[MUSIC PLAYING]
CASSIE KOZYRKOV: Hello and welcome.
We're here at the Security Zone at Google Next with Prajakta,
who is one of Google's leading experts in denial
of service attacks.
Hi, Prajakta.
PRAJAKTA JOSHI: Hi, Cassie.
And thank you for having me.
CASSIE KOZYRKOV: When companies deploy
internet-facing services, one of the biggest problems
they encounter is denial of service attacks.
PRAJAKTA JOSHI: So our customers have a tough job.
They want to quickly and responsively serve their end
users and, at the same time, they
need to defend their internet facing services
against malicious attacks.
And denial of service attacks are getting much larger,
they're getting much more sophisticated,
and security teams need to be prepared for them.
So let's look at an example.
Let's say you're the infrastructure
manager for an online retailer and it's
Black Friday, the busiest day of the year for you,
and you've got an important job.
You need to make sure that the website and apps stay up
and running.
So Black Friday has started, and here, we
can see all of the successful transactions represented
as boxes coming into the application servers.
Everything looks to be running smoothly now,
but let's see what happens once an attack is launched.
CASSIE KOZYRKOV: Awesome.
Do your worst.
SPEAKER: The first attack I'm going to launch
is a high volume DDoS attack.
I'm going to use this to try and overwhelm the servers
with malicious traffic.
[MUSIC PLAYING]
PRAJAKTA JOSHI: We can see that the application instances are
being overwhelmed by the malicious traffic
from the attacker's servers.
CASSIE KOZYRKOV: If this amount of traffic
keeps hitting the application instances,
they'll get overloaded, and they'll go down.
PRAJAKTA JOSHI: That's correct.
Shoppers on the website are already
getting a slow load time and the website
is going to start crashing.
Now, as the infrastructure manager,
you do have some tools at your disposal to manage this.
What do you think would be the best way to go handle this?
CASSIE KOZYRKOV: I'm going to go with infrastructure DDoS
protection using Google Global Load Balancer.
PRAJAKTA JOSHI: Great choice.
After you enable the Google Global Load Balancer,
the application instances are back up and running
and shoppers are now able to access
the site without a problem.
Now, in this example, you turned on this defense
in the middle of a live attack.
But in reality, you would have actually already set up
your services behind the Global Load Balancer,
prior to Black Friday.
But Black Friday isn't over yet.
In fact, our shoppers are just getting started.
Let's see what happens when the attacker launches
an application attack this time.
SPEAKER: This time, I'm going to launch a SQL injection attack.
PRAJAKTA JOSHI: So now our attacker
is sending in SQL injection packets in an attempt
to bring down our service and steal data.
With SQL injection one little flaw
in one little feature of your application
can compromise all the data for your app.
Again, you've got some tools at your disposal.
What do you think is a good defense for this type
of attack?
CASSIE KOZYRKOV: I'd pick Cloud Armor SQL Injection Defense.
PRAJAKTA JOSHI: Good choice, again.
This Cloud Armor rule acts as a defense
to these types of attacks by automatically identifying
malicious SQL injection packets and blocking them before they
hit your application instances.
Without Cloud Armor you would have
to first detect SQL injection attack,
and then react, remediate, and also fix your code and data.
CASSIE KOZYRKOV: Got it.
So this means just enabling this single rule
would defend our app against all SQL injection attacks.
PRAJAKTA JOSHI: That's correct.
But the day isn't done yet, and our sophisticated attacker
is going to come at us again.
SPEAKER: For this last attack, I'm
going to use a multi-vector attack, which
is going to hit the application instances using
multiple different types of attack vectors all at once.
[MUSIC PLAYING]
PRAJAKTA JOSHI: Now, we can see that a multi-vector attack is
hitting the servers and trying to take them out.
And it looks like all of this traffic
is coming from one region.
Again, the service is slowing down
and our shoppers aren't able to submit their orders.
After analyzing this attack, we find out
that it's coming from a single location with a specific type
of cookie and user agent.
CASSIE KOZYRKOV: Aha.
So maybe we could create a custom rule
in Cloud Armor that looks for this cookie and user
agent in the traffic coming from the region?
PRAJAKTA JOSHI: Exactly.
That's correct.
Now you see the Cloud Armor custom rule
blocking the traffic that matches
our specified pattern, which helps keep our service up
and running.
CASSIE KOZYRKOV: I feel like now I
know a lot more about what our retail customers have
to deal with on Black Friday.
I have a lot more empathy for them.
It's pretty challenging.
PRAJAKTA JOSHI: With Google Cloud's tools
to help defend and scale against this infrastructure
and application denial of service attacks in place,
you can actually focus on building great software
and great customer experiences.
CASSIE KOZYRKOV: Thanks so much for walking us
through this demo, Prajakta.
And thank you, [? Srina, ?] for this very admirable attack
attempt.
SPEAKER: Thank you.
PRAJAKTA JOSHI: Thank you for having me, Cassie.
[MUSIC PLAYING]