Radware Releases Global Security Report - Reveals New Cyber Attack Methods Uncovering Blind-Spots Unrecognized by Security Professionals and Organizations
Poster: SySAdmin
Posted on January 22, 2013 at 5:35:01 AM
Radware Releases Global Security Report - Reveals New Cyber Attack Methods Uncovering Blind-Spots Unrecognized by Security Professionals and Organizations
Server-based botnets and HTTPS layer attacks among the tactics leveraged by hackers in some of 2012's most notorious attacks
MAHWAH, New Jersey, January 22, 2013 /PRNewswire/ --
In the face of an ever-evolving cyber security landscape, researchers at Radware
[http://www.radware.com ](R) (NASDAQ: RDWR), a leading provider of application delivery
and application security solutions for virtual and cloud data centers, have identified a
number of new attack methods representative of today's increasingly sophisticated and
severe distributed-denial-of-service (DDoS
[http://security.radware.com/knowledge-center/DDoSPedia/ddos-attack ]) threat. Radware's
2012 Global Application and Network Security Report highlights server-based botnets
[http://security.radware.com/knowledge-center/DDoSPedia/botnet ] and encrypted layer
attacks as just two of the new attack tools challenging organizations during DDoS attacks.
Most recently, these tactics were leveraged by perpetrators in the attacks against U.S.
financial institutions
[http://blog.radware.com/security/2013/01/us-bank-attacks-in-review-its-a-brave-new-world ]
that have been ongoing since September 2012.
Prepared by Radware's Emergency Response Team (ERT) which actively monitors and
mitigates attacks in real-time, the in-depth research report also found that while
security organizations have focused their efforts and attention on the pre and post-phases
of defense, attackers now launch prolonged attacks that last days or weeks. This has
created a vulnerable blind-spot as defenders lack the capabilities and resources to
mitigate attacks in the "during" phase which attackers can exploit to their advantage.
"The Radware ERT sees hundreds of DoS/DDoS attacks each year, and we've found attacks
lasting more than one week have doubled in frequency during 2012," says Avi Chesla, chief
technology officer at Radware. Through empirical and statistical research coupled with
front-line experience, our team identified trends that can help educate the security
community.
"Through highlighting significant trends found in this report, our goal is to provide
actionable intelligence to ensure organizations can better detect and mitigate these
threats that plague their network infrastructure," adds Chesla.
Key findings from the report include:
- Server-based botnets represent a new and more powerful order in the DDoS
environment. The shift from single-server attacks to the use of multiple servers in
different geographic locations has allowed attackers to quickly and effectively launch
more powerful DDoS attacks than ever before. Just a few attacking servers can produce
the same attack traffic as a large number of client botnets, with the 24/7
availability of servers allowing for greater reliability as well as
command-and-control. In 2013, Radware expects this method to gain in popularity,
requiring that organizations make sure their defense architecture can withstand these
scaled up attacks. Although effective, several weak points are uncovered and
identified.
- The number of DDoS and DoS attacks lasting more than one week doubled in 2012.
Radware's ERT developed the Advanced Persistent Threat (APT) score to quantify and
qualify the increasing force, sophistical and persistence of 2012's attacks. The
numbers are staggering - with 58 percent of attacks scoring a 7 or higher in
complexity (out of 10), as compared to just 23 percent of attacks in 2011. In 2011,
only 30% of attacks scored higher than a level of 3 in terms of severity, while in
2012 70% achieved a level of 3 or higher.
- Encrypted layer attacks fly below the radar - and can't be ignored. In 2012,
the growing popularity of HTTPS-based attacks added a new dimension to the security
landscape. Though conventionally associated with security on the web, hackers have
managed to weaponize the encryption layer, using it to launch application-level and
SSL attacks that can escape detection and remain hidden until its already too late.
This has become an especially troubling phenomenon for financial services and
e-commerce websites that rely heavily on HTTPS.
- In today's security environment, most organizations are bringing a knife to a
gunfight. With some of the worlds largest institutions victimized by cyber attacks in
2012, the question remains as to why many of these organizations continue to be
vulnerable. The fact remains that less than a quarter of all organizations surveyed
invest their efforts in mitigating attacks as they're happening - a fact exploited by
hackers. In 2013, Radware recommends that organizations dedicate resources to creating
a "security war room" equipped to dynamically respond to and handle persistent
security attacks during all phases of an attack and adopt a three-phased security
approach.
- The 'DIY' phenomenon. The proliferation of 'do-it-yourself' sites devoted to
enabling hacking schemes has reached commodity market proportions. The supply chain
includes took kits and for-hire services that are available to anyone with minimal
coding or advanced hacking skills for as little as $10 for a ransomware attack tool.
This has significantly reduced the barrier of entry for individuals or organizations
to launch an attack.
The report which doubles as a resource guide that security professionals can easily
reference also features recommendations that organizations can adopt to safeguard
themselves against emerging attack trends and techniques. Chief among these
recommendations are:
- How to Stop Sophisticated Attack Campaigns. Organizations usually
administer a two-phase "pre and post" attack security approach as their defense
strategy. Sophisticated campaigns can only be eradicated by setting a third-phase
security approach during the attack. A cadre of external "on-demand" force multiplier
teams who can dynamically respond and employ tactics to mitigate future attacks needs
to be implemented by an organization. A typical, persistent DDoS attack requires no
less than 9 security engineers for sufficient defense.
- Examination Lines of Defense. Mitigation may have improved, but this has also
pushed attackers to invest in finding the weak links in lines of defense.
Organizations should ensure that their line of defense is comprehensive. As part of
this, a mitigation checklist must be completed, with any missing elements in to be
addressed.
- Carefully Consider Network Architecture. To be effective, a DoS / DDoS
mitigation solution must be placed before most of the network elements in the path,
which is not the traditional deployment. Additionally, if a content delivery network
(CDN) is the primary DDoS mitigation solution, ensure you complement it with a
customer premise equipment (CPE) solution for optimal protection.
To download the complete 2012 Global Network & Application Security Report, which
includes the ERT's recommendations for how organizations can best prepare for mitigating
cyber threats in 2013, please visit http://www.radware.com/globalsecurityreport
Additional Resources
ERT Video: Matthew Andriani, ERT Specialist discusses APT Scoring
[http://youtu.be/L8tfWlPbRzg ] (http://youtu.be/L8tfWlPbRzg)
ERT Video: Ziv Gadot, ERT Team Leader discusses how to stop sophisticated attack
campaigns [http://youtu.be/y0i5yQ_rJUY ] (http://youtu.be/y0i5yQ_rJUY)
Slideshare Presentation:
http://www.slideshare.net/Radware/2012-global-application-and
Blog: http://blog.radware.com/security
About the Radware Emergency Response Team (ERT)
Radware's ERT is a group of dedicated security consultants who are available around
the clock. As literal "first responders" to cyber attacks, Radware's ERT members gained
their extensive experience by successfully dealing with some of the industry's most
notable hacking episodes, providing the knowledge and expertise to mitigate the kind of
attack a business's security team may never have handled. Through the report, the ERT
reveals how their in-the-trenches experiences fighting cyber attacks provide deeper
forensic analysis than surveys alone or academic research.
About the 2012 Global Network & Application Security Report
Radware's annual Global Application & Network Security Report provides insight into
network security trends with a specific focus on DoS/DDoS attacks. Intended for the entire
security community, this research is designed to deliver a comprehensive and objective
summary of network security events and DoS / DDoS attacks that took place in 2012, with an
analysis of attack types, trends and mitigation technologies. Altogether, the report draws
its information from 274 organizations from two sources: Radware's Industry Security
Review and key security cases from Radware's Emergency Response Team.
About Radware
Radware [http://www.radware.com ] (NASDAQ: RDWR), is a global leader of application
delivery [http://www.radware.com/Products/ApplicationDelivery/default.aspx ] and
application security
[http://www.radware.com/Products/ApplicationNetworkSecurity/default.aspx ] solutions for
virtual and cloud data centers. Its award-winning solutions portfolio delivers full
resilience for business-critical applications, maximum IT efficiency, and complete
business agility.
Radware's solutions empower more than 10,000 enterprise and carrier customers
worldwide to adapt to market challenges quickly, maintain business continuity and achieve
maximum productivity while keeping costs down. For more information, please visit
http://www.radware.com.
Radware encourages you to join our community and follow us on; LinkedIn
[http://www.linkedin.com/company/165642 ], Radware Blog [http://blog.radware.com ],
Twitter [http://twitter.com/#!/radware ], YouTube [http://www.youtube.com/radwareinc ],
Radware Connect [http://itunes.apple.com/us/app/radware-connect/id391124100?mt=8 ] app for
iPhone(R) and our new security center DDoSWarriors.com [http://security.radware.com ] that
provides a comprehensive analysis on DDoS attack tools, trends and threats.
(c)2013 Radware, Ltd. All rights reserved. Radware and all other Radware product and
service names are registered trademarks or trademarks of Radware in the U.S. and other
countries. All other trademarks and names are property of their respective owners.
This press release may contain statements concerning Radware's future prospects that
are "forward-looking statements" under the Private Securities Litigation Reform Act of
1995. Statements preceded by, followed by, or that otherwise include the words "believes",
"expects", "anticipates", "intends", "estimates", "plans", and similar expressions or
future or conditional verbs such as "will", "should", "would", "may" and "could" are
generally forward-looking in nature and not historical facts. These statements are based
on current expectations and projections that involve a number of risks and uncertainties.
There can be no assurance that future results will be achieved, and actual results could
differ materially from forecasts and estimates. These risks and uncertainties, as well as
others, are discussed in greater detail in Radware's Annual Report on Form 20-F and
Radware's other filings with the Securities and Exchange Commission. Forward-looking
statements speak only as of the date on which they are made and Radware undertakes no
commitment to revise or update any forward-looking statement in order to reflect events or
circumstances after the date any such statement is made. Radware's public filings are
available from the Securities and Exchange Commission's website at http://www.sec.gov
or may be obtained on Radware's website at http://www.radware.com.
Corporate Media Relations:
Brian T. Gallagher
+1-201-785-3206 (office)
+1-201-574-3840 (cell)
briang@radware.com
Radware Ltd
Server-based botnets and HTTPS layer attacks among the tactics leveraged by hackers in some of 2012's most notorious attacks
MAHWAH, New Jersey, January 22, 2013 /PRNewswire/ --
In the face of an ever-evolving cyber security landscape, researchers at Radware
[http://www.radware.com ](R) (NASDAQ: RDWR), a leading provider of application delivery
and application security solutions for virtual and cloud data centers, have identified a
number of new attack methods representative of today's increasingly sophisticated and
severe distributed-denial-of-service (DDoS
[http://security.radware.com/knowledge-center/DDoSPedia/ddos-attack ]) threat. Radware's
2012 Global Application and Network Security Report highlights server-based botnets
[http://security.radware.com/knowledge-center/DDoSPedia/botnet ] and encrypted layer
attacks as just two of the new attack tools challenging organizations during DDoS attacks.
Most recently, these tactics were leveraged by perpetrators in the attacks against U.S.
financial institutions
[http://blog.radware.com/security/2013/01/us-bank-attacks-in-review-its-a-brave-new-world ]
that have been ongoing since September 2012.
Prepared by Radware's Emergency Response Team (ERT) which actively monitors and
mitigates attacks in real-time, the in-depth research report also found that while
security organizations have focused their efforts and attention on the pre and post-phases
of defense, attackers now launch prolonged attacks that last days or weeks. This has
created a vulnerable blind-spot as defenders lack the capabilities and resources to
mitigate attacks in the "during" phase which attackers can exploit to their advantage.
"The Radware ERT sees hundreds of DoS/DDoS attacks each year, and we've found attacks
lasting more than one week have doubled in frequency during 2012," says Avi Chesla, chief
technology officer at Radware. Through empirical and statistical research coupled with
front-line experience, our team identified trends that can help educate the security
community.
"Through highlighting significant trends found in this report, our goal is to provide
actionable intelligence to ensure organizations can better detect and mitigate these
threats that plague their network infrastructure," adds Chesla.
Key findings from the report include:
- Server-based botnets represent a new and more powerful order in the DDoS
environment. The shift from single-server attacks to the use of multiple servers in
different geographic locations has allowed attackers to quickly and effectively launch
more powerful DDoS attacks than ever before. Just a few attacking servers can produce
the same attack traffic as a large number of client botnets, with the 24/7
availability of servers allowing for greater reliability as well as
command-and-control. In 2013, Radware expects this method to gain in popularity,
requiring that organizations make sure their defense architecture can withstand these
scaled up attacks. Although effective, several weak points are uncovered and
identified.
- The number of DDoS and DoS attacks lasting more than one week doubled in 2012.
Radware's ERT developed the Advanced Persistent Threat (APT) score to quantify and
qualify the increasing force, sophistical and persistence of 2012's attacks. The
numbers are staggering - with 58 percent of attacks scoring a 7 or higher in
complexity (out of 10), as compared to just 23 percent of attacks in 2011. In 2011,
only 30% of attacks scored higher than a level of 3 in terms of severity, while in
2012 70% achieved a level of 3 or higher.
- Encrypted layer attacks fly below the radar - and can't be ignored. In 2012,
the growing popularity of HTTPS-based attacks added a new dimension to the security
landscape. Though conventionally associated with security on the web, hackers have
managed to weaponize the encryption layer, using it to launch application-level and
SSL attacks that can escape detection and remain hidden until its already too late.
This has become an especially troubling phenomenon for financial services and
e-commerce websites that rely heavily on HTTPS.
- In today's security environment, most organizations are bringing a knife to a
gunfight. With some of the worlds largest institutions victimized by cyber attacks in
2012, the question remains as to why many of these organizations continue to be
vulnerable. The fact remains that less than a quarter of all organizations surveyed
invest their efforts in mitigating attacks as they're happening - a fact exploited by
hackers. In 2013, Radware recommends that organizations dedicate resources to creating
a "security war room" equipped to dynamically respond to and handle persistent
security attacks during all phases of an attack and adopt a three-phased security
approach.
- The 'DIY' phenomenon. The proliferation of 'do-it-yourself' sites devoted to
enabling hacking schemes has reached commodity market proportions. The supply chain
includes took kits and for-hire services that are available to anyone with minimal
coding or advanced hacking skills for as little as $10 for a ransomware attack tool.
This has significantly reduced the barrier of entry for individuals or organizations
to launch an attack.
The report which doubles as a resource guide that security professionals can easily
reference also features recommendations that organizations can adopt to safeguard
themselves against emerging attack trends and techniques. Chief among these
recommendations are:
- How to Stop Sophisticated Attack Campaigns. Organizations usually
administer a two-phase "pre and post" attack security approach as their defense
strategy. Sophisticated campaigns can only be eradicated by setting a third-phase
security approach during the attack. A cadre of external "on-demand" force multiplier
teams who can dynamically respond and employ tactics to mitigate future attacks needs
to be implemented by an organization. A typical, persistent DDoS attack requires no
less than 9 security engineers for sufficient defense.
- Examination Lines of Defense. Mitigation may have improved, but this has also
pushed attackers to invest in finding the weak links in lines of defense.
Organizations should ensure that their line of defense is comprehensive. As part of
this, a mitigation checklist must be completed, with any missing elements in to be
addressed.
- Carefully Consider Network Architecture. To be effective, a DoS / DDoS
mitigation solution must be placed before most of the network elements in the path,
which is not the traditional deployment. Additionally, if a content delivery network
(CDN) is the primary DDoS mitigation solution, ensure you complement it with a
customer premise equipment (CPE) solution for optimal protection.
To download the complete 2012 Global Network & Application Security Report, which
includes the ERT's recommendations for how organizations can best prepare for mitigating
cyber threats in 2013, please visit http://www.radware.com/globalsecurityreport
Additional Resources
ERT Video: Matthew Andriani, ERT Specialist discusses APT Scoring
[http://youtu.be/L8tfWlPbRzg ] (http://youtu.be/L8tfWlPbRzg)
ERT Video: Ziv Gadot, ERT Team Leader discusses how to stop sophisticated attack
campaigns [http://youtu.be/y0i5yQ_rJUY ] (http://youtu.be/y0i5yQ_rJUY)
Slideshare Presentation:
http://www.slideshare.net/Radware/2012-global-application-and
Blog: http://blog.radware.com/security
About the Radware Emergency Response Team (ERT)
Radware's ERT is a group of dedicated security consultants who are available around
the clock. As literal "first responders" to cyber attacks, Radware's ERT members gained
their extensive experience by successfully dealing with some of the industry's most
notable hacking episodes, providing the knowledge and expertise to mitigate the kind of
attack a business's security team may never have handled. Through the report, the ERT
reveals how their in-the-trenches experiences fighting cyber attacks provide deeper
forensic analysis than surveys alone or academic research.
About the 2012 Global Network & Application Security Report
Radware's annual Global Application & Network Security Report provides insight into
network security trends with a specific focus on DoS/DDoS attacks. Intended for the entire
security community, this research is designed to deliver a comprehensive and objective
summary of network security events and DoS / DDoS attacks that took place in 2012, with an
analysis of attack types, trends and mitigation technologies. Altogether, the report draws
its information from 274 organizations from two sources: Radware's Industry Security
Review and key security cases from Radware's Emergency Response Team.
About Radware
Radware [http://www.radware.com ] (NASDAQ: RDWR), is a global leader of application
delivery [http://www.radware.com/Products/ApplicationDelivery/default.aspx ] and
application security
[http://www.radware.com/Products/ApplicationNetworkSecurity/default.aspx ] solutions for
virtual and cloud data centers. Its award-winning solutions portfolio delivers full
resilience for business-critical applications, maximum IT efficiency, and complete
business agility.
Radware's solutions empower more than 10,000 enterprise and carrier customers
worldwide to adapt to market challenges quickly, maintain business continuity and achieve
maximum productivity while keeping costs down. For more information, please visit
http://www.radware.com.
Radware encourages you to join our community and follow us on; LinkedIn
[http://www.linkedin.com/company/165642 ], Radware Blog [http://blog.radware.com ],
Twitter [http://twitter.com/#!/radware ], YouTube [http://www.youtube.com/radwareinc ],
Radware Connect [http://itunes.apple.com/us/app/radware-connect/id391124100?mt=8 ] app for
iPhone(R) and our new security center DDoSWarriors.com [http://security.radware.com ] that
provides a comprehensive analysis on DDoS attack tools, trends and threats.
(c)2013 Radware, Ltd. All rights reserved. Radware and all other Radware product and
service names are registered trademarks or trademarks of Radware in the U.S. and other
countries. All other trademarks and names are property of their respective owners.
This press release may contain statements concerning Radware's future prospects that
are "forward-looking statements" under the Private Securities Litigation Reform Act of
1995. Statements preceded by, followed by, or that otherwise include the words "believes",
"expects", "anticipates", "intends", "estimates", "plans", and similar expressions or
future or conditional verbs such as "will", "should", "would", "may" and "could" are
generally forward-looking in nature and not historical facts. These statements are based
on current expectations and projections that involve a number of risks and uncertainties.
There can be no assurance that future results will be achieved, and actual results could
differ materially from forecasts and estimates. These risks and uncertainties, as well as
others, are discussed in greater detail in Radware's Annual Report on Form 20-F and
Radware's other filings with the Securities and Exchange Commission. Forward-looking
statements speak only as of the date on which they are made and Radware undertakes no
commitment to revise or update any forward-looking statement in order to reflect events or
circumstances after the date any such statement is made. Radware's public filings are
available from the Securities and Exchange Commission's website at http://www.sec.gov
or may be obtained on Radware's website at http://www.radware.com.
Corporate Media Relations:
Brian T. Gallagher
+1-201-785-3206 (office)
+1-201-574-3840 (cell)
briang@radware.com
Radware Ltd