Hey guys one of my client having a concern about the security patch. he has PA-820 PA and PA-220. The New DDOS attack is there ID is CIAD-2021-0030
https://clicktime.symantec.com/3QdtY9QLh9kb4B5ny33Z2KD7Vc?u=https%3A%2F%2Fwww.cert-in.org.in%2F
Please check the Palo alto firewall is capable to handle this attack. is Palo alto have this security patch. I also mention the details about attack
Severity Rating: High
Description
A potential new method of DDoS attack has been identified that exploit a
loophole in the security middle boxes such as Intrusion Prevention Systems
(IPS), NextGen Firewalls, Network Address Translators (NATs) and Load
balancers etc.
The attack is carried out by sending a specially crafted sequence of
packets to misconfigured security middle boxes deceiving it into believing
a 3-way handshake is completed thus allowing TCP communication. The
attacker sends an HTTP request for a website likely to be blocked at the
security device, spoofing the IP Address of the victim, to which the
security device responds with a large HTML blocking notification page which
results in amplification effect. It is reported that the attacker can
achieve an amplification factor up to 100,000,000.
II. Measures to be adopted to protect against DDoS attacks.
1. Measures for detection of attacks:
Understand your current environment and have a baseline of the daily
volume, type and performance of network traffic.
Enable adequate logging mechanisms at perimeter, server, system level and
review the logs at frequent intervals.
Continuously monitor the network activities & server logs to detect and
mitigate suspicious and malicious activities in your network. Review the
traffic patterns and logs of perimeter devices to detect anomalies in
traffic, network level floods(TCP, UDP, SYN, etc.) and application floods
(HTTP GET) etc.
Preserve all logs indicating type of attack and attack sources.
2. Protection measures:
Thoroughly scan the network and online applications and plug any existing
vulnerability in the network devices, operating systems, server software
and application software and apply latest patches/updates as applicable.
Employ defense-in-depth strategies: emphasize multiple, overlapping and
mutually supportive defensive systems to guard against single point
failures in any specific technology and protection method.
Deploy appropriate Intrusion/DDoS Prevention System capable of detecting
and mitigating DDoS attacks. Ensure that Intrusion/DDoS Prevention System
contain signatures to detect the attacks launched from common attack tools.
Sudden surge in inbound traffic to any critical server or services, such as
ICMP floods, UDP/TCP flood etc. could be due to DDoS attacks. If such
attacks are observed, implement appropriate response measures in
coordination with Internet Service Provider (ISP).
Identify and block the attack sources at Router/Packet filtering
device/DDoS prevention solutions. Disable non-essential ports/services.
To counter attacks on applications, check the integrity of critical
application files periodically and in case of suspicion of attack restore
applications and content from trusted backups.
Maintain list of contacts of ISPs, vendors of network and security devices
and contact them as appropriate.
In case your SLA with ISP includes DDoS mitigation services instruct your
staff about the requirements to be sent to ISP.
Have a Business Continuity Plan and Disaster Recovery Plan ready for
activation in case of emergency.
