際際滷

際際滷Share a Scribd company logo

BISC 2013: Hosting and security

Frank Louwers
Frank Louwers

This document discusses security challenges in hosting environments, including DDoS attacks and how they have evolved over time. It also addresses how laws and government surveillance programs can impact hosting providers. Some key points include: - DDoS attacks are increasingly large in scale and use amplification techniques, making them difficult to defend against. External protection services are very expensive. - Traditional firewalls are ineffective against many modern attacks which exploit weaknesses in websites or use stolen credentials. The "onion model" of multiple layers of security is recommended. - Hosting servers located in one country may still be subject to laws and surveillance programs of the country where the hosting company is headquartered or network owner is based. This can allow governments

1 of 24
Download to read offline
Frank Louwers - Security challenges in a hosting environment - 20131024 Frank Louwers Openminds bvba Co-founder en COO Managed Hosting frank@openminds.be
Frank Louwers - Security challenges in a hosting environment - 20131024 DDoS and how they changed
Frank Louwers - Security challenges in a hosting environment - 20131024 (D)DoS attacks are not new Used to be targeted at: Competing game clans IRC servers Political parties
Frank Louwers - Security challenges in a hosting environment - 20131024 DDoS attack shift ≒Occupy movement: a lot of attacks on banks Political parties ≒companies and organisations with negative press (Monsanto, Press-agency of the Belgian Catholic Church, ...)
Frank Louwers - Security challenges in a hosting environment - 20131024 Attacks we cant explain Radio Stations?! Software development companies B2B online shops?
Frank Louwers - Security challenges in a hosting environment - 20131024 DDoS attacks: new tricks Ampli鍖cation attacks: attacker sends 2 Mbps stream, gets multiplied by 20, results in 40 Mbps attack Now multiply by 100 bots, so 4Gbps attack Bad con鍖gured DNS servers DNSSec increases the problem
Frank Louwers - Security challenges in a hosting environment - 20131024 Protect against DDoS attacks UDP: yes, can be blocked by decent routers SYN 鍖ood: difficult: compare to tickets at butcher Huge amount of bandwidth: impossible: 100000 cars on road built for 100 cars (only option: remove roadsigns)
Frank Louwers - Security challenges in a hosting environment - 20131024 Protection by external 鍖rms Good ones: very very very expensive (but they work!) Cheaper ones: no unlimited protection 2013: large number of new cheap players Some of them Russian and very cheap Would you pay the attacker to block the attack?
Frank Louwers - Security challenges in a hosting environment - 20131024 Conclusion: the new normal DDoS attacks are here to stay Invest in tools to detect the attack Invest in procedures: know how to respond Get to know the external players Insurance? Some insurance companies cover this
Frank Louwers - Security challenges in a hosting environment - 20131024 About that 鍖rewall... Or why your 鍖rewall isnt going to help much (in a hosting environment)
Frank Louwers - Security challenges in a hosting environment - 20131024 Traditional big 鍖rewall is useless Will not protect you against 99.5% of break-ins we see Bad code in CMS/Websites (> 98%) Stolen credentials (caused by spyware) Infected customer computers used as launchplatform Not 鍖exible enough (Cloud, scaling, ...) Unmaintainable, unupgradeable
Frank Louwers - Security challenges in a hosting environment - 20131024 We are under attack... All the time Every server Impossible to 鍖lter signal out of the noise Or at least very difficult
Frank Louwers - Security challenges in a hosting environment - 20131024 So what does work? The Onion Model
Frank Louwers - Security challenges in a hosting environment - 20131024 Onion model Maintained website (ask for maintenance contract) written in the right mindset (we will be attacked) Small, efficient host-鍖rewalls Try to detect anomalies Force secure credentials or 2-Factor Authentication Make customers aware of the problems, teach them ... Know what happens on the network
Frank Louwers - Security challenges in a hosting environment - 20131024 ... and automate Human factor weakest link so take away human factor where possible Automate con鍖guration management: Less mistakes Quickly apply 鍖x to large # of servers
Frank Louwers - Security challenges in a hosting environment - 20131024 Hosting providers and the law
Frank Louwers - Security challenges in a hosting environment - 20131024 Which laws?
Frank Louwers - Security challenges in a hosting environment - 20131024 Which laws apply? ≒Laws of country where the server is located, applies ≒Laws of country where company HQ are, applies But thats not always the case!
Frank Louwers - Security challenges in a hosting environment - 20131024 Servers in Europe, US laws Amazon Ireland, Microsoft Azure Europe, Rackspace UK Are all American companies, or controlled by US entity So they must follow US law! PATRIOT Act (so FBI can get a copy of your data without a warrant)
Frank Louwers - Security challenges in a hosting environment - 20131024 Networks Almost all of the big networks are American So assume they can read everything you put on the wire So use good encryption or VPN links AMS-IX wanted to open US branch huge concerns by members!
Frank Louwers - Security challenges in a hosting environment - 20131024 Snowden and the NSA It has become clear the the NSA has access to a lot of data why is there no real outrage? Do we really think this is normal? Do we accept this?
Frank Louwers - Security challenges in a hosting environment - 20131024 Laws that change everything Last proposal for Internet tap: coffee-bar next door that offers free WiFi forced to buy 25 000 tap box to allow police to tap the public network
Frank Louwers - Security challenges in a hosting environment - 20131024 Laws that change everything Data-retention law: Vague, details (= entire law) to be 鍖lled in by RD Clearly targeted at the small 鍖sh Real criminal rents 30 euro dedicated service, no logs
Frank Louwers - Security challenges in a hosting environment - 20131024 Laws that change everything A lot of Notice and Take Down proposals: requires us as a hoster, to be a judge. We are not judges, and dont want to be! Changes the intent of the current law completely! ≒mere conduit vs judge

More Related Content

BISC 2013: Hosting and security

  • 1. Frank Louwers - Security challenges in a hosting environment - 20131024 Frank Louwers Openminds bvba Co-founder en COO Managed Hosting frank@openminds.be
  • 2. Frank Louwers - Security challenges in a hosting environment - 20131024 DDoS and how they changed
  • 3. Frank Louwers - Security challenges in a hosting environment - 20131024 (D)DoS attacks are not new Used to be targeted at: Competing game clans IRC servers Political parties
  • 4. Frank Louwers - Security challenges in a hosting environment - 20131024 DDoS attack shift ≒Occupy movement: a lot of attacks on banks Political parties ≒companies and organisations with negative press (Monsanto, Press-agency of the Belgian Catholic Church, ...)
  • 5. Frank Louwers - Security challenges in a hosting environment - 20131024 Attacks we cant explain Radio Stations?! Software development companies B2B online shops?
  • 6. Frank Louwers - Security challenges in a hosting environment - 20131024 DDoS attacks: new tricks Ampli鍖cation attacks: attacker sends 2 Mbps stream, gets multiplied by 20, results in 40 Mbps attack Now multiply by 100 bots, so 4Gbps attack Bad con鍖gured DNS servers DNSSec increases the problem
  • 7. Frank Louwers - Security challenges in a hosting environment - 20131024 Protect against DDoS attacks UDP: yes, can be blocked by decent routers SYN 鍖ood: difficult: compare to tickets at butcher Huge amount of bandwidth: impossible: 100000 cars on road built for 100 cars (only option: remove roadsigns)
  • 8. Frank Louwers - Security challenges in a hosting environment - 20131024 Protection by external 鍖rms Good ones: very very very expensive (but they work!) Cheaper ones: no unlimited protection 2013: large number of new cheap players Some of them Russian and very cheap Would you pay the attacker to block the attack?
  • 9. Frank Louwers - Security challenges in a hosting environment - 20131024 Conclusion: the new normal DDoS attacks are here to stay Invest in tools to detect the attack Invest in procedures: know how to respond Get to know the external players Insurance? Some insurance companies cover this
  • 10. Frank Louwers - Security challenges in a hosting environment - 20131024 About that 鍖rewall... Or why your 鍖rewall isnt going to help much (in a hosting environment)
  • 11. Frank Louwers - Security challenges in a hosting environment - 20131024 Traditional big 鍖rewall is useless Will not protect you against 99.5% of break-ins we see Bad code in CMS/Websites (> 98%) Stolen credentials (caused by spyware) Infected customer computers used as launchplatform Not 鍖exible enough (Cloud, scaling, ...) Unmaintainable, unupgradeable
  • 12. Frank Louwers - Security challenges in a hosting environment - 20131024 We are under attack... All the time Every server Impossible to 鍖lter signal out of the noise Or at least very difficult
  • 13. Frank Louwers - Security challenges in a hosting environment - 20131024 So what does work? The Onion Model
  • 14. Frank Louwers - Security challenges in a hosting environment - 20131024 Onion model Maintained website (ask for maintenance contract) written in the right mindset (we will be attacked) Small, efficient host-鍖rewalls Try to detect anomalies Force secure credentials or 2-Factor Authentication Make customers aware of the problems, teach them ... Know what happens on the network
  • 15. Frank Louwers - Security challenges in a hosting environment - 20131024 ... and automate Human factor weakest link so take away human factor where possible Automate con鍖guration management: Less mistakes Quickly apply 鍖x to large # of servers
  • 16. Frank Louwers - Security challenges in a hosting environment - 20131024 Hosting providers and the law
  • 17. Frank Louwers - Security challenges in a hosting environment - 20131024 Which laws?
  • 18. Frank Louwers - Security challenges in a hosting environment - 20131024 Which laws apply? ≒Laws of country where the server is located, applies ≒Laws of country where company HQ are, applies But thats not always the case!
  • 19. Frank Louwers - Security challenges in a hosting environment - 20131024 Servers in Europe, US laws Amazon Ireland, Microsoft Azure Europe, Rackspace UK Are all American companies, or controlled by US entity So they must follow US law! PATRIOT Act (so FBI can get a copy of your data without a warrant)
  • 20. Frank Louwers - Security challenges in a hosting environment - 20131024 Networks Almost all of the big networks are American So assume they can read everything you put on the wire So use good encryption or VPN links AMS-IX wanted to open US branch huge concerns by members!
  • 21. Frank Louwers - Security challenges in a hosting environment - 20131024 Snowden and the NSA It has become clear the the NSA has access to a lot of data why is there no real outrage? Do we really think this is normal? Do we accept this?
  • 22. Frank Louwers - Security challenges in a hosting environment - 20131024 Laws that change everything Last proposal for Internet tap: coffee-bar next door that offers free WiFi forced to buy 25 000 tap box to allow police to tap the public network
  • 23. Frank Louwers - Security challenges in a hosting environment - 20131024 Laws that change everything Data-retention law: Vague, details (= entire law) to be 鍖lled in by RD Clearly targeted at the small 鍖sh Real criminal rents 30 euro dedicated service, no logs
  • 24. Frank Louwers - Security challenges in a hosting environment - 20131024 Laws that change everything A lot of Notice and Take Down proposals: requires us as a hoster, to be a judge. We are not judges, and dont want to be! Changes the intent of the current law completely! ≒mere conduit vs judge