Radware: Week-plus DDoS attacks doubled last year

Quite a few security vendor attack trend reports are hitting my inbox today.

There’s the Akamai report I wrote about earlier. Now I’ve had a chance to look at a report from Radware about the rise of server-based botnets and encrypted layer attacks, among other things.

[See also: “What a botnet looks like” and “The botnet hunters“]

The full report is available here, but an excerpt of the takeaways are below:

Server-based botnets represent a new and more powerful order in the DDoS environment.

The shift from single-server attacks to the use of multiple servers in different geographic locations has allowed attackers to quickly and effectively launch more powerful DDoS attacks than ever before. Just a few attacking servers can produce the same attack traffic as a large number of client botnets, with the 24/7 availability of servers allowing for greater reliability as well as command-and-control. In 2013, Radware expects this method to gain in popularity, requiring that organizations make sure their defense architecture can withstand these scaled up attacks. Although effective, several weak points are uncovered and identified.

The number of DDoS and DoS attacks lasting more than one week doubled last year.

Radware’s ERT developed the Advanced Persistent Threat (APT) score to quantify and qualify the increasing force, sophistical and persistence of 2012’s attacks. The numbers are staggering – with 58 percent of attacks scoring a 7 or higher in complexity (out of 10), as compared to just 23 percent of attacks in 2011. In 2011, only 30% of attacks scored higher than a level of 3 in terms of severity, while in 2012 70% achieved a level of 3 or higher.

Encrypted layer attacks fly below the radar.

In 2012, the growing popularity of HTTPS-based attacks added a new dimension to the security landscape. Though conventionally associated with security on the web, hackers have managed to weaponize the encryption layer, using it to launch application-level and SSL attacks that can escape detection and remain hidden until its already too late. This has become an especially troubling phenomenon for financial services and e-commerce websites that rely heavily on HTTPS.

Most organizations are bringing a knife to a gunfight.

With some of the worlds largest institutions victimized by cyber attacks in 2012, the question remains as to why many of these organizations continue to be vulnerable. The fact remains that less than a quarter of all organizations surveyed invest their efforts in mitigating attacks as they’re happening – a fact exploited by hackers. In 2013, Radware recommends that organizations dedicate resources to creating a “security war room” equipped to dynamically respond to and handle persistent security attacks during all phases of an attack and adopt a three-phased security approach.

The ‘DIY’ phenomenon

The proliferation of ‘do-it-yourself’ sites devoted to enabling hacking schemes has reached commodity market proportions.  The supply chain includes took kits and for-hire services that are available to anyone with minimal coding or advanced hacking skills for as little as $10 for a ransomware attack tool.  This has significantly reduced the barrier of entry for individuals or organizations to launch an attack.

[Also see CSO’s DDoS survival guide]