bullet -proofing your internet applications 2019...defining security threats 1 - ddos attacks 2 -...
TRANSCRIPT
Bullet-proofing your Internet applications against the evolving threatsChris Wang | Cloudflare @chriswang_tech
If you use the Internet, you already use Cloudflare
#cloudsec
Cloudflare's global anycast network
8.7MHTTP request s / second
on average
19M+Internet properties
30Tbps network capacity
180+cities
#cloudsec
In case you haven't heard about Cloudflare...
#cloudsec
Cloudflare solves today’s Internet challenges
DNS Anycast net work
Load balancing
Always online
CDN Web opt im izat ion
Mobile opt im izat ion
WAN opt im izat ion
Rat elim it ing
WAF
SSLDDoS Threatanalyt ics
Ent erpr iselogs
Appsplat form
Traf f icm onit or ing
PLATFORM
Workers Access St ream Mobile SDK
#cloudsec
Defining security threats
1 - DDoS attacks2 - Web application attacks
Defense against DDoS requires scalable solutions
#cloudsec
DDoS aims to make your internet service unavailable
Up to 600,000 devices (Mirai 2016)
#cloudsec
DDoS attacks are getting more "affordable"
#cloudsec
300Gbps // Volumetric Layer 3/4
400Gbps // NTP Reflection
1Tbps // IoT Botnet Layer 7 Attack
1.7 Tbps // Memcached reflection/amplification Attack
DDoS attacks are getting larger
#cloudsec
Telegram
Source: https://twitter.com/durov/status/1138942773430804480
#cloudsec
Put numbers in scale 25Tb
20Tb
15Tb
10Tb
5Tb
30 TbpsCloudflare
Network Capacity
942 Gbps Largest DDoS attack
mitigated by Cloudflare
#cloudsec
"Always-On" = No slow ing down
Industry Legacy Scrubbing- Long propagation times (up to 300 sec)- Adds significant latency- Typically requires manual intervention
Always-On- Zero propagation time- No added latency- Immediate, automated mitigation,
with no “cut over” required
Defense against web application attacks require fast
actions on large dataset
#cloudsec
Web app attacks aim to gain unauthorized access by exploiting vulnerabilities in web apps
Source: OWASP Top 10 - 2017 The Ten Most Critical Web Application Security Risks
#cloudsecSource: https://haveibeenpwned.com/
#cloudsec
Web app attacks still follow the old cycles
#4 Fixes / patches deployed by the user
#3 Fixes / patches issued by vendor #2 Exploit attempts by attackers
#1 Discovery of a new vulnerability (0-day)
#cloudsec
WAF "as a service" means faster response to new vulnerabilities
#4 Fixes / patches deployed by the user
#3 Fixes / patches issued by vendor #2 Exploit attempts by attackers
#1 Discovery of a new vulnerability (0-day)
#cloudsec
Stopping CVE-2019-0604 (1/2)2019-05-11 9:33AM: CVE-2019-0604, a Remote Code Execution vulnerability in Microsoft SharePoint Servers which was not previously known to be exploitable via the web. CVSS v3 rating = 8.8
2019-05-11 2:45PM: Cloudflare internal vulnerability score = 9.8Cloudflare WAF Rule 100157 deployed in Log mode
2019-05-11 4:47PM: First probes observed by Cloudflare. Believed to be reconnaissance probes.
Timestamps in UTC; Source: https://blog.cloudflare.com/stopping-cve-2019-0604/
#cloudsec
Stopping CVE-2019-0604 (2/2)
2019-05-13 2:13PM: Cloudflare WAF Rule 100157 deployed in Block mode
2019-05-16: UK’s NCSC's alert of highly successful exploitation attempts against UK organisations. On the same day, ~7000 malicious requests blocked by Cloudflare WAF Rule 100157
Responding to the ever-evolving threat landscape
Some best practices we find useful ....
#cloudsec
Choose a DDoS solution that's scalable, always-on & cost-effective
Ensure it doesn't slow down your visitors (or make it even faster)
How to prepare against DDoS attacks
#cloudsec
Choose a cloud managed WAF with a large user base
Patch the applications (eventually)
How to prepare against web app attacks
#cloudsec
Lucky Draw Main stage 4:50-5:00pm
Remember visit usat booth 黄2!
THANK YOU