Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Network Denial of Service:  Прямое увеличение сетевого трафика

Adversaries may attempt to cause a denial of service (DoS) by directly sending a high-volume of network traffic to a target. This DoS attack may also reduce the availability and functionality of the targeted system(s) and network. Direct Network Floods are when one or more systems are used to send a high-volume of network packets towards the targeted service's network. Almost any network protocol may be used for flooding. Stateless protocols such as UDP or ICMP are commonly used but stateful protocols such as TCP can be used as well. Botnets are commonly used to conduct network flooding attacks against networks and services. Large botnets can generate a significant amount of traffic from systems spread across the global Internet. Adversaries may have the resources to build out and control their own botnet infrastructure or may rent time on an existing botnet to conduct an attack. In some of the worst cases for distributed DoS (DDoS), so many systems are used to generate the flood that each one only needs to send out a small amount of traffic to produce enough volume to saturate the target network. In such circumstances, distinguishing DDoS traffic from legitimate clients becomes exceedingly difficult. Botnets have been used in some of the most high-profile DDoS flooding attacks, such as the 2012 series of incidents that targeted major US banks.(Citation: USNYAG IranianBotnet March 2016)

ID: T1498.001
Относится к технике:  T1498
Тактика(-и): Impact
Платформы: Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Источники данных: Network Traffic: Network Traffic Flow, Sensor Health: Host Status
Тип влияния: Availability
Версия: 1.3
Дата создания: 02 Mar 2020
Последнее изменение: 19 Apr 2022

Контрмеры

Контрмера Описание
Filter Network Traffic

Use network appliances to filter ingress or egress traffic and perform protocol-based filtering. Configure software on endpoints to filter network traffic.

Обнаружение

Detection of a network flood can sometimes be achieved before the traffic volume is sufficient to cause impact to the availability of the service, but such response time typically requires very aggressive monitoring and responsiveness or services provided by an upstream network service provider. Typical network throughput monitoring tools such as netflow(Citation: Cisco DoSdetectNetflow), SNMP, and custom scripts can be used to detect sudden increases in network or service utilization. Real-time, automated, and qualitative study of the network traffic can identify a sudden surge in one type of protocol can be used to detect a network flood event as it starts. Often, the lead time may be small and the indicator of an event availability of the network or service drops. The analysis tools mentioned can then be used to determine the type of DoS causing the outage and help with remediation.

Каталоги

БДУ ФСТЭК:
УБИ.140 Угроза приведения системы в состояние "отказ в обслуживании"
Угроза заключается в возможности отказа дискредитированной системой в доступе легальным пользователям при лавинообразном увеличе...
УБИ.153 Угроза усиления воздействия на вычислительные ресурсы пользователей при помощи сторонних серверов
Угроза заключается в возможности осуществления нарушителем опосредованного деструктивного программного воздействия на дискредити...