SlideShare a Scribd company logo
1 of 19
Download to read offline
Threat Intelligence
At The Cloud
Or Katz - Principal Security Researcher
Ezra Caltum - Senior Security Researcher
©2015 AKAMAI | FASTER FORWARDTM
Hide and Seek
©2015 AKAMAI | FASTER FORWARDTM
Hide and Seek
Akamai Cloud
The Playground? Who is Hiding?
Who is Seeking? The Goal of the Game?
Threat Actors
Find malicious activity and
create actionable threat
intelligence
©2015 AKAMAI | FASTER FORWARDTM
Hide: Threat Actors
©2015 AKAMAI | FASTER FORWARDTM
Seek: Akamai Threat Research Team
Akamai’s State of The Internet Report
Research Publication
Thought Leadership
©2015 AKAMAI | FASTER FORWARDTM
The Platform
•  167,000+ Servers
•  750+ Cities
•  92 Countries
The Data
•  2 trillion hits per day
•  260+ terabytes of
compressed daily
logs
Playground: Akamai’s Content Delivery Network (CDN)
Data
Centers
End User
©2015 AKAMAI | FASTER FORWARDTM
The Goal: Threat Intelligence
Highlights of threat intelligence:
•  New insights
•  Forecast future threats
•  Digested output
•  Actionable
According to Gartner:
“Threat intelligence is evidence-based knowledge, including context,
mechanisms, indicators, implications and actionable advice, about an existing or
emerging menace or hazard”
©2015 AKAMAI | FASTER FORWARDTM
Why Threat Intelligence At the Cloud?
Volume, Velocity and Variety
Leading to better:
• visibility to threat landscape
• Insights
• Future threats forecasting
• Security level
©2015 AKAMAI | FASTER FORWARDTM
Case Study – Slow & Low
Customer: “Some of the Web site
accounts had been taken over, I
suspect that it was a brute force
attack”
©2015 AKAMAI | FASTER FORWARDTM
Web Brute Force
Also known as: Password guessing attack
User: Ezra
Password: 123456
Brute Forcer
Web Application
©2015 AKAMAI | FASTER FORWARDTM
Brute Force - Common vs. Advanced
Common
•  Attack method – Brute force flood
•  Attacking resources – single/few
•  Detection technique – Noisy logs
•  Protection - Rate control
Advanced
•  Attack method – Brute force slow and low
•  Attacking resources – multiple/Botnet
•  Detection technique – ?
•  Protection - ?
©2015 AKAMAI | FASTER FORWARDTM
Slow & Low – On Site Threat Intelligence
Step 1 (on-site)
Analyzing each IP address
activity per Web application
Step 2 (on-site)
Analyzing aggregated Web
application login attempts per
hour
Resource Application
5 ~ 12 login attempts per hour ~50 login attempts per hour
©2015 AKAMAI | FASTER FORWARDTM
Slow and Low – At Cloud
Step 3 (cloud)
Tracking brute forcer across the cloud!
Monitoring all IP addresses activity on all targeted Web application
1.  Each Botnet member target 100 ~ 300 Web applications
2.  Botnet execute ~10,000 login attempts per hour over Cloud
network
3.  Botnet is running over the same virtual hosting service provider
4.  The Botnet was active at least few months before detected
BINGO
©2015 AKAMAI | FASTER FORWARDTM
On-site vs. Cloud
On-Site Cloud
©2015 AKAMAI | FASTER FORWARDTM
Brute Force Botnet
©2015 AKAMAI | FASTER FORWARDTM
Brute Force by Industry Segment
©2015 AKAMAI | FASTER FORWARDTM
Actionable Insight
•  Tactical controls - Block any login attempts initiated from detected Botnet
•  Strategic controls - Adjust security control brute force rate mitigations
•  GEO intelligence - Restrict GEO login
•  Present threat Intel. - Detection based on cross targeted correlation
•  Future threat Intel. - Forecasting based on industry intelligence
©2015 AKAMAI | FASTER FORWARDTM
Summary
•  Cloud platform can yield unique actionable threat intelligence
•  Cloud threat intelligence introduce the ability to use cross targets, cross
industry and evasive techniques in order to produce unique threat
intelligence
•  Using gaming techniques while at work is fun!
•  When you are 195cm tall it is hard to find good hiding places
©2015 AKAMAI | FASTER FORWARDTM
Ezra Caltum - @aCaltum
Or Katz - @or_katz

More Related Content

What's hot

Cisco ACI & Hybrid Networks - Breaking Down Silos with Central Policy Management
Cisco ACI & Hybrid Networks - Breaking Down Silos with Central Policy ManagementCisco ACI & Hybrid Networks - Breaking Down Silos with Central Policy Management
Cisco ACI & Hybrid Networks - Breaking Down Silos with Central Policy Management
AlgoSec
 
5 things you didnt know you could do with security policy management
5 things you didnt know you could do with security policy management5 things you didnt know you could do with security policy management
5 things you didnt know you could do with security policy management
AlgoSec
 
Technologies You Need to Safely Use the Cloud
Technologies You Need to Safely Use the CloudTechnologies You Need to Safely Use the Cloud
Technologies You Need to Safely Use the Cloud
CloudPassage
 

What's hot (20)

Centurylink - Acceleration and securing modern applications!
Centurylink - Acceleration and securing modern applications!Centurylink - Acceleration and securing modern applications!
Centurylink - Acceleration and securing modern applications!
 
Cisco ACI & Hybrid Networks - Breaking Down Silos with Central Policy Management
Cisco ACI & Hybrid Networks - Breaking Down Silos with Central Policy ManagementCisco ACI & Hybrid Networks - Breaking Down Silos with Central Policy Management
Cisco ACI & Hybrid Networks - Breaking Down Silos with Central Policy Management
 
Cisco IT and ThousandEyes
Cisco IT and ThousandEyesCisco IT and ThousandEyes
Cisco IT and ThousandEyes
 
Tying cyber attacks to business processes, for faster mitigation
Tying cyber attacks to business processes, for faster mitigationTying cyber attacks to business processes, for faster mitigation
Tying cyber attacks to business processes, for faster mitigation
 
Pros and Cons of Moving to Cloud and Managed Services
Pros and Cons of Moving to Cloud and Managed ServicesPros and Cons of Moving to Cloud and Managed Services
Pros and Cons of Moving to Cloud and Managed Services
 
Dynatrace Cloud-Native Workshop Slides
Dynatrace Cloud-Native Workshop SlidesDynatrace Cloud-Native Workshop Slides
Dynatrace Cloud-Native Workshop Slides
 
Amazon CloudWatch RUM for monitoring applications’ client-side performance
Amazon CloudWatch RUM for monitoring applications’ client-side performanceAmazon CloudWatch RUM for monitoring applications’ client-side performance
Amazon CloudWatch RUM for monitoring applications’ client-side performance
 
Rethinking Security: The Cloud Infrastructure Effect
Rethinking Security: The Cloud Infrastructure EffectRethinking Security: The Cloud Infrastructure Effect
Rethinking Security: The Cloud Infrastructure Effect
 
Unlock the Intelligent Data Center with VMware & Zenoss
Unlock the Intelligent Data Center with VMware & ZenossUnlock the Intelligent Data Center with VMware & Zenoss
Unlock the Intelligent Data Center with VMware & Zenoss
 
5 things you didnt know you could do with security policy management
5 things you didnt know you could do with security policy management5 things you didnt know you could do with security policy management
5 things you didnt know you could do with security policy management
 
Technologies You Need to Safely Use the Cloud
Technologies You Need to Safely Use the CloudTechnologies You Need to Safely Use the Cloud
Technologies You Need to Safely Use the Cloud
 
Security Change Management: Agility vs. Control
Security Change Management: Agility vs. ControlSecurity Change Management: Agility vs. Control
Security Change Management: Agility vs. Control
 
Shift Happens: Eliminating the Risks of Network Security Policy Changes
Shift Happens: Eliminating the Risks of Network Security Policy ChangesShift Happens: Eliminating the Risks of Network Security Policy Changes
Shift Happens: Eliminating the Risks of Network Security Policy Changes
 
2021 01-13 reducing risk-of_ransomware
2021 01-13 reducing risk-of_ransomware2021 01-13 reducing risk-of_ransomware
2021 01-13 reducing risk-of_ransomware
 
AWS Security Fundamentals: Dos and Don’ts
AWS Security Fundamentals: Dos and Don’tsAWS Security Fundamentals: Dos and Don’ts
AWS Security Fundamentals: Dos and Don’ts
 
IoT - Software Updates Via Akamai Over the Air Services
IoT - Software Updates Via Akamai Over the Air ServicesIoT - Software Updates Via Akamai Over the Air Services
IoT - Software Updates Via Akamai Over the Air Services
 
Securing Traditional Workloads on AWS
Securing Traditional Workloads on AWSSecuring Traditional Workloads on AWS
Securing Traditional Workloads on AWS
 
NetScout nGeniusONE overview
NetScout nGeniusONE overviewNetScout nGeniusONE overview
NetScout nGeniusONE overview
 
Technical Webinar with AWS - Everything You Need to Measure in Your Migration
Technical Webinar with AWS - Everything You Need to Measure in Your MigrationTechnical Webinar with AWS - Everything You Need to Measure in Your Migration
Technical Webinar with AWS - Everything You Need to Measure in Your Migration
 
AWS re:Invent 2016: Introduction to AWS IoT in the Cloud (IOT204)
AWS re:Invent 2016: Introduction to AWS IoT in the Cloud (IOT204)AWS re:Invent 2016: Introduction to AWS IoT in the Cloud (IOT204)
AWS re:Invent 2016: Introduction to AWS IoT in the Cloud (IOT204)
 

Viewers also liked

Mapas conceptuales de solci thieroldt ♥
Mapas conceptuales de solci thieroldt ♥Mapas conceptuales de solci thieroldt ♥
Mapas conceptuales de solci thieroldt ♥
Solcita123
 
Media Platforms Emerge: 2004 onward - The rise of Embeddability
Media Platforms Emerge:  2004 onward - The rise of EmbeddabilityMedia Platforms Emerge:  2004 onward - The rise of Embeddability
Media Platforms Emerge: 2004 onward - The rise of Embeddability
Nick Kellet
 
Hack In The Box (Dubai) 04172008
Hack In The Box (Dubai) 04172008Hack In The Box (Dubai) 04172008
Hack In The Box (Dubai) 04172008
guesta84549
 
Musicas cifradas bossa nova samba 01
Musicas cifradas bossa nova samba 01Musicas cifradas bossa nova samba 01
Musicas cifradas bossa nova samba 01
Elvis Live
 
1960s shortened
1960s shortened1960s shortened
1960s shortened
Krista Leh
 
Blue ocean strategy 3
Blue ocean strategy 3Blue ocean strategy 3
Blue ocean strategy 3
Daniel
 
Work wants to be social (talk at Web 2 Expo 2010)
Work wants to be social (talk at Web 2 Expo 2010)Work wants to be social (talk at Web 2 Expo 2010)
Work wants to be social (talk at Web 2 Expo 2010)
Rashmi Sinha
 

Viewers also liked (20)

Marama 3
Marama 3Marama 3
Marama 3
 
Mapas conceptuales de solci thieroldt ♥
Mapas conceptuales de solci thieroldt ♥Mapas conceptuales de solci thieroldt ♥
Mapas conceptuales de solci thieroldt ♥
 
Media Platforms Emerge: 2004 onward - The rise of Embeddability
Media Platforms Emerge:  2004 onward - The rise of EmbeddabilityMedia Platforms Emerge:  2004 onward - The rise of Embeddability
Media Platforms Emerge: 2004 onward - The rise of Embeddability
 
Hack In The Box (Dubai) 04172008
Hack In The Box (Dubai) 04172008Hack In The Box (Dubai) 04172008
Hack In The Box (Dubai) 04172008
 
Musicas cifradas bossa nova samba 01
Musicas cifradas bossa nova samba 01Musicas cifradas bossa nova samba 01
Musicas cifradas bossa nova samba 01
 
Ingless
InglessIngless
Ingless
 
Neo-noir: The Dark Side of Creative Writing
Neo-noir: The Dark Side of Creative Writing Neo-noir: The Dark Side of Creative Writing
Neo-noir: The Dark Side of Creative Writing
 
Infosys
InfosysInfosys
Infosys
 
1960s shortened
1960s shortened1960s shortened
1960s shortened
 
God Is Holy
God Is HolyGod Is Holy
God Is Holy
 
Zombies, Run! Transforming Fitness, Games & Story
Zombies, Run! Transforming Fitness, Games & StoryZombies, Run! Transforming Fitness, Games & Story
Zombies, Run! Transforming Fitness, Games & Story
 
Train a Social Workforce: How AT&T Trained Thousands of Employee Advocates
Train a Social Workforce: How AT&T Trained Thousands of Employee AdvocatesTrain a Social Workforce: How AT&T Trained Thousands of Employee Advocates
Train a Social Workforce: How AT&T Trained Thousands of Employee Advocates
 
Blue ocean strategy 3
Blue ocean strategy 3Blue ocean strategy 3
Blue ocean strategy 3
 
Are you listening to your data? Chris Stanley Virtusa
Are you listening to your data? Chris Stanley Virtusa Are you listening to your data? Chris Stanley Virtusa
Are you listening to your data? Chris Stanley Virtusa
 
Verilog-HDL Tutorial (6)
Verilog-HDL Tutorial (6)Verilog-HDL Tutorial (6)
Verilog-HDL Tutorial (6)
 
Work wants to be social (talk at Web 2 Expo 2010)
Work wants to be social (talk at Web 2 Expo 2010)Work wants to be social (talk at Web 2 Expo 2010)
Work wants to be social (talk at Web 2 Expo 2010)
 
Outline of How to Publish a Book
Outline of How to Publish a BookOutline of How to Publish a Book
Outline of How to Publish a Book
 
QUEST/SmarterMeasure Learning Readiness Indicator Lunch & Learn Webinar Series
QUEST/SmarterMeasure Learning Readiness Indicator Lunch & Learn Webinar SeriesQUEST/SmarterMeasure Learning Readiness Indicator Lunch & Learn Webinar Series
QUEST/SmarterMeasure Learning Readiness Indicator Lunch & Learn Webinar Series
 
How we calculated the $ value of candidate experience and transformed the per...
How we calculated the $ value of candidate experience and transformed the per...How we calculated the $ value of candidate experience and transformed the per...
How we calculated the $ value of candidate experience and transformed the per...
 
Ph.D. defense: semantic social network analysis
Ph.D. defense: semantic social network analysisPh.D. defense: semantic social network analysis
Ph.D. defense: semantic social network analysis
 

Similar to Threat intelligence at the cloud

Akamai in a hyperconnected world
Akamai in a hyperconnected worldAkamai in a hyperconnected world
Akamai in a hyperconnected world
magda3695
 
Akamai in a hyperconnected world
Akamai in a hyperconnected worldAkamai in a hyperconnected world
Akamai in a hyperconnected world
magda3695
 
PLNOG 13: James Kretchmar: How Akamai scales to serve the largest events on t...
PLNOG 13: James Kretchmar: How Akamai scales to serve the largest events on t...PLNOG 13: James Kretchmar: How Akamai scales to serve the largest events on t...
PLNOG 13: James Kretchmar: How Akamai scales to serve the largest events on t...
PROIDEA
 

Similar to Threat intelligence at the cloud (20)

State of the Internet: Mirai, IOT and History of Botnets
State of the Internet: Mirai, IOT and History of BotnetsState of the Internet: Mirai, IOT and History of Botnets
State of the Internet: Mirai, IOT and History of Botnets
 
Big Data Intelligence - Or Katz, Akamai and Tsvika Klein, Akamai
Big Data Intelligence - Or Katz, Akamai and Tsvika Klein, AkamaiBig Data Intelligence - Or Katz, Akamai and Tsvika Klein, Akamai
Big Data Intelligence - Or Katz, Akamai and Tsvika Klein, Akamai
 
DESAYUNO DE TRABAJO AKAMAI
DESAYUNO DE TRABAJO AKAMAIDESAYUNO DE TRABAJO AKAMAI
DESAYUNO DE TRABAJO AKAMAI
 
Akamai in a hyperconnected world
Akamai in a hyperconnected worldAkamai in a hyperconnected world
Akamai in a hyperconnected world
 
Akamai in a hyperconnected world
Akamai in a hyperconnected worldAkamai in a hyperconnected world
Akamai in a hyperconnected world
 
Atmosphere 2014: Helping the Internet to scale since 1998 - Paweł Kuśmierski
Atmosphere 2014: Helping the Internet to scale since 1998 - Paweł KuśmierskiAtmosphere 2014: Helping the Internet to scale since 1998 - Paweł Kuśmierski
Atmosphere 2014: Helping the Internet to scale since 1998 - Paweł Kuśmierski
 
The Akamai Security Portfolio
The Akamai Security PortfolioThe Akamai Security Portfolio
The Akamai Security Portfolio
 
Tom uk soti_final_without video.4.21.15
Tom uk soti_final_without video.4.21.15Tom uk soti_final_without video.4.21.15
Tom uk soti_final_without video.4.21.15
 
Holiday Retail Readiness: Preparing For Peak
Holiday Retail Readiness: Preparing For PeakHoliday Retail Readiness: Preparing For Peak
Holiday Retail Readiness: Preparing For Peak
 
Beyond S3 Buckets - Effective Countermeasures for Emerging Cloud Threats
Beyond S3 Buckets - Effective Countermeasures for Emerging Cloud ThreatsBeyond S3 Buckets - Effective Countermeasures for Emerging Cloud Threats
Beyond S3 Buckets - Effective Countermeasures for Emerging Cloud Threats
 
2015 akamai ir_summit_show_file_v6_unanimated
2015 akamai ir_summit_show_file_v6_unanimated2015 akamai ir_summit_show_file_v6_unanimated
2015 akamai ir_summit_show_file_v6_unanimated
 
PLNOG 13: James Kretchmar: How Akamai scales to serve the largest events on t...
PLNOG 13: James Kretchmar: How Akamai scales to serve the largest events on t...PLNOG 13: James Kretchmar: How Akamai scales to serve the largest events on t...
PLNOG 13: James Kretchmar: How Akamai scales to serve the largest events on t...
 
How to Counter Cybersecurity Attacks - Trust No One
How to Counter Cybersecurity Attacks - Trust No OneHow to Counter Cybersecurity Attacks - Trust No One
How to Counter Cybersecurity Attacks - Trust No One
 
Zero trust in a hybrid architecture
Zero trust in a hybrid architectureZero trust in a hybrid architecture
Zero trust in a hybrid architecture
 
Bitglass Webinar - A Primer on CASBs and Cloud Security
Bitglass Webinar - A Primer on CASBs and Cloud SecurityBitglass Webinar - A Primer on CASBs and Cloud Security
Bitglass Webinar - A Primer on CASBs and Cloud Security
 
Jeroen Wijdogen (Akamai) | TU - Hacks & Attacks
Jeroen Wijdogen (Akamai) | TU - Hacks & AttacksJeroen Wijdogen (Akamai) | TU - Hacks & Attacks
Jeroen Wijdogen (Akamai) | TU - Hacks & Attacks
 
Closing the Loop on Web Application Vulnerabilities - John Dilley, Akamai
Closing the Loop on Web Application Vulnerabilities - John Dilley, AkamaiClosing the Loop on Web Application Vulnerabilities - John Dilley, Akamai
Closing the Loop on Web Application Vulnerabilities - John Dilley, Akamai
 
Great Expectations - Dr. Tom Leighton, Akamai
Great Expectations - Dr. Tom Leighton, AkamaiGreat Expectations - Dr. Tom Leighton, Akamai
Great Expectations - Dr. Tom Leighton, Akamai
 
Visibility and Automation for Enhanced Security
Visibility and Automation for Enhanced SecurityVisibility and Automation for Enhanced Security
Visibility and Automation for Enhanced Security
 
SACON - Incident Response Automation & Orchestration (Amit Modi)
SACON - Incident Response Automation & Orchestration (Amit Modi)SACON - Incident Response Automation & Orchestration (Amit Modi)
SACON - Incident Response Automation & Orchestration (Amit Modi)
 

Recently uploaded

Junnasandra Call Girls: 🍓 7737669865 🍓 High Profile Model Escorts | Bangalore...
Junnasandra Call Girls: 🍓 7737669865 🍓 High Profile Model Escorts | Bangalore...Junnasandra Call Girls: 🍓 7737669865 🍓 High Profile Model Escorts | Bangalore...
Junnasandra Call Girls: 🍓 7737669865 🍓 High Profile Model Escorts | Bangalore...
amitlee9823
 
FESE Capital Markets Fact Sheet 2024 Q1.pdf
FESE Capital Markets Fact Sheet 2024 Q1.pdfFESE Capital Markets Fact Sheet 2024 Q1.pdf
FESE Capital Markets Fact Sheet 2024 Q1.pdf
MarinCaroMartnezBerg
 
Abortion pills in Doha Qatar (+966572737505 ! Get Cytotec
Abortion pills in Doha Qatar (+966572737505 ! Get CytotecAbortion pills in Doha Qatar (+966572737505 ! Get Cytotec
Abortion pills in Doha Qatar (+966572737505 ! Get Cytotec
Abortion pills in Riyadh +966572737505 get cytotec
 
Escorts Service Kumaraswamy Layout ☎ 7737669865☎ Book Your One night Stand (B...
Escorts Service Kumaraswamy Layout ☎ 7737669865☎ Book Your One night Stand (B...Escorts Service Kumaraswamy Layout ☎ 7737669865☎ Book Your One night Stand (B...
Escorts Service Kumaraswamy Layout ☎ 7737669865☎ Book Your One night Stand (B...
amitlee9823
 
Call Girls Indiranagar Just Call 👗 7737669865 👗 Top Class Call Girl Service B...
Call Girls Indiranagar Just Call 👗 7737669865 👗 Top Class Call Girl Service B...Call Girls Indiranagar Just Call 👗 7737669865 👗 Top Class Call Girl Service B...
Call Girls Indiranagar Just Call 👗 7737669865 👗 Top Class Call Girl Service B...
amitlee9823
 
Jual Obat Aborsi Surabaya ( Asli No.1 ) 085657271886 Obat Penggugur Kandungan...
Jual Obat Aborsi Surabaya ( Asli No.1 ) 085657271886 Obat Penggugur Kandungan...Jual Obat Aborsi Surabaya ( Asli No.1 ) 085657271886 Obat Penggugur Kandungan...
Jual Obat Aborsi Surabaya ( Asli No.1 ) 085657271886 Obat Penggugur Kandungan...
ZurliaSoop
 
Call Girls In Bellandur ☎ 7737669865 🥵 Book Your One night Stand
Call Girls In Bellandur ☎ 7737669865 🥵 Book Your One night StandCall Girls In Bellandur ☎ 7737669865 🥵 Book Your One night Stand
Call Girls In Bellandur ☎ 7737669865 🥵 Book Your One night Stand
amitlee9823
 
Call Girls Begur Just Call 👗 7737669865 👗 Top Class Call Girl Service Bangalore
Call Girls Begur Just Call 👗 7737669865 👗 Top Class Call Girl Service BangaloreCall Girls Begur Just Call 👗 7737669865 👗 Top Class Call Girl Service Bangalore
Call Girls Begur Just Call 👗 7737669865 👗 Top Class Call Girl Service Bangalore
amitlee9823
 
Mg Road Call Girls Service: 🍓 7737669865 🍓 High Profile Model Escorts | Banga...
Mg Road Call Girls Service: 🍓 7737669865 🍓 High Profile Model Escorts | Banga...Mg Road Call Girls Service: 🍓 7737669865 🍓 High Profile Model Escorts | Banga...
Mg Road Call Girls Service: 🍓 7737669865 🍓 High Profile Model Escorts | Banga...
amitlee9823
 
Call Girls Hsr Layout Just Call 👗 7737669865 👗 Top Class Call Girl Service Ba...
Call Girls Hsr Layout Just Call 👗 7737669865 👗 Top Class Call Girl Service Ba...Call Girls Hsr Layout Just Call 👗 7737669865 👗 Top Class Call Girl Service Ba...
Call Girls Hsr Layout Just Call 👗 7737669865 👗 Top Class Call Girl Service Ba...
amitlee9823
 

Recently uploaded (20)

Junnasandra Call Girls: 🍓 7737669865 🍓 High Profile Model Escorts | Bangalore...
Junnasandra Call Girls: 🍓 7737669865 🍓 High Profile Model Escorts | Bangalore...Junnasandra Call Girls: 🍓 7737669865 🍓 High Profile Model Escorts | Bangalore...
Junnasandra Call Girls: 🍓 7737669865 🍓 High Profile Model Escorts | Bangalore...
 
Anomaly detection and data imputation within time series
Anomaly detection and data imputation within time seriesAnomaly detection and data imputation within time series
Anomaly detection and data imputation within time series
 
April 2024 - Crypto Market Report's Analysis
April 2024 - Crypto Market Report's AnalysisApril 2024 - Crypto Market Report's Analysis
April 2024 - Crypto Market Report's Analysis
 
Sampling (random) method and Non random.ppt
Sampling (random) method and Non random.pptSampling (random) method and Non random.ppt
Sampling (random) method and Non random.ppt
 
FESE Capital Markets Fact Sheet 2024 Q1.pdf
FESE Capital Markets Fact Sheet 2024 Q1.pdfFESE Capital Markets Fact Sheet 2024 Q1.pdf
FESE Capital Markets Fact Sheet 2024 Q1.pdf
 
Abortion pills in Doha Qatar (+966572737505 ! Get Cytotec
Abortion pills in Doha Qatar (+966572737505 ! Get CytotecAbortion pills in Doha Qatar (+966572737505 ! Get Cytotec
Abortion pills in Doha Qatar (+966572737505 ! Get Cytotec
 
Call me @ 9892124323 Cheap Rate Call Girls in Vashi with Real Photo 100% Secure
Call me @ 9892124323  Cheap Rate Call Girls in Vashi with Real Photo 100% SecureCall me @ 9892124323  Cheap Rate Call Girls in Vashi with Real Photo 100% Secure
Call me @ 9892124323 Cheap Rate Call Girls in Vashi with Real Photo 100% Secure
 
Escorts Service Kumaraswamy Layout ☎ 7737669865☎ Book Your One night Stand (B...
Escorts Service Kumaraswamy Layout ☎ 7737669865☎ Book Your One night Stand (B...Escorts Service Kumaraswamy Layout ☎ 7737669865☎ Book Your One night Stand (B...
Escorts Service Kumaraswamy Layout ☎ 7737669865☎ Book Your One night Stand (B...
 
Invezz.com - Grow your wealth with trading signals
Invezz.com - Grow your wealth with trading signalsInvezz.com - Grow your wealth with trading signals
Invezz.com - Grow your wealth with trading signals
 
Call Girls Indiranagar Just Call 👗 7737669865 👗 Top Class Call Girl Service B...
Call Girls Indiranagar Just Call 👗 7737669865 👗 Top Class Call Girl Service B...Call Girls Indiranagar Just Call 👗 7737669865 👗 Top Class Call Girl Service B...
Call Girls Indiranagar Just Call 👗 7737669865 👗 Top Class Call Girl Service B...
 
Jual Obat Aborsi Surabaya ( Asli No.1 ) 085657271886 Obat Penggugur Kandungan...
Jual Obat Aborsi Surabaya ( Asli No.1 ) 085657271886 Obat Penggugur Kandungan...Jual Obat Aborsi Surabaya ( Asli No.1 ) 085657271886 Obat Penggugur Kandungan...
Jual Obat Aborsi Surabaya ( Asli No.1 ) 085657271886 Obat Penggugur Kandungan...
 
ELKO dropshipping via API with DroFx.pptx
ELKO dropshipping via API with DroFx.pptxELKO dropshipping via API with DroFx.pptx
ELKO dropshipping via API with DroFx.pptx
 
Capstone Project on IBM Data Analytics Program
Capstone Project on IBM Data Analytics ProgramCapstone Project on IBM Data Analytics Program
Capstone Project on IBM Data Analytics Program
 
Call Girls In Bellandur ☎ 7737669865 🥵 Book Your One night Stand
Call Girls In Bellandur ☎ 7737669865 🥵 Book Your One night StandCall Girls In Bellandur ☎ 7737669865 🥵 Book Your One night Stand
Call Girls In Bellandur ☎ 7737669865 🥵 Book Your One night Stand
 
Call Girls Begur Just Call 👗 7737669865 👗 Top Class Call Girl Service Bangalore
Call Girls Begur Just Call 👗 7737669865 👗 Top Class Call Girl Service BangaloreCall Girls Begur Just Call 👗 7737669865 👗 Top Class Call Girl Service Bangalore
Call Girls Begur Just Call 👗 7737669865 👗 Top Class Call Girl Service Bangalore
 
Mature dropshipping via API with DroFx.pptx
Mature dropshipping via API with DroFx.pptxMature dropshipping via API with DroFx.pptx
Mature dropshipping via API with DroFx.pptx
 
BDSM⚡Call Girls in Mandawali Delhi >༒8448380779 Escort Service
BDSM⚡Call Girls in Mandawali Delhi >༒8448380779 Escort ServiceBDSM⚡Call Girls in Mandawali Delhi >༒8448380779 Escort Service
BDSM⚡Call Girls in Mandawali Delhi >༒8448380779 Escort Service
 
Mg Road Call Girls Service: 🍓 7737669865 🍓 High Profile Model Escorts | Banga...
Mg Road Call Girls Service: 🍓 7737669865 🍓 High Profile Model Escorts | Banga...Mg Road Call Girls Service: 🍓 7737669865 🍓 High Profile Model Escorts | Banga...
Mg Road Call Girls Service: 🍓 7737669865 🍓 High Profile Model Escorts | Banga...
 
Call Girls Hsr Layout Just Call 👗 7737669865 👗 Top Class Call Girl Service Ba...
Call Girls Hsr Layout Just Call 👗 7737669865 👗 Top Class Call Girl Service Ba...Call Girls Hsr Layout Just Call 👗 7737669865 👗 Top Class Call Girl Service Ba...
Call Girls Hsr Layout Just Call 👗 7737669865 👗 Top Class Call Girl Service Ba...
 
CebaBaby dropshipping via API with DroFX.pptx
CebaBaby dropshipping via API with DroFX.pptxCebaBaby dropshipping via API with DroFX.pptx
CebaBaby dropshipping via API with DroFX.pptx
 

Threat intelligence at the cloud

  • 1. Threat Intelligence At The Cloud Or Katz - Principal Security Researcher Ezra Caltum - Senior Security Researcher
  • 2. ©2015 AKAMAI | FASTER FORWARDTM Hide and Seek
  • 3. ©2015 AKAMAI | FASTER FORWARDTM Hide and Seek Akamai Cloud The Playground? Who is Hiding? Who is Seeking? The Goal of the Game? Threat Actors Find malicious activity and create actionable threat intelligence
  • 4. ©2015 AKAMAI | FASTER FORWARDTM Hide: Threat Actors
  • 5. ©2015 AKAMAI | FASTER FORWARDTM Seek: Akamai Threat Research Team Akamai’s State of The Internet Report Research Publication Thought Leadership
  • 6. ©2015 AKAMAI | FASTER FORWARDTM The Platform •  167,000+ Servers •  750+ Cities •  92 Countries The Data •  2 trillion hits per day •  260+ terabytes of compressed daily logs Playground: Akamai’s Content Delivery Network (CDN) Data Centers End User
  • 7. ©2015 AKAMAI | FASTER FORWARDTM The Goal: Threat Intelligence Highlights of threat intelligence: •  New insights •  Forecast future threats •  Digested output •  Actionable According to Gartner: “Threat intelligence is evidence-based knowledge, including context, mechanisms, indicators, implications and actionable advice, about an existing or emerging menace or hazard”
  • 8. ©2015 AKAMAI | FASTER FORWARDTM Why Threat Intelligence At the Cloud? Volume, Velocity and Variety Leading to better: • visibility to threat landscape • Insights • Future threats forecasting • Security level
  • 9. ©2015 AKAMAI | FASTER FORWARDTM Case Study – Slow & Low Customer: “Some of the Web site accounts had been taken over, I suspect that it was a brute force attack”
  • 10. ©2015 AKAMAI | FASTER FORWARDTM Web Brute Force Also known as: Password guessing attack User: Ezra Password: 123456 Brute Forcer Web Application
  • 11. ©2015 AKAMAI | FASTER FORWARDTM Brute Force - Common vs. Advanced Common •  Attack method – Brute force flood •  Attacking resources – single/few •  Detection technique – Noisy logs •  Protection - Rate control Advanced •  Attack method – Brute force slow and low •  Attacking resources – multiple/Botnet •  Detection technique – ? •  Protection - ?
  • 12. ©2015 AKAMAI | FASTER FORWARDTM Slow & Low – On Site Threat Intelligence Step 1 (on-site) Analyzing each IP address activity per Web application Step 2 (on-site) Analyzing aggregated Web application login attempts per hour Resource Application 5 ~ 12 login attempts per hour ~50 login attempts per hour
  • 13. ©2015 AKAMAI | FASTER FORWARDTM Slow and Low – At Cloud Step 3 (cloud) Tracking brute forcer across the cloud! Monitoring all IP addresses activity on all targeted Web application 1.  Each Botnet member target 100 ~ 300 Web applications 2.  Botnet execute ~10,000 login attempts per hour over Cloud network 3.  Botnet is running over the same virtual hosting service provider 4.  The Botnet was active at least few months before detected BINGO
  • 14. ©2015 AKAMAI | FASTER FORWARDTM On-site vs. Cloud On-Site Cloud
  • 15. ©2015 AKAMAI | FASTER FORWARDTM Brute Force Botnet
  • 16. ©2015 AKAMAI | FASTER FORWARDTM Brute Force by Industry Segment
  • 17. ©2015 AKAMAI | FASTER FORWARDTM Actionable Insight •  Tactical controls - Block any login attempts initiated from detected Botnet •  Strategic controls - Adjust security control brute force rate mitigations •  GEO intelligence - Restrict GEO login •  Present threat Intel. - Detection based on cross targeted correlation •  Future threat Intel. - Forecasting based on industry intelligence
  • 18. ©2015 AKAMAI | FASTER FORWARDTM Summary •  Cloud platform can yield unique actionable threat intelligence •  Cloud threat intelligence introduce the ability to use cross targets, cross industry and evasive techniques in order to produce unique threat intelligence •  Using gaming techniques while at work is fun! •  When you are 195cm tall it is hard to find good hiding places
  • 19. ©2015 AKAMAI | FASTER FORWARDTM Ezra Caltum - @aCaltum Or Katz - @or_katz