It's not easy to defend a federal Web server against distributed service denial attacks, but it's not impossible either.
Styles of attack
- Internet Control Message Protocol flooding. An ICMP ping on a server produces an echo response to confirm the server's presence. When enough pings are sent, the target server can do nothing but respond to the requests.
- Smurf attack. It appears to originate from the target server's own IP address or somewhere on its network. Targeted correctly, it can flood the network with pings and multiple responses.
- User Datagram Protocol flood. UDP diagnostic services generate characters that are echoed back from the receiving end to the host. This can swamp the network with useless data.
- TCP SYN flood. Multiple spoofed requests for Transmission Control Protocol connections force the server to keep ports open, waiting for responses.
- A firewall where the agency LAN connects to an Internet service provider or other network access point. A firewall can keep hackers out, but it's not good at stopping a distributed service denial attack.
Many firewalls can be configured to act as packet-filtering routers, which means they strip out bad packets and still let legitimate traffic through. But by the time the bad traffic reaches the firewall, it's already clogging the Internet connection.
- A network-based intrusion detection system. An IDS is generally set to so-called promiscuous mode so it can see all passing data. It can log improper data or trigger an alarm. A host-based IDS is similar, but set to monitor a single service on a host.
Both types of intrusion detection systems can be configured to look for specific data signatures or anomalies. They don't react directly to the intrusion, but they can trigger separate filtering systems.
One disadvantage is that they, like PC antivirus software, must constantly be updated with suspect data signatures.
- The most effective roadblock is to work with the Internet provider to filter out the flow of bad data, based on analysis of the arriving packets. This is time-consuming but worthwhile because it keeps the network free of unwanted traffic.
- A quicker but less effective method is to install a traffic-limiting intrusion detection system that looks for unusual or anomalous traffic. It takes advantage of a feature in TCP/IP to confirm whether traffic comes from a nonspoofed source.
Only provider can bar packets
- A filtering and traffic-limiting device at the agency firewall will limit inbound service-denial traffic. If it does egress filtering, it can prevent agency servers from being used in an attack.
- A similar setup at the highest bandwidth point will do even more. Large government networks have a slight advantage here because they don't have to count on commercial providers to install such devices.
- Finally, having two or more gateways will make the agency's network redundant and therefore harder to shut down.
Shawn P. McCarthy designs products for a Web search engine provider. E-mail him at email@example.com.
'Shawn P. McCarthy
Stop outgoing packets
Shunning some ISPs
'Shawn P. McCarthy