August 10, 2010, 5:04 PM — Akamai Technologies continues to study the massive DDoS attacks that brought government websites to a standstill last year. The picture keeps getting uglier, but emergency planning hasn't improved.
At Securitymetrics.org's Metricon 5 event today, R.H. Powell, senior service line manager for the Cambridge, Mass.-based company, revealed new research and suggested companies do better at planning for these increasingly vicious attacks.
Powell has been watching the DDoS trend from a pretty tall vantage point. Most people use Akamai services without even realizing it. The company runs a global platform with thousands of servers customers rely on to do business online. The company currently handles tens of billions of daily Web interactions for such companies as Audi, NBC, and Fujitsu, and organizations like the U.S. Department of Defense and NASDAQ. There's rarely a moment -- if at all -- when an Akamai customer IS NOT under the DDoS gun.
Gleaning data from 200 agent servers whose sole purpose is to listen in on port activity, as well as customer traffic logs and public reports and data from firms such as Forrester Research, Akamai has found, among other things, that:
- Attacks are increasingly originating from countries like Turkey and Brazil, where Internet use is catching up with the rest of the world but not the security culture. In fact, Powell said, the security culture in these places is practically non-existent.
- Ninety-five percent of corporate web apps have severe flaws that are at risk of being exploited, aiding the growth of botnets and enabling the more severe DDoS attacks (Powell cited Forrester as the source of that example).
- Vulnerabilities at the application level are particularly troubling because companies are rushing out new apps every day, widening the attack surface.
Powell's assessment mirrors that of his colleague, Akamai CSO Andy Ellis, who told CSO in January that botnets launching many of today's DDoS attacks are so vast that those controlling them probably lost track of how many hijacked machines they control a long time ago. [Listen to the full interview with Ellis in The Long, Strange Evolution of DDoS Attacks]