How DDoS has evolved into new threats against a data center

Volumetric Attacks

TCP State-Exhaustion Attacks

Application-Layer Attacks

Use of reflection/amplification to launch massive attacks: The largest reported attack in 2014 was 400Gbps, with other large reported events at 300, 200 and 170Gbps with a further six respondents reporting events over the 100Gbps threshold. Ten years ago, the largest attack was 8 Gbps.

Multi-vector and application-layer DDoS attacks are becoming ubiquitous: 90 percent of respondents reported application-layer attacks and 42 percent experienced multi-vector attacks that combine volumetric, application-layer and state exhaustion techniques within a single sustained attack.

DDoS attack frequency is on the rise: In 2013, just over one quarter of respondents indicated they had seen more than 21 attacks per month; in 2014, that percentage has nearly doubled to 38 percent.

Virtual Appliances and Security Virtualization. No longer bound by the physical aspect, virtual appliances can roam between physical hosts and have visibility into more parts of the network. Plus, they’re easier to manage from an agility perspective. Furthermore, administrators can dedicate a virtual security appliance to a specific function. This means an appliance can reside departmentally doing a certain type of service for that team. This would prove to be much more expensive when doing something similar with a physical device. Furthermore, new kinds of tools allow you to integrate security directly into storage repositories, and even virtual machines. This allows you to scan data before they even hit a VM. These are advanced virtual security mechanisms which enable a new level of infrastructure security.

New Cross-Device Security Engines. Advanced deep scanning engines like data-loss prevention (DLP), intrusion detection/prevention services (IPS/IDS), and even device interrogation helps lock down an environment. Creating intelligent network monitoring algorithms allows administrators to control what data flows in and out of the environment. Furthermore, these new engines help control the various consumer devices that are trying to enter the environment. Here’s the reality – you can now control any IP-based devices which attempts to connect into your network. This kind of granular control automates the security process especially when you have a lot of different devices connecting into your data center.

Create a network which acts as a sensor and an enforcer. The three kinds of attacks that I mentioned earlier are absolutely impacting the modern network and data center architecture. This is where next-generation security technologies must meet the rest of your data center architecture. This means having intelligent policies and monitors running at the edge – and on your network. Is a specific port on a core switch experiencing a burst? Is an application sitting internally suddenly getting anomalous traffic? Are there mal-formed packets hitting a service or site? An intelligent security and networking architecture will sense these kinds of attacks and then enforce appropriate policies to stop the traffic and prevent any damage. Today, there is a lot of intelligence available which span from the blade, through your network, and out to the edge.