DDoS-Resilient Architecture on AWS

What can we do if our system gets enormous amounts of traffic from the bad guys? We will look at a few attacks that are possible and what you can do against them. At then end we will have a system that looks like this: Route 53 -> CloudFront -> ELB -> Web Application Firewall (Auto Scalling) -> ELB -> Webservers (Auto Scalling) -> Protection Layer -> vulnerable legacy database

Transcript

1. DDoS-­‐Resilient  Architecture  
2. What  we  do   •  Migra8on  /  Consul8ng   •  Training   •  Development   •  Managed  Hos8ng  
4. numbers  
5. Q1  2015   hFp://resources.arbornetworks.com/h/i/73426938-­‐atlas-­‐q1-­‐2015-­‐global-­‐ddos-­‐aFack-­‐trends  
6. DNS  aFacks   •  DNS  Amplifica8on  AFack   – 60  bytes  request   – 3000  bytes  response   – use  DNS  servers  to  aFack  a  vic8m   •  IP-­‐Spoofing   – Response  IP  is  changed  to  the  target  
7. AWS cloud Internet Amazon Route 53 •  Route  53  cares  about  all   DNS  related  aFacks  
8. DDoS-­‐Resilient  Architecture?   protec8ng  a  web  stack  
9. What  can  we  do?   •  Minimize  aFackable  surface   – Only  expose  the  minimum  set   – Decouple  asynchronously   •  Be  ready  to  scale   •  Know  your  traffic   •  Safeguard  expensive  resources  (database)   •  Have  a  plan  to  deal  with  DDoS     AWS  re:Invent  2014  |  (SEC307)  Building  a  DDoS-­‐Resilient  Architecture  with  AWS  
10. AWS cloud Internet virtual private cloud Availability Zone VPC subnet VPC subnet instance MySQL DB Amazon Route 53 security group security group MySQL •  Security  Groups  keep   bad  traffic  from  your   instances  without  using   your  resources  
11. HTTP  aFacks   •  HTTP  Flood   – Send  enormous  amount  of  valid  GET  /  POST   requests   – expensive   •  Slowloris   – Send  HTTP  request  extremly  slow  to  exhaust  max   connec8ons  on  the  web  server   – cheap  
12. AWS cloud Internet virtual private cloud Availability Zone VPC subnet VPC subnet instance MySQL DB Amazon Route 53 security group security group MySQL •  A  single  web  server  is   easy  to  aFack  
13. AWS cloud Internet virtual private cloud Availability Zone VPC subnet VPC subnet instance MySQL DB security group security group MySQL security group Elastic Load Balancing •  ELB  terminates  SSL   •  filters  bad  HTTP  requests   •  manages  8meouts  
14. AWS cloud Internet virtual private cloud Availability Zone VPC subnet VPC subnet instance MySQL DB security group security group MySQL security group Elastic Load Balancing CloudFront •  CloudFront  returns   cached  results   •  absorbs  some  aFacks   •  geo  restric8ons  
15. AWS cloud Internet virtual private cloud Availability Zone VPC subnet VPC subnet instance MySQL DB security group security group MySQL security group Elastic Load Balancing CloudFront •  More  web  servers  can   handle  more  requests   •  Stateless  server!   •  but:    database  can‘t  scale  
16. Alert  Logic  Web  Security  Manager   Web  Applica8on  Firewall  (WAF)  
17. AWS cloud Internet virtual private cloud Availability Zone VPC subnet VPC subnet WAF security group security group security group Elastic Load Balancing CloudFront •  Inspect  HTTP  traffic     •  Automated  learning   engine   •  Reject  evil  requests  early   security group Elastic Load Balancing instance
18. Be  ready  to  scale  
19. AWS cloud Internet virtual private cloud Availability Zone VPC subnet VPC subnet instance MySQL DB security group security group MySQL security group Elastic Load Balancing CloudFront alarm •  Increasing  servers  when   traffic  goes  up  will   automa8cally  absorb   aFack  
20. Know  your  traffic  
21. Safeguard  expensive  resources    
22. AWS cloud Internet virtual private cloud VPC subnet VPC subnet instance MySQL DB security group security group MySQL security group Elastic Load Balancing CloudFront alarm •  Absorbing  database   traffic  with  a  cache   •  Hystrix   VPC subnet security group cache node
23. Have  a  plan  to  deal  with  DDoS  
24. Michael  Wihg   tecRacer  GmbH  &  Co.  KG   mwihg@tecracer.de  
25. M A N N I N G Michael Wittig Andreas Wittig hFp://manning.com/wihg   Save  39%  with  code  39wihg