Monday, 10 June 2013

Denial of Service (DoS) and Brute-Force Protection

Recently it has become clear to me that, although the terms Denial of Service (DoS), Distributed Denial of Service (DDoS) and Brute-Force are used by many, people don't really understand them. This has caused confusion and problems on more than one project, so I thought I would write my thoughts on their similarities, differences and protection mechanisms.

A Denial of Service is anything that happens (usually on purpose, but not necessarily) that takes a service off line or makes it unavailable to legitimate users. This could range from a hacker exploiting a vulnerability and taking the service off line, to someone digging up a cable in the road. However, a Denial of Service could also be triggered by legitimate use of a service without any 'vulnerabilities'. Consider a service that performs operations on large sets of data that take a few seconds to complete. If I put in multiple requests for this service then I could tie it up and make it unresponsive for several minutes. Similarly, consider a website that has a page with a large video or flash animation on it. Again, relatively few requests for this resource could make the server slow and unresponsive. DoS is not just about hackers finding vulnerabilities.

Distributed Denial of Service, on the other hand, is a deliberate attempt by someone to deny service by performing large numbers of requests from a large number of hosts at once. Whilst it is relatively easy to spot a single host attempting a large number of requests and block them, it can be hard to pick up on many hosts making few requests and harder to block them. There are many solutions to combat DDoS by caching content and providing high bandwidth to large numbers of nodes, such as those available from the likes of Akamai. However, logic flaws or lengthy processing in the application can only really be fixed by the application developers.

Brute-Force, on the other hand, has nothing to do with DoS or making a service slow or unavailable. I was amazed that people didn't know this! Brute-Force is all about submitting a, usually, large number of requests to a service to obtain information that was not intended by the developer. An example would be having no account lockout after several incorrect login attempts. It would then be possible to try a whole dictionary or even every character combination to eventually find the password for a user. This is an example of Brute-Force, but there are many others, such as finding database versions, telephone numbers, transactions, parcel delivery addresses, etc. This can only really be stopped with application logic.

Monday, 29 April 2013

The Disconnect between Security and Senior Management

There is often a fundamental disconnect between security professionals and senior management. As I have stated in a previous post about slips, mistakes and violations, if senior management don't 'buy in' to security then nor will the rest of the organisation and ultimately it will fail. Middle management want to be senior management and will model themselves on them, often seeing the breaking of rules as a mark of status. So, it is vital that senior management lead by example.

Unfortunately, it is often very hard to get senior management to 'buy in' to this concept and not have a 'them-and-us' attitude of there being those rules that apply to the rest of the organisation and those that apply to them. This is as much the fault of the security professionals as senior management though. Security professionals have spent so long saying "no" to everyone and stalwartly refusing to budge or see someone else's point of view that people have stopped listening and taking note. To be honest, rightly so.

If you want someone to change their point of view or come round to your way of thinking, by far the easiest way is to sell it to them as a positive thing that will be beneficial to them and 'bring them with you' rather than dictate. Saying "no" all the time is not positive and will ultimately fail as people will stop listening. Make it personal to them and put it in terms they understand. Relating security to risk and money will usually be more successful.

Welcome to the RLR UK Blog

This blog is about network and information security issues primarily, but it does stray into other IT related fields, such as web development and anything else that we find interesting.

Tag Cloud

Twitter Updates

    follow me on Twitter

    Purewire Trust