh h動畛ng C叩c Ng但n hng, doanh nghi畛p lu担n l m畛c ti棚u t畉n c担ng c畛a c叩c nh坦m t畛i ph畉m m畉ng Nguy c董 d畛ch v畛 b畛 gi叩n o畉n, 畉nh h動畛ng t畛i kinh doanh s畉n xu畉t. Ngu畛n l畛c dnh cho c担ng t叩c gi叩m s叩t, x畛 l箪 s畛 c畛 m畉t ATTT ang thi畉u h畛t Chi ph鱈 畉u t動 h畛 th畛ng b畉o m畉t chuy棚n bi畛t gi叩 thnh cao.
  • 7. Theo b叩o c叩o c畛a Verisign, ngnh Ti ch鱈nh l ngnh th動畛ng xuy棚n b畛 t畉n c担ng nh畉t trong 6 th叩ng 畉u nm 2018, chi畉m 57% (Q1/2018) v 43% (Q2/2018) trong t畛ng s畛 c叩c ho畉t 畛ng t畉n c担ng DDoS 畛i t動畛ng, nguy c董, 畉nh h動畛ng
  • 8. C叩c xu h動畛ng DDoS ch鱈nh: 50% s畛 v畛 t畉n c担ng l ng畉p l畛t UDP (User Datagram Protocol), (56% Q2/2018) 26% s畛 v畛 t畉n c担ng d畛a tr棚n TCP l h狸nh th畛c t畉n c担ng ph畛 bi畉n th畛 2. C叩c h狸nh th畛c t畉n c担ng DDoS ph畛 bi畉n
  • 9. M畛c t畉n c担ng DDoS: User Datagram Protocol (UDP) fragment v畛i 42 Gigabits per second (Gbps) v 3.5 Million packets per second (Mpps), k辿o di 3 gi畛 Multi-vector attack v畛i 38 Gbps v 4.7 Mpps, k辿o di trong v嘆ng 2h C叩c h狸nh th畛c t畉n c担ng DDoS ph畛 bi畉n
  • 10. C叩c cu畛c t畉n c担ng DDoS v畛i nhi畛u h狸nh th畛c, nhi畛u l畛p v ph但n t叩n khi畉n vi畛c ngn ch畉n kh坦 khn h董n C叩c h狸nh th畛c t畉n c担ng DDoS ph畛 bi畉n
  • 11. D畛ch v畛 ph嘆ng ch畛ng DDoS c畛a CMC Telecom 11
  • 12. CMC Telecom cung c畉p t畛i kh叩ch hng v畛i c叩c g坦i d畛ch v畛 linh ho畉t nh動 sau: Option1: Smart DDoS Ch畛ng t畉n c担ng l畛p Application DDoS Option2: Volumetric DDoS Ch畛ng t畉n c担ng Volumetric DDoS Option3: Hybrid Ch畛ng t畉n c担ng Application v Volumetric DDoS D畛ch v畛 ch畛ng t畉n c担ng DDoS c畛a CMC Telecom
  • 13. C叩c g坦i d畛ch v畛 DDoS c畛a CMC Telecom STT Lo畉i d畛ch v畛 Tri畛n khai 働u i畛m H畉n ch畉 1 Smart DDoS T畉i site kh叩ch hng ch畛 y畉u dnh cho ph嘆ng ch畛ng t畉n c担ng DDoS l畛p 畛ng d畛ng (Layer 7) nh動 DNS, SMTP, SIP, HTTP Ph嘆ng ch畛ng t畉n c担ng tr棚n nhi畛u ngu畛n ISP CMC Tel v畉n hnh ton h畛 th畛ng Th畛i gian tri畛n khai l但u do c畉n th畛i gian 畉t hng t畛 h達ng (6-8 tu畉n) Kh担ng ph嘆ng ch畛ng 動畛c lo畉i t畉n c担ng ng畉p l畛t 動畛ng truy畛n (Volumetric DDoS) do b畛 ngh畉n bng th担ng 動畛ng Uplink 2 Volumetric DDoS T畉i CMC Telecom DC ph嘆ng ch畛ng t畉n c畛ng DDoS theo d畉ng Volumetric DDoS (Layer 3- Layer 4) Tri畛n khai nhanh ch坦ng 畉u m畛i h畛 tr畛 t畉p trung CMC Tel v畉n hnh ton h畛 th畛ng Ch畛ng 動畛c t畉n c担ng Layer 3 v 4 Kh担ng ph叩t hi畛n 動畛c t畉n c担ng Layer 7 V畛i t畉n c担ng Volumetric DDoS, ch畛 c坦 t叩c d畛ng tr棚n 動畛ng truy畛n do CMC cung c畉p. 3 Hybrid T畉i site kh叩ch hng v CMC Tel DC Ph嘆ng ch畛ng 動畛c ton di畛n c叩c lo畉i t畉n c担ng DDoS. Ch畛ng t畉n c担ng tr棚n nhi畛u ngu畛n ISP CMC Tel v畉n hnh h畛 th畛ng Ph嘆ng ch畛ng t畉n c担ng t畛 Layer 3, 4 v 7 V畛i t畉n c担ng Volumetric DDoS, ch畛 c坦 t叩c d畛ng tr棚n 動畛ng truy畛n do CMC cung c畉p
  • 14. M担 h狸nh tri畛n khai d畛ch v畛 DDoS Smart DDoS Thi畉t b畛 ph嘆ng ch畛ng DDoS s畉 動畛c kh叩ch hng 畉u t動 ho畉c thu棚 l畉i c畛a CMC Telecom v 畉t On-premise. Thi畉t b畛 動畛c ci 畉t ch畉 畛 transparent s畉 th畛c hi畛n l畛c c叩c cu畛c t畉n c担ng t畛 b棚n ngoi internet cung c畉p BW s畉ch 畛 user truy c畉p 畛ng d畛ng. Kh叩ch hng ph嘆ng ch畛ng tr棚n t畉t c畉 c叩c line internet hi畛n c坦 cho c叩c d畛ch v畛 動畛c public. Ph嘆ng ch畛ng 動畛c m畛c t畉n c担ng l畛p 畛ng d畛ng (l畛p 7) nh動: DNS, HTTP, SSL,SMTP, SIP. ISP Target Applications & Services Firewall IPS Load Balancer Arbor APS User Ng動畛i d湛ng h畛p l畛. DDoS Traffic t畉n c担ng. DATA CENTER ISP1 ISPn
  • 15. CMC Telecom IP Core Firewall IPS Load Balancer Application DATA CENTER Arbor APS Gi叩m s叩t, hi畛n th畛, ph叩t hi畛n v x畛 l箪 t畉n c担ng DDoS t畉i site kh叩ch hng theo license BW. User Ng動畛i d湛ng h畛p l畛. User Ng動畛i d湛ng h畛p l畛. DDoS Traffic t畉n c担ng. DDoS Traffic t畉n c担ng. CMC Telecom SOC V畉n hnh v b叩o c叩o s畛 c畛 cho kh叩ch hng User Ng動畛i d湛ng h畛p l畛. DDoS Traffic t畉n c担ng. Nguy棚n l箪 ho畉t 畛ng d畛ch v畛 DDoS Smart DDoS
  • 16. M担 h狸nh tri畛n khai d畛ch v畛 DDoS Volumetric DDoS L動u l動畛ng s畉 動畛c 動a qua h畛 th畛ng gi叩m s叩t ph嘆ng ch畛ng DDoS 畉t t畉i DC c畛a CMC Telecom, s畉 l畛c t畉t c畉 c叩c traffic DDoS v tr畉 v畛 l動u l動畛ng s畉ch cho kh叩ch hng Vi畛c ph嘆ng ch畛ng DDoS v v畉n hnh h畛 th畛ng s畉 do chuy棚n gia c畛a CMC Telecom k畉t h畛p v畛i chuy棚n gia b畉o m畉t c畛a Arbor 畉m nhi畛m. Kh叩ch hng ph嘆ng ch畛ng tr棚n t畉t c畉 c叩c line internet do CMC Telecom cung c畉p cho c叩c d畛ch v畛 動畛c public. Ph嘆ng ch畛ng ki畛u t畉n c担ng Volumetric nh動: TCP/UDP Flood, TCP SYN. Firewall IPS Load Balancer Arbor SP DDoS Detection Gi叩m s叩t, hi畛n th畛, ph叩t hi畛n t畉n c担ng DDoS. G畛i nh畉n BGP Flowsec. Qu畉n l箪 thu棚 bao kh叩ch hng Arbor TMS DDoS Migration X畛 l箪 c叩c cu畛c t畉n c担ng DDoS. Tr畉 BW s畉ch v畛 cho kh叩ch hng. User Ng動畛i d湛ng h畛p l畛. DDoS Traffic t畉n c担ng. DATA CENTER ISP2 ISPn
  • 17. CMC Telecom IP Core Firewall IPS Load Balancer Application DATA CENTER User Ng動畛i d湛ng h畛p l畛. User Ng動畛i d湛ng h畛p l畛. DDoS Traffic t畉n c担ng. DDoS Traffic t畉n c担ng. CMC Telecom SOC V畉n hnh v b叩o c叩o s畛 c畛 cho kh叩ch hng User Ng動畛i d湛ng h畛p l畛. DDoS Traffic t畉n c担ng. Arbor SP DDoS Detection Nh畉n c畉nh b叩o t畛 router th担ng qua giao th畛c BGP Flowsec. Qu畉n l箪 thu棚 bao kh叩ch hng Arbor TMS DDoS Migration X畛 l箪 c叩c cu畛c t畉n c担ng DDoS. Tr畉 BW s畉ch v畛 cho kh叩ch hng. Nguy棚n l箪 ho畉t 畛ng d畛ch v畛 DDoS Volumetric DDoS
  • 18. CMC Telecom IP Core Firewall IPS Load Balancer Application DATA CENTER User Ng動畛i d湛ng h畛p l畛. User Ng動畛i d湛ng h畛p l畛. DDoS Traffic t畉n c担ng. DDoS Traffic t畉n c担ng. CMC Telecom SOC V畉n hnh v b叩o c叩o s畛 c畛 cho kh叩ch hng User Ng動畛i d湛ng h畛p l畛. DDoS Traffic t畉n c担ng. Arbor SP DDoS Detection Gi叩m s叩t, hi畛n th畛, ph叩t hi畛n t畉n c担ng DDoS. G畛i nh畉n t鱈n hi畛u Cloud Signaling. Qu畉n l箪 thu棚 bao kh叩ch hng Arbor TMS DDoS Migration X畛 l箪 c叩c cu畛c t畉n c担ng DDoS. Tr畉 BW s畉ch v畛 cho kh叩ch hng. Nguy棚n l箪 ho畉t 畛ng d畛ch v畛 DDoS Volumetric DDoS
  • 19. Ph嘆ng ch畛ng 動畛c c叩c lo畉i t畉n c担ng DDoS d畉ng volumetric v application DDoS. Hybrid l s畛 k畉t h畛p gi畛a On-premise v Cloud DDoS Ph嘆ng ch畛ng 動畛c m畛c t畉n c担ng l畛p 畛ng d畛ng nh動: DNS, HTTP, SSL,SMTP, SIP. Khi ng動畛ng bng th担ng ch動a v動畛t 75% BW 畉u vo c畛a c叩c line internet Khi bng th担ng v動畛t ng動畛ng 75% tr棚n t畛ng BW internet th狸 l動u l動畛ng 動畛c i畛u chuy畛n v畛 Core DDoS c畛a CMC Tel 畛 ph嘆ng ch畛ng DDoS d畉ng volumetric. M担 h狸nh tri畛n khai d畛ch v畛 DDoS Hybrid DATA CENTER Firewall IPS Load Balancer Arbor APS Arbor SP DDoS Detection Gi叩m s叩t, hi畛n th畛, ph叩t hi畛n t畉n c担ng DDoS. G畛i nh畉n t鱈n hi畛u Cloud Signaling. Qu畉n l箪 thu棚 bao kh叩ch hng Arbor TMS DDoS Migration X畛 l箪 c叩c cu畛c t畉n c担ng DDoS. Tr畉 BW s畉ch v畛 cho kh叩ch hng. User Ng動畛i d湛ng h畛p l畛. DDoS Traffic t畉n c担ng. ISP2 ISPn
  • 20. Nguy棚n l箪 ho畉t 畛ng d畛ch v畛 DDoS Hybrid DATA CENTER Firewall IPS Load Balancer Arbor APS CMC Telecom SOC V畉n hnh v b叩o c叩o s畛 c畛 cho kh叩ch hng Arbor APS T畛 畛ng g畛i t鱈n hi畛u Cloud Signaling khi bng v動畛t ng動畛ng cho ph辿p. ISP2 ISPn
  • 21. Arbor Peakflow SP / TMS-based DDoS Service Arbor Pravail APS Data Center Network Firewall / IPS / WAF Public Facing Servers Subscriber Network Subscriber Network Internet Service Provider 1. Service ho畉t 畛ng b狸nh th動畛ng 2. C叩c cu畛c t畉n c担ng s畉 動畛c b畉o v畛 b畛i thi畉t b畛 On-premise 3. Khi t畉n c担ng v動畛t ng動畛ng Bandwidth c畛a thi畉t b畛 APS, Cloud Signal 動畛c g畛i t畛 thi畉t b畛 APS t畛i CMC Tel SP/TMS 4. Traffic t畉n c担ng s畉 動畛c migrate v畛 h畛 th畛ng DDoS c畛a CMC Tel Nguy棚n l箪 ho畉t 畛ng d畛ch v畛 DDoS Hybrid
  • 22. 22 G坦i d畛ch v畛 ph嘆ng ch畛ng DDoS CMC Telecom STT M畛c Bng Th担ng M担 h狸nh tri畛n khai 1 100 Mbps Smart DDoS Hybrid 2 250 Mbps Smart DDoS Hybrid 3 500 Mbps Smart DDoS Hybrid 4 1 Gbps Smart DDoS Hybrid 5 2 Gbps Smart DDoS Hybrid 6 5 Gbps Smart DDoS Hybrid 7 10 Gbps Smart DDoS Hybrid 8 15 Gbps Smart DDoS Hybrid 9 20 Gbps Smart DDoS Hybrid M畛c Bng Th担ng M担 h狸nh tri畛n khai 1 Mbps Volumetric DDoS
  • 23. 23 STT G坦i d畛ch v畛 ph嘆ng ch畛ng DDoS c畛a CMC Telecom 1 S畛 l動畛ng 動畛ng truy畛n k畉t n畛i t畛i ISP 8 line k畉t n畛i 2 M畛c BW s畉ch cam k畉t 20Gbps 3 H狸nh th畛c tri畛n khai Smart DDoS Volumetric DDoS Hybrid 4 V畛 tr鱈 tri畛n khai d畛ch v畛 Internet/WAN 5 動畛ng truy畛n CMC Telecom cung c畉p t畛i kh叩ch hng 02 動畛ng truy畛n: - 1 動畛ng ILL theo m畛c BW ph嘆ng ch畛ng DDoS cam k畉t. - 1 動畛ng truy畛n CMC Telecom d湛ng 畛 v畉n hnh d畛ch v畛 (Smart v Hybrid). 6 Thi畉t b畛 CMC Telecom cung c畉p thi畉t b畛 t畛i kh叩ch hng v畛i d畛ch v畛 Smart v Hybrid 7 V畉n hnh c畉nh b叩o CMC Telecom v畉n hnh, v b叩o c叩o hng tu畉n/th叩ng 畛nh k畛 t畛i kh叩ch hng. G坦i d畛ch v畛 ph嘆ng ch畛ng DDoS CMC Telecom
  • 24. Th畛i gian tri畛n khai d畛ch v畛 24
  • 25. Th畛i gian tri畛n khai d畛ch v畛 On-premise & Cloud Hybrid C担ng vi畛c Th畛i gian CMC Telecom Kh叩ch hng L動u K箪 h畛p 畛ng v load thi畉t b畛 50 Ngy R S Sau khi kh叩ch hng k箪 h畛p 畛ng G畉n thi畉t b畛 APS l棚n Rack v 畉u n畛i v畉t l箪, C畉u h狸nh c叩c th担ng s畛 c董 b畉n 1 Ngy R Kh叩ch hng c畛 nh但n s畛 h畛 tr畛, ph畛i h畛p Kh畛i t畉o c畉u h狸nh theo y棚u c畉u 1 Ngy R Kh叩ch hng c畛 nh但n s畛 h畛 tr畛, ph畛i h畛p C畉u h狸nh v UAT c叩c rule theo y棚u c畉u c畛a Kh叩ch hng 4 Ngy R S Kh叩ch hng c畛 nh但n s畛 h畛 tr畛, ph畛i h畛p Ch畉y th畛 nghi畛m sau khi ki畛m th畛 UAT 3 Ngy R S Kh叩ch hng c畛 nh但n s畛 h畛 tr畛, ph畛i h畛p T畛i 動u l畉i h畛 th畛ng rule sau khi ch畉y th畛 nghi畛m 4 Ngy R S Kh叩ch hng c畛 nh但n s畛 h畛 tr畛, ph畛i h畛p Kh畛i t畉o report theo y棚u c畉u c畛a Kh叩ch hng 1 Ngy R S Kh叩ch hng c畛 nh但n s畛 h畛 tr畛, ph畛i h畛p T畉o ti li畛u h動畛ng d畉n monitor cho nh但n s畛 Kh叩ch hng 2 Ngy R S Kh叩ch hng c畛 nh但n s畛 h畛 tr畛, ph畛i h畛p o t畉o v畛 d畛ch v畛, m担 h狸nh tri畛n khai v c叩ch th畛c ph畛i h畛p cho nh但n s畛 Kh叩ch hng 1 Ngy R S Kh叩ch hng c畛 nh但n s畛 h畛 tr畛, ph畛i h畛p T畛ng th畛i gian d畛 ki畉n 68 Ngy Hon thnh d畛 叩n
  • 26. Th畛i gian tri畛n khai d畛ch v畛 Cloud DDoS C担ng vi畛c Th畛i gian CMC Telecom Kh叩ch hng L動u Kh畉o s叩t h畛 th畛ng kh叩ch hng 1 Ngy R S Sau khi kh叩ch hng k箪 h畛p 畛ng Tri畛n khai k棚nh truy畛n 2 Ngy R Kh叩ch hng c畛 nh但n s畛 h畛 tr畛, ph畛i h畛p Kh畛i t畉o c畉u h狸nh theo y棚u c畉u 0.5 Ngy R Kh叩ch hng c畛 nh但n s畛 h畛 tr畛, ph畛i h畛p C畉u h狸nh v UAT c叩c rule theo y棚u c畉u c畛a Kh叩ch hng 0.5 Ngy R S Kh叩ch hng c畛 nh但n s畛 h畛 tr畛, ph畛i h畛p Ch畉y th畛 nghi畛m sau khi ki畛m th畛 UAT 1 Ngy R S Kh叩ch hng c畛 nh但n s畛 h畛 tr畛, ph畛i h畛p T畛i 動u l畉i h畛 th畛ng rule sau khi ch畉y th畛 nghi畛m 1 Ngy R S Kh叩ch hng c畛 nh但n s畛 h畛 tr畛, ph畛i h畛p Kh畛i t畉o report theo y棚u c畉u c畛a Kh叩ch hng 1 Ngy R S Kh叩ch hng c畛 nh但n s畛 h畛 tr畛, ph畛i h畛p T畛ng th畛i gian d畛 ki畉n 7 Ngy Hon thnh d畛 叩n R: Responsibility S: Support
  • 27. Cam k畉t ch畉t l動畛ng d畛ch v畛 27
  • 28. Cam k畉t ch畉t l動畛ng d畛ch v畛 DDoS - CMC Telecom STT N畛i dung cam k畉t Th担ng s畛 cam k畉t 1 Ph叩t hi畛n v c畉nh b叩o t畉n c担ng DDoS 24/7 H狸nh th畛c c畉nh b叩o & th担ng b叩o: - Phone - SMS - Email 24/7 2 Ph嘆ng ch畛ng & x畛 l箪 t畉n c担ng DDos 10 ph炭t Th担ng b叩o x畛 l箪 t畉n c担ng DDoS 10 ph炭t X畛 l箪 ngn ch畉n cu畛c t畉n c担ng DDoS 15 ph炭t 3 B叩o c叩o C坦 b叩o c叩o ph但n t鱈ch, ph叩t hi畛n 畛nh k畛 v畛 d畉u hi畛n, nguy c董, t狸nh tr畉ng t畉n c担ng DDoS 畛i v畛i h畛 th畛ng Kh叩ch hng ho畉c theo y棚u c畉u c畛a Kh叩ch hng. Hng tu畉n 4 B叩o c叩o x畛 l箪 & nguy棚n nh但n s畛 c畛 sau t畉n c担ng DDoS Trong 90 ph炭t sau s畛 c畛
  • 29. Quy tr狸nh x畛 l箪 d畛ch v畛 DDoS CMC Telecom CMC SOC/NOC Kh叩ch hng x叩c nh畉n d畛ch v畛 online CMC Tel x畛 l箪 s畛 c畛 Nh畉n s畛 ti畉p nh畉n s畛 c畛 *CMC Tel c坦 nh但n s畛 SOC/NOC tr畛c 24x7x365 k畛 c畉 l畛 t畉t Kh叩ch Hng
  • 30. C叩c d畛 叩n ti棚u bi畛u 30
  • 31. C叩c d畛 叩n ti棚u bi畛u STT T棚n KH D畛ch v畛 s畛 d畛ng Dung l動畛ng 叩p 畛ng Hi畛n tr畉ng 1 Ng但n hng ABB D畛ch v畛 Smart DDoS - Ch畛ng t畉n c担ng L7 - BW = 250Mbps ang s畛 d畛ng d畛ch v畛 2 Ng但n hng ACB D畛ch v畛 Hybrid - Ch畛ng t畉n c担ng L3/L4 - Ch畛ng t畉n c担ng L7 - BW = 1000Mbps ang s畛 d畛ng d畛ch v畛 3 B叩o VietnamNet D畛ch v畛 Hybrid - Ch畛ng t畉n c担ng L3/L4 - Ch畛ng t畉n c担ng L7 - BW = 1000Mbps ang t動 v畉n
  • 32. ISP2 ISPn User Ng動畛i d湛ng h畛p l畛. DDoS Traffic t畉n c担ng. Target Applications & Services Firewall IPS Load Balancer Arbor APS Disaster Recovery Target Applications & Services Firewall IPS Load Balancer Arbor APS DATA CENTER BW = 250Mbps theo nng l畛c thi畉t b畛 畉t t畉i site Ph嘆ng ch畛ng t畉n c担ng DDoS L7 tr棚n c叩c line internet hi畛n c坦. Ph嘆ng ch畛ng t畉n c担ng vo c叩c server 畛ng d畛ng nh動: Web Servers HTTP. SSL Secured Services SIP Servers DNS Servers CMC Telecom v畉n hnh v b叩o c叩o cho kh叩ch hng. C叩c d畛 叩n ti棚u bi畛u
  • 33. ISP2 ISPn User Ng動畛i d湛ng h畛p l畛. DDoS Traffic t畉n c担ng. BW = 1000Mbps theo nng l畛c thi畉t b畛 畉t t畉i site Ph嘆ng ch畛ng t畉n c担ng DDoS L7 tr棚n c叩c line internet hi畛n c坦. Ph嘆ng ch畛ng Volumetric DDoS CMC Telecom v畉n hnh v b叩o c叩o cho kh叩ch hng. Target Applications & Services Firewall IPS Load Balancer Arbor APS DATA CENTER C叩c d畛 叩n ti棚u bi畛u
  • 34. ISP2 ISPn NGFW Firewall Web App Server Cluster Load Balancer WAF Database Server Clutser Load Balancer vAPS CMC Telecom Managed services VietNamNet IT Team CMC Cloud User Ng動畛i d湛ng h畛p l畛. DDoS Traffic t畉n c担ng. C叩c d畛 叩n ti棚u bi畛u
  • 36. D畛ch v畛 ch畛ng t畉n c担ng DDoS c畛a CMC Telecom

Editor's Notes

  • #7: For the incoming years, we have plans to expand our network structure and upgrade our capacity to pursuit our vision to become the first choice ISP for both domestic and multi national companies in VN.
  • #8: Link Q炭y I: https://blog.verisign.com/security/q1-2018-ddos-trends-report-58-percent-of-attacks-employed-multiple-attack-types/ Ti畉ng Vi畛t: https://ictnews.vn/cntt/bao-mat/top-3-nganh-muc-tieu-cua-cac-cuoc-tan-cong-ddos-trong-quy-dau-nam-2018-169430.ict Link Qu箪 II: https://blog.verisign.com/security/ddos-protection/q2-2018-ddos-trends-report-52-percent-of-attacks-employed-multiple-attack-types/
  • #15: DNS Reroute: DNS A records are modified to point attack FQDN to Arbor cloud Full DNS proxy in cloud will route clean traffic to its destination Full proxy requires traffic in both directions Clean Traffic = Inbound + outbound traffic BGP Reroute Must divert a minimum of a /24 subnet Arbor requires 3 days to register routes with Internet Registry If customer only has a /24, then customer must de-announce the route when Arbor announces it Traffic returned via GRE Clean Traffic = Inbound traffic only By BGP Diversion here we mean the case where the route to the /24 netblock is taken over by a different provider by publishing the route to the Internet.
  • #16: DNS Reroute: DNS A records are modified to point attack FQDN to Arbor cloud Full DNS proxy in cloud will route clean traffic to its destination Full proxy requires traffic in both directions Clean Traffic = Inbound + outbound traffic BGP Reroute Must divert a minimum of a /24 subnet Arbor requires 3 days to register routes with Internet Registry If customer only has a /24, then customer must de-announce the route when Arbor announces it Traffic returned via GRE Clean Traffic = Inbound traffic only By BGP Diversion here we mean the case where the route to the /24 netblock is taken over by a different provider by publishing the route to the Internet.
  • #17: DNS Reroute: DNS A records are modified to point attack FQDN to Arbor cloud Full DNS proxy in cloud will route clean traffic to its destination Full proxy requires traffic in both directions Clean Traffic = Inbound + outbound traffic BGP Reroute Must divert a minimum of a /24 subnet Arbor requires 3 days to register routes with Internet Registry If customer only has a /24, then customer must de-announce the route when Arbor announces it Traffic returned via GRE Clean Traffic = Inbound traffic only By BGP Diversion here we mean the case where the route to the /24 netblock is taken over by a different provider by publishing the route to the Internet.
  • #18: DNS Reroute: DNS A records are modified to point attack FQDN to Arbor cloud Full DNS proxy in cloud will route clean traffic to its destination Full proxy requires traffic in both directions Clean Traffic = Inbound + outbound traffic BGP Reroute Must divert a minimum of a /24 subnet Arbor requires 3 days to register routes with Internet Registry If customer only has a /24, then customer must de-announce the route when Arbor announces it Traffic returned via GRE Clean Traffic = Inbound traffic only By BGP Diversion here we mean the case where the route to the /24 netblock is taken over by a different provider by publishing the route to the Internet.
  • #19: DNS Reroute: DNS A records are modified to point attack FQDN to Arbor cloud Full DNS proxy in cloud will route clean traffic to its destination Full proxy requires traffic in both directions Clean Traffic = Inbound + outbound traffic BGP Reroute Must divert a minimum of a /24 subnet Arbor requires 3 days to register routes with Internet Registry If customer only has a /24, then customer must de-announce the route when Arbor announces it Traffic returned via GRE Clean Traffic = Inbound traffic only By BGP Diversion here we mean the case where the route to the /24 netblock is taken over by a different provider by publishing the route to the Internet.
  • #20: DNS Reroute: DNS A records are modified to point attack FQDN to Arbor cloud Full DNS proxy in cloud will route clean traffic to its destination Full proxy requires traffic in both directions Clean Traffic = Inbound + outbound traffic BGP Reroute Must divert a minimum of a /24 subnet Arbor requires 3 days to register routes with Internet Registry If customer only has a /24, then customer must de-announce the route when Arbor announces it Traffic returned via GRE Clean Traffic = Inbound traffic only By BGP Diversion here we mean the case where the route to the /24 netblock is taken over by a different provider by publishing the route to the Internet.
  • #21: DNS Reroute: DNS A records are modified to point attack FQDN to Arbor cloud Full DNS proxy in cloud will route clean traffic to its destination Full proxy requires traffic in both directions Clean Traffic = Inbound + outbound traffic BGP Reroute Must divert a minimum of a /24 subnet Arbor requires 3 days to register routes with Internet Registry If customer only has a /24, then customer must de-announce the route when Arbor announces it Traffic returned via GRE Clean Traffic = Inbound traffic only By BGP Diversion here we mean the case where the route to the /24 netblock is taken over by a different provider by publishing the route to the Internet.
  • #22: DNS Reroute: DNS A records are modified to point attack FQDN to Arbor cloud Full DNS proxy in cloud will route clean traffic to its destination Full proxy requires traffic in both directions Clean Traffic = Inbound + outbound traffic BGP Reroute Must divert a minimum of a /24 subnet Arbor requires 3 days to register routes with Internet Registry If customer only has a /24, then customer must de-announce the route when Arbor announces it Traffic returned via GRE Clean Traffic = Inbound traffic only By BGP Diversion here we mean the case where the route to the /24 netblock is taken over by a different provider by publishing the route to the Internet.
  • #35: For the incoming years, we have plans to expand our network structure and upgrade our capacity to pursuit our vision to become the first choice ISP for both domestic and multi national companies in VN.