According to Bryan Hamman, territory manager for sub-Saharan Africa at NETSCOUT Arbor, which specialises in advanced Distributed Denial of Service (DDoS) protection solutions, encryption is a basic necessity in an organisation’s cyber security defence arsenal. “Encryption is the way in which plaintext or any other type of data is converted from a readable form to an encoded version that can only be decoded by another entity if they have access to a decryption key. Encryption is a tremendously important method for providing data security, especially for end-to-end protection of data transmitted across networks.

“For example, encryption allows banks to offer online banking and funds transfers, and protects the public’s online interactions when they use their credit or debit cards, or interact with any service provider for an online transaction that involves the exchange of information. Breaking web service encryption of such online data stores, which house confidential personal and financial data, is therefore a serious goal for cyber attackers, and, according to the most recent NETSCOUT Arbor WISR, attacks targeting encrypted web services in recent years are becoming more common. Using a DDoS attack is one method of carrying out such an assault on data.”

A DDoS attack is an attempt to make an online service unavailable by overwhelming it with traffic from multiple sources. In recent years, DDoS attacks have become a major cyber-security issue for CIOs and CSOs, as each year these attacks grow in number, becoming bigger and more damaging. Just a few months ago, NETSCOUT Arbor defences were able to foil – on behalf of its clients – two of the biggest DDoS attacks in history.

Hamman notes, “On 28 February, a 1.3Tbps DDoS attack was confirmed against developer platform GitHub, which was unavailable from 17:21 to 17:26 UTC, and intermittently unavailable from 17:26 to 17:30 UTC, due to the attack. However, no data was lost. This was then the most powerful DDoS attack recorded to date. Hot on its heels though, just days later in early March, an even larger attack of 1.7Tbps – a reflection/amplification attack – was targeted at a customer of an American-based service provider and recorded by the NETSCOUT Arbor ATLAS global traffic and DDoS threat data system. Again, the attack was unsuccessful.”

With reference to a recent article from Tom Bienkowski, director of DDoS Product Marketing at NETSCOUT Arbor, Hamman clarifies that there are four key types of DDoS attacks that target encrypted services:

• Attacks that target the SSL/TLS negotiation, which determines how two parties to an internet connection will encrypt their communications.
• Protocol or connection attacks against SSL service ports.
• Volumetric attacks targeting SSL/TLS service ports, which overwhelm port capacity with high volume traffic floods.
• Application-layer attacks against underlying services running over SSL/TLS.

Hamman says that against such grimly determined tactics, a multi-layered defensive strategy is required in turn. NETSCOUT Arbor’s DDoS defence approach incorporates the following key strategies:

• Arbor Cloud and 24/7 Security Operations Centre, which detects and mitigates volumetric attacks upstream before hitting the organisation.
• Arbor APS, which stops ‘low and slow’ application layer attacks.
• Arbor Cloud Signaling™, which intelligently routes traffic to secure clouds, thereby preventing on-premise infrastructure protection from being overwhelmed.
• Arbor ATLAS Intelligence Feed, which sends continual alerts to security teams to inform them of developing threats and trends.

Bienkowski concludes, “A key component of the security arsenal is the ability to inspect encrypted traffic securely and attest to its authenticity without slowing, disrupting or compromising legitimate traffic. While decryption is not always necessary for successful mitigation, there is a growing need for scalable solutions for decrypting packets.

“One positive conclusion coming out of the 13^th WISR is that both service providers and enterprises are recognising that traditional firewalls and intrusion prevention systems are insufficient in confronting sophisticated DDoS attacks – particularly encrypted attacks targeting encrypted services. Encryption is essential but cannot be relied upon on its own to thwart determined and sophisticated attackers.”

For more information about NETSCOUT Arbor in Africa, please contact Bryan Hamman at bhamman@arbor.net.

About NETSCOUT Arbor
NETSCOUT Arbor, the security division of NETSCOUT, helps secure the world’s largest enterprise and service provider networks from DDoS attacks and advanced threats. NETSCOUT Arbor is the world’s leading provider of DDoS protection in the enterprise, carrier and mobile market segments, according to Infonetics Research. NETSCOUT Arbor’s advanced threat solutions deliver complete network visibility through a combination of packet capture and NetFlow technology, enabling the rapid detection and mitigation of malware and malicious insiders. NETSCOUT Arbor also delivers market-leading analytics for dynamic incident response, historical analysis, visualization and forensics. NETSCOUT Arbor strives to be a “force multiplier,” making network and security teams the experts. Our goal is to provide a richer picture into networks and more security context so customers can solve problems faster and reduce the risks to their business.

To learn more about NETSCOUT Arbor products and services, please follow us on Twitter @ArborNetworks. Arbor’s research, analysis and insight, together with data from the ATLAS global threat intelligence system, can be found at the ATLAS Threat Portal.

Trademark Notice: NESCOUT Arbor, the NETSCOUT Arbor logo and ATLAS are all trademarks of NETSCOUT Arbor, Inc. All other brands may be the trademarks of their respective owners.