You can beat service denial attacks

By Shawn McCarthy

Connecting state and local government leaders

| August 9, 2001

It's not easy to defend a government Web server against distributed service denial attacks, but it's not impossible either.

Many firewalls can be configured to act as packet-filtering routers, which means they strip out bad packets and still let legitimate traffic through. But by the time the bad traffic reaches the firewall, it's already clogging the Internet connection.Both types of intrusion detection systems can be configured to look for specific data signatures or anomalies. They don't react directly to the intrusion, but they can trigger separate filtering systems. One disadvantage is that they, like PC antivirus software, must constantly be updated with suspect data signatures.Firewalls and intrusion detection systems are reactive measures. They won't stop an attack, and they can shut only part of it down.Bad traffic can be shut down at two points:Managers with such systems can set thresholds and policies for various triggers, as well as alerts and filters for bad traffic.The best overall bet is a multilevel approach:

It's not easy to defend a government Web server against distributed service denial attacks, but it's not impossible either.

For years now, governments have been under the gun in an undeclared cyberwar with hackers around the globe. The simplest and so far the most common attack is denial of service, which keeps a server so busy with fake data traffic that it can't do its real job.

A distributed denial-of-service attack pits multiple computers across the Internet against a single target server. Most serious attacks today orchestrate the use of hundreds of machines and take the target server out of commission for the duration of the attack.

Many agencies have installed two types of defenses:

A firewall where the agency LAN connects to an Internet service provider or other network access point. A firewall can keep hackers out, but it's not good at stopping a distributed service denial attack.

A network-based intrusion detection system. An IDS is generally set to so-called promiscuous mode so it can see all passing data. It can log improper data or trigger an alarm. A host-based IDS is similar, but set to monitor a single service on a host.

The most effective roadblock is to work with the Internet provider to filter out the flow of bad data, based on analysis of the arriving packets. This is time-consuming but worthwhile because it keeps the network free of unwanted traffic.

A quicker but less effective method is to install a traffic-limiting intrusion detection system that looks for unusual or anomalous traffic. It takes advantage of a feature in TCP/IP to confirm whether traffic comes from a nonspoofed source.

A filtering and traffic-limiting device at the agency firewall will limit inbound service-denial traffic. If it does egress filtering, it can prevent agency servers from being used in an attack.

A similar setup at the highest bandwidth point will do even more. Large government networks have a slight advantage here because they don't have to count on commercial providers to install such devices.

Finally, having two or more gateways will make the agency's network redundant and therefore harder to shut down.

Shawn P. McCarthy designs products for a Web search engine provider. E-mail him at smccarthy@lycos-inc.com.

NEXT STORY: Pentium 4 or Athlon?

This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. / Do Not Sell My Personal Information

Accept Cookies