On 1/31/13 10:13 AM, matt kelly wrote:

Can anyone recommended ddos mitigation companies with US east coast presence that provide the services via bgp? We are not interested in an appliance but rather offloading the traffic.

Prolexic.

Look up DOSArrest. (dosarrest.com) 3 permanent cases easily solved with them. And no, I'm not one of their sales rep =D ----- Alain Hebert ahebert@pubnix.net PubNIX Inc. 50 boul. St-Charles P.O. Box 26770 Beaconsfield, Quebec H9W 6G7 Tel: 514-990-5911 http://www.pubnix.net Fax: 514-990-9443 On 01/31/13 13:13, matt kelly wrote:

Can anyone recommended ddos mitigation companies with US east coast presence that provide the services via bgp? We are not interested in an appliance but rather offloading the traffic.

Thanks.

The 3 major scrubbing vendors: Prolexic Verisign Akamai Prolexic has the ability to announce a /24 for you, and scrub the whole thing, then pipe it back to you via a GRE tunnel or dedicated circuit. All of the companies mentioned do this for a living, and are pretty good at what they do. There are other vendors as well that do FQDN scrubbing for you (which is the normal way to do it). You swing the DNS A record to point to their provisioned VIP, and they proxy back the traffic to you. This doesn't do anything to prevent attacks against IP addresses rather than resolved FQDNs. It's important to note that all mitigation techniques can have a negative impact and should be tested first. The scrubbing centers are only one solution and you should equip yourself with multiple layers of defense, separated by where they live: Beyond the carrier perimeter - Scrubbing farms in IP-routed mode - Scrubbing farms in DNS-routed mode - CDNs to deliver high value target pages, like main corporate pages and login windows - Globally Anycast DNS auth slaves through a CDN Beyond your perimeter (carriers) - Geoblocks - Zombie detection and rate limits - Flowspec routes via monitoring tools like Arbor's - Various other carrier-specific security offerings - Provision a secondary circuit to carry non-public IP space, for corporate web/out, phones, VPN etc. If the main pipe comes under attack, you can still carry out some critical business and B2B functions Within the perimeter - Load balancers - Firewalls - IPS - WAF - Reverse proxies - Blackhole routes - Flowspec routes (ie Arbor) - A span tap on the internet feed(s) connected to a tcpdump box (silly and cheap, but highly useful to generate sigs and collect intel) Not all DDoS are created equal, and there can always be some leakage by protections further out; the protections closer in allow for a faster and more granular response, but you're really limited to the circuit sizes, session limits etc. I would highly recommend that you also join industry specific cyberintelligence organizations, like any of the -ISACs, and/or a cyberintel provider if you don't have access to an -ISAC. The 3 major areas of infosec business focus in 2013 that I see will be insourcing malware analysis + automation of IOC generation, cyberintelligence, and DDoS mitigations. Businesses have realized that relying solely in external vendors to provide these services in a generic way results in good service but slower turnaround times; the insourced components become both a first tier of defense, and also a specialized set of incident responders that understand the business. Pierre On 31/01/2013 1:13 PM, matt kelly wrote:

Can anyone recommended ddos mitigation companies with US east coast presence that provide the services via bgp? We are not interested in an appliance but rather offloading the traffic.

Thanks.