Cisco Blogs

Cisco Blog > SP360: Service Provider

Stopping DDoS Attacks at the Network Edge

ASR 9000We’ve been talking a lot about security this week with the announcement of the Firepower 9300 and how we’re helping to secure the Evolved Programmable Network.  Earlier posts talked about the security threat, the challenge to video delivery networks, and what steps we’re taking to for both DDoS mitigation and security in general.

Part of the challenge is that there are two types of DDoS attacks – volumetric – meaning, massive amounts of data – and application specific, a smaller attack but one that targets a specific service. An efficient, effective, defense-in-depth requires protection for both. Firepower 9300 is optimized for the application centric attacks, but the Cisco ASR9000 virtual DDOS or vDDOS mitigation leveraging from technology from Arbor Networks ensures that the bad guys can’t overwhelm your defenses at the edge of the network.

That edge-based protection is important since DDoS attacks getting bigger – in 2014 the biggest according to Arbor was 400 Gigabits per second.  They’re also getting more complicated, or “multi-vector”, meaning the bad guys are attacking from multiple directions.

The Cisco ASR 9000 virtual DDoS mitigation solution, provides Read More »

Tags: , , , , ,

Cisco Hosting Amsterdam 2014 FIRST Technical Colloquium

The registration is now open and there is still time left to respond to the call for papers for the upcoming FIRST Technical Colloquium April 7-8, 2014. Please contact us at for speaker engagements. The event already has an exciting preliminary program covering:

  • Savvy Attribution in the DNS – Using DNS to Geo-locate Malicious Actors
  • Beyond Zone File Access: Discovering interesting Domain Names Using Passive DNS
  • DNStap: High speed DNS logging without packet capture
  • CVSS v3 – This One Goes to 11
  • Securing the Internet Against DDoS Attacks
  • Threat Actor Techniques
  • Mitigating Attacks Targeting Administrator Credentials in the Enterprise
  • Hardware: The root of trust in the cloud
  • Targeted attack case study
  • What does an enterprise monitor for targeted attacks? – CSIRT Playbook II
  • Security uses for hadoop & big data
  • OpenSOC
  • Using HBASE for Packet capture

And many more current issues facing the incident response community. Learn how organizations operationalize intelligence to mitigate and detect advanced threats.

The event’s line-up includes so far already notables from Cisco Security Intelligence Operations (SIO), Symantec, Vrije Universiteit Amsterdam and Farsight. Looking forward to A great TC!

Tags: , , , , , ,

Enterprise Security: Include DDoS Mitigation in your 2014 Plans

2014 will be a pivotal year for Enterprise Security professionals. Large scale Denial of Service ( DoS ) and Distributed Denial of Service attacks ( DDoS ) have been increasing over the years, which is nothing new. As technology evolves, including faster machines and cheaper bandwidth, attacks will also evolve just as fast if not a little faster.  What is alarming is the dramatic increase in the size of these DoS and DDoS attacks over the last year. These attacks are nothing to sneeze at, and in fact, are down right scary. Most of these attacks can cripple even the biggest of Enterprises due to their sheer size. This will require Enterprise Security professionals to take a serious look at their security plans for 2014.

Entperise Security

2013 saw the largest DDoS attack on record, with the 300gbps attack on the Anti-Spam site Spamhaus. 2014 has also started off quickly with a large NTP reflection attack. Jaeson Schultz has a great article on this topic, available here. This isn’t the start of the year the Enterprise Security professional wants to see. But it’s a real threat, and any Enterprise needs to have plans in place to handle this type of situation so can keep service available for their clients.

How Enterprise Security professional handle this type of nightmare can lead to some sleepless nights. With the amount Read More »

Tags: , , , , ,

When Network Clocks Attack

TRACIn October 2013, Cisco TRAC discussed Network Time Protocol (NTP) as a possible vector for amplified distributed denial of service (DDoS) attacks. Litnet CERT has since revealed that their NTP servers were used in a denial of service (DoS) attack. Symantec also published information regarding an NTP amplification-based DDoS attack that occurred in December 2013. On December 7, 2013, a user posted an NTP amplification DDoS script to Pastebin. The NTP DDoS script is heavily obfuscated Perl, though the plain text at the top credits the “leaking” of the script to an individual who goes by the handle Starfall. Brian Krebs also mentioned someone going by the name Starfall as a paying user of They may be the same person.

Decoding the obfuscated Perl yields some interesting insights. For example, this code near the top of the script has nothing to do with the NTP DDoS functionality:

The code above downloads a program called from IP, then runs and erases that program while writing the text “j00 g0t 0wn3d s0n” into a hidden file. Unfortunately, we were unable to obtain a copy of the script, but the ominous “j00 g0t 0wn3d s0n” text indicates the purpose of the program was likely to compromise the machine of anyone who was running the obfuscated NTP DDoS script. Is there no honor among hackers?
Read More »

Tags: , , , ,

2014: A Look Ahead

It’s December and the 2013 cyber security news cycle has just about run its course. We’ve seen more and increasingly virulent attacks, continued “innovation” by adversaries, and a minor revival of distributed denial of services (DDOS) actions perpetrated by hacktivists and other socio-politically motived actors.

Against this, Cisco stood up tall in recognizing the importance of strong security as both an ingredient baked into all Cisco products, services, and solutions, and a growing understanding of how to use the network to identify, share information about, and defeat threats to IT assets and value generation processes. I can also look back at 2013 as the year that we made internal compliance with the Cisco Secure Development Lifecycle (CSDL) process a stop-ship-grade requirement for all new Cisco products and development projects. Read More »

Tags: , , , , , ,