Threat Summary: October 1, 2012On September 19, 2012, the Financial Services Information Sharing and Analysis Center (FS-ISAC) raised its Financial Services Cyber Threat Level to High based on reported attacks against United States financial institutions. Multiple online groups have claimed responsibility for the attacks, which have continued for the past 2 weeks. This malicious activity should be considered a high risk and a threat to other industries. Customers are strongly advised to follow best common practices (BCPs) for denial of service attacks. These BCPs are provided as links in this document. Multiple attack-pattern profiles are being used in these distributed denial of service (DDoS) attacks. The patterns are described in the Cisco Security Intelligence Operations Analysis section of this document. Threat UpdatesDecember 19, 2012: Cisco Security Intelligence Operations (SIO) has included new countermeasure and control guidelines in this document, which include recommendations on network segmentation, baseline traffic profiles, packet scrubbing services, device capacity and performance, and additional resources. October 25, 2012: Cisco SIO has included incident handling and response guidelines in this document. The guidelines should not replace your existing organizational policy, rather they should supplement your existing response procedures. See the Incident Handling and Response section for more information. Although it has been reported that the attacks will slow down, the Financial Services Information Sharing and Analysis Center (FS-ISAC) maintains its Financial Services Cyber Threat Level at High. Additional information has been added to the Attack Pattern Traffic Profiles table, Resources, and Related Cisco Products and Services. October 3, 2012: Cisco SIO has published Intrusion Prevention System (IPS) signature 1493/0: Distributed Denial of Service on Financial Institutions in signature update package S672 to help provide identification and detection for these attacks. Other countermeasures and controls may help identify and detect the attack pattern traffic profiles described in this document. See the Attack Pattern Traffic Profiles table for more information. To better understand the methodology Cisco SIO uses to respond to this event and other similar events, please read the security blog post Distributed Denial of Service Attacks on Financial Institutions: A Cisco Security Intelligence Operations Perspective. Cisco SIO will continue to monitor the threat landscape and provide additional analysis and updates when new information is available. |
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||
Event IntelligenceThe following table identifies Cisco SIO content that is associated with this Event Response Page:
Cisco SIO has obtained the following network-based threat detection related to this DDoS attack: The primary market segment from which Cisco SIO has observed denial of service attempts is Financial Services. Recently published SIO Cyber Risk Reports (CRRs) for September 17–23, September 24–30, and December 10–16, 2012, include threat information, additional analysis, hyperlinks to media reporting, and advising to prepare and deploy countermeasures if an attack occurs. DDoS attacks continue to evolve, and infrastructure managers are urged to plan for defense against these attacks well in advance of an active attack. Cisco SIO recommends that users work with their data providers to perform mitigations as close to the traffic source as possible to avoid services from becoming overwhelmed at the destination host and network. Cisco Internet Protocol Journal has published a white paper that provides strategies to protect against DDoS attacks. Network-based indicators of these attacks are the following: Attack Pattern Traffic Profiles
Impact on Cisco ProductsThere are no specific Cisco vulnerabilities associated with this event. The attack attempts to saturate the bandwidth of the targeted network and exhaust resources on the targeted devices and devices in the path between the attacker and victim. If the Cisco Product Security Incident Response Team (PSIRT) discovers that a product is vulnerable to DDoS attacks because of a defect in software or hardware unrelated to memory or bandwidth saturation from a DDoS attack, information about affected products will be published at Cisco Security Advisories and Responses. As always, ensure that you monitor reports from Cisco PSIRT for any Cisco product-related vulnerabilities. Countermeasures and Controls on Network DevicesNetwork Segmentation
Baseline Traffic Profiles
On-Premise and Upstream Scrubbing Services
Device Capacity and Performance
Network operators are encouraged to work with their data providers or applicable Cisco products and services. Cisco SIO has performed attack analysis and published a Cisco Applied Mitigation Bulletin, Identifying and Mitigating the Distributed Denial of Service Attacks Targeting Financial Institutions, which provides details about countermeasures and controls that can be used to identify and detect the Attack Pattern Traffic Profiles listed in the preceding table. Incident Handling and ResponseCoordinate Internal Response Teams
Sharing Information with Third Parties
Lessons Learned
Huffington Post - Izz Ad-Din Al-Qassam Cyber Fighters Group Takes Break From Hacking Banks To Celebrate Eid Al-Adha Holiday
Configuring Threat Detection on Cisco ASA 5500 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
