For more info on a specific newsletter, click the title. Details will be displayed in a new window.
Subscribe to
Computerworld 40 years of the most authoritative source of news and information for IT leaders.
Mydoom lesson: Take proactive steps to prevent DDoS attacks
or
Other Spam, Malware and Vulnerabilities Stories
|
|
|
|
February 06, 2004 (Computerworld) -- Dealing with a distributed denial-of-service attack such as the one that took down The SCO Group Inc.'s Web site this week continues to be a major challenge for companies, security experts said.
But several options are available to at least help alleviate the pain for those that become targets.
A DDoS attack typically involves thousands of compromised "zombie" systems sending torrents of useless data or requests for data to targeted servers or networks.
The SCO attack, for instance, was launched using systems that had previously been infected by the Mydoom virus (see story). The virus contained code that instructed thousands of infected computers to access SCO's Web site at the same time, rendering it inaccessible to legitimate users.
Stopping the flood of traffic can be very difficult because it's coming from so many sources, said Bruce Schneier, president of Counterpane Internet Security Inc. in Mountain View, Calif.
"From a philosophical perspective, if the attacker's pipe is bigger than the defender's pipe, the attacker can always knock out the defender," said Schneier.
There are several approaches companies can take to prepare for attacks such as this, said Paul Mockapetris, inventor of the Internet's core Domain Name System and chairman of IP address management vendor Nominum Inc. in Redwood City, Calif. One is to set aside extra network bandwidth and server processing capacity to withstand sudden surges in traffic, he said. Another is to "retreat from your domain name" and essentially park your Web site at another address while the attack plays out.
Geographically distributing Web servers is another approach worth considering, Schneier said. That way, even if one server or network segment is taken down by an attack, normal traffic can be redirected to other servers.
But putting in place extra server processing capacity to handle DDoS attacks can be expensive and is likely to make sense only for larger companies, Mockapetris said. "There's a bit of a digital divide when it comes to the ability of companies to defend themselves against these attacks," he said.
"The long-term answer to DDoS protection has to be in the [service provider] networks and backbones," said John Pescatore, an analyst at Stamford, Conn.-based Gartner Inc. That's because upstream service providers are in a better position to detect and choke off traffic directed at a specific IP address, said Schneier.
As a result, it's a good idea to require service providers to offer some sort of guarantee against DDoS attacks, said Schneier. Gartner has in fact been advocating this for more than two years, urging users to include DDoS protection language in their service-level agreements with Internet service providers and data center hosting companies.
But less than 1% of companies overall are buying such services, Pescatore said. "Most enterprises say, 'It isn't raining, so the roof isn't leaking. Why fix it?' " he said.
|
Print this Story |
|
Send Us Feedback |
|
E-mail this Story |
|
Digg this Story |
|
Slashdot this Story |
|
|
|
|
|
 |
|
All Zones Application Performance Zone Business Continuity Zone Data Center Management Zone Enterprise-Class Security Zone The File Data Management Zone Grid Computing on Windows Zone Security Management Zone ITIL Best Practices Zone The SAS Zone Storage Virtualization Zone Business Intelligence and Analytics Zone |
 See your link here
|
 |
||||||||
| ||||||||
| ||||||||
| ||||||||
|
Why SaaS is Vital to Email and Web Security
Download this white paper now, compliments of Computerworld and Absolute Software.
Get this white paper now!
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
- Microsoft promises four patches next week
- Google gives away home-cooked Web application security scanner
- Expect iPhone, Fourth of July scams, security firm says
- More top stories
| XenServer FREE trial Citrix XenServer is the simplest and most effective way to virtualize and provision servers. XenServer combines comprehensive server virtualization capabilities with unparalleled scalability, performance, economics, and ease-of-use. Based on the open source Xen hypervisor, XenServer delivers fast performance, easy management, and advanced features such as live migration. |
| Try Fluke Networks'
EtherScope Analyzer on your network FREE Quickly solve the wide range of problems you encounter - 10, 100 and Gigabit, twisted pair and optical fiber, LAN or wireless LAN. The EtherScope Analyzer combines the essential tools you need to monitor network traffic and switch interfaces, discover devices, networks, VLANs, access points, mobile clients and more. See the power of this portable network analyzer on your network. Request free trial now
*Terms and conditions: Evaluation units are available only for a limited time and will be scheduled on a first-come first-served basis. Not available in all geographies. Limited quantities available; customers requesting evaluation units may be waitlisted for the next available unit. It will be at the discretion of Fluke Networks to accept or decline requests for this free evaluation. |
CIO
Computerworld
CSO
DEMO
GamePro
Games.net
IDG Connect
IDG World Expo
Infoworld
The Industry Standard
ITworld
JavaWorld
LinuxWorld
MacUser
Macworld
Network World
PC World
Playlist
Copyright © 2008 Computerworld Inc. All
rights reserved. Reproduction in whole or in part in any form or medium
without express written permission of Computerworld Inc. is prohibited.
Computerworld and Computerworld.com and the respective logos are
trademarks of International Data Group Inc.
|
