Join this webinar with guest speaker Christopher Rodriguez, Research Manager of Cybersecurity Products for IDC and Cloudflare, recently named a Leader in the IDC MarketScape: Worldwide DDoS Prevention Solutions 2019 Vendor Assessment (Doc #US43699318, March 2019). In this webinar, you will learn: - Why defending against only volumetric layer 3 and 4 attacks will leave you vulnerable to other emerging DDoS attack vectors - What economic and technological shifts are making DDoS more harmful and more evasive - Why bot management should be considered in every DDoS mitigation strategy - Which types of companies in North America are highly targeted and why

1. Defending Threats Beyond DDoS Attacks
Featuring Guest Speaker from IDC

2. What you will learn today
2
How is DDoS evolving? Why should bot management
also be part of your DDoS
mitigation strategy?
How Cloudflare helps you
address these challenges

3. Today’s Speakers
Timothy Fong
Product Marketing Lead,
Security Solutions @
Cloudflare
Chris Rodriguez
Research Manager,
Cybersecurity Products @
IDC

4. We are helping
build a better
Internet
4

5. 5
Cloudflare Security Vision
Provide world-class visibility, controls, and guided
configurations so that customers of any size and
technical sophistication can keep their Internet property
safe and secure without sacrificing speed and
performance
5

6. A Global Anycast Network
175+Data centers globally
2.8B
Monthly active visitors
generating 1.3 trillion
page view
10%Internet requests
everyday
8MRequests/second
websites, apps & APIs
in 150+ countries
13M+
2x
Speed up each
request by

7. Rate
Limiting
SSL
L3/4 DDoS
Protection
`
We secure traffic end-to-end, providing a layered
defense
Request Passed!
Bot
Management
WAFDNS/DNSSEC
Argo
Tunnel
7
Orbit Spectrum
EXTEND
WorkersAccess
CONTROL
7
L7 DDoS
Protection

8. Factors increasing exposure to security risks
Greater scrutiny by
government and media
around data, privacy
and security
Greater attack surface area
from more public APIs, moving
to the cloud, and increasing
third-party integrations
Stronger and more
sophisticated attackers

9. IDC MarketScape: WW DDoS Prevention Solutions
IDC MarketScape vendor analysis model is designed to provide an overview of the competitive fitness of ICT suppliers in a given market. The research methodology utilizes a
rigorous scoring methodology based on both qualitative and quantitative criteria that results in a single graphical illustration of each vendor’s position within a given market. The
Capabilities score measures vendor product, go-to-market and business execution in the short-term. The Strategy score measures alignment of vendor strategies with customer
requirements in a 3-5-year timeframe. Vendor market share is represented by the size of the icons.
Cloudflare is positioned as a
Leader
in the IDC MarketScape:
Worldwide DDoS Prevention
Solutions 2019 Assessment
According to IDC, Cloudflare Strengths are its
"unique architecture" and "rapid on-boarding
process which is considered one of the easiest
and fastest in the industry."
Source: IDC MarketScape: Worldwide DDoS Prevention Solutions 2019
Vendor Assessment, by Martha Vazquez, March 2019, IDC
#US43699318
Report Link: here

10. Chris Rodriguez is a Research Manager in IDC's Cybersecurity product
research group focused on the products designed to secure today’s
complex enterprise networks.
IDC's cybersecurity research offerings to which Chris contributes include
Endpoint Security, Network Security Products and Strategies; Security
Analytics, Intelligence, Response, and Orchestration (Security AIRO); and
Identity & Access Management research programs.
10© IDC
Today’s Presenter

11. Top Trends in Today’s DDoS Attacks
11© IDC
▪ Volumetric attack; TCP exhaustion ; Application layer; Multi-vector
▪ Volumetric to various
types of DDoS
attacks, such as TCP
exhaustion ,
application layer,
multi-vector
▪ IoT connected
devices is becoming
a major force
behind DDoS attacks
▪ Highly profitable
and low entry (e.g.
Script Kiddies)
▪ Convergence of
DDoS attack and
fraud (e.g. targeting
at business logics)

12. Over 50% of Respondents Had Been Attacked Between 1-10 Times in the Past Year
With Over 60% Attacks Lasting an Average of 0-10 Hours
12© IDC
Q. How frequently did your organization experience a DDoS attack in the past year?
Q. If you experienced a DDoS attack, on average, how long did the attack last?
🞀 ToCSource: DDoS Prevention Survey, January 2018, IDC
Frequency of Attacks Duration of Attacks

13. Prominent Types of DDoS Attacks
13© IDC
Q. What type of attacks did you experience?
🞀 ToCSource: IDC DDoS Prevention Survey, January 2018, n=140
• TCP exhaustion (focuses on web servers, firewalls, and
load balancers to disrupt connections, thus exhausting
the finite number of concurrent connections devices
can support)
• Application layer attacks (also known as Layer 7 attacks,
specifically targets weaknesses in an application or
server with the goal of establishing a connection and
exhausting it by monopolizing processes and
transactions)
• Multivector attacks (combine volumetric attacks, stateful
exhaustion attacks, and application-layer attacks)
• DDoS attacks with ransom requests
• DDoS attacks as smoke screen

14. Multi-vector DDoS Attacks
14
Nearly half of impacted organizations say their DDoS attacks coincided with some form of breach or malicious
activity on their networks, including theft and ransomware.

15. 15© IDC
Q. Which type of DDoS mitigation solutions do you use?
🞀 ToC
Source: DDoS Prevention Survey, January 2018, IDC n =138
Adoption Trends in DDoS Mitigation Solutions
• 47% of organizations are using
hybrid deployments to protect
against the broadest set of
potential attack vector
• 23% - 26% of respondents
report plans to move to 100%
cloud, hosted, and SaaS
solutions

16. Businesses Spending More on DDoS Protection
16© IDC
▪ Customers are ramping up DDoS protection
• Majority of organizations do plan to increase spend in DDoS solutions
• Most are looking at increasing their spending from 6-15%.
n =129 n =110
Base = All Respondents
Source: DDoS Prevention Survey, January 2018, IDC

17. Growing Demand for DDoS Mitigation
17© IDC
▪ Elevated DDoS risk drives mitigation market on-premises products and cloud services
• DDoS mitigation services growing at CAGR of 17.8% through 2022.
Source: Worldwide DDoS Prevention Products and
Services Forecast, 2018–2022, July 2018, IDC
On-prem
Products
Cloud
Services

18. The Intersection Between DDoS and Bot Risk
18© IDC
▪ DDoS is a business operations attack, and bots are the next frontier
▪ Early bots: DDoS,
spam, malware
propagation
▪ New bots: IoT, mobile
▪ Bot fraud: click-
fraud, fake account
activity, ad fraud,
comment spam
▪ Business logic
abuse: data
harvesting, scraping,
scalping, operations
sabotage
▪ Security threats:
credential stuffing,
account takeover,
others (future??)

19. Business Logic Is Important
19
▪ Business logic is key to success, and yet, vulnerable
© IDC19
1. Business
Need
2. Marketing
Idea
3.
Promotion
4. Execution
5. Customer
Experience
6. Drives New
Business
Customer
Engagement
and Brand
Building
▪ Develop brand and
reputation
▪ Drive customer
engagement
▪ Build good will with
customers

20. Attacking Business Logic for Profit Harms Everyone
20
▪ Business logic is vulnerable and lucrative attack vector for bot operators.
© IDC20
1. Business
Need
2. Marketing
Idea
3. (Failed)
Promotion
4. (Poor)
Execution
5. (Bad) Customer
Experience
6. [Deters] New
Business
Customer
Engagement
and Brand
Building
▪ Not always malicious
▪ Lucrative for attackers
▪ Harms the customer
experience
▪ Hard to quantify
▪ Hard to detect
▪ Not well understood
Scalper
Inventory
Hoarders
Ad Fraud

21. Benign Malicious
▪ Search engine bots
▪ Partner systems
▪ Web indexing
▪ Archiving
Benign / Beneficial
▪ Data collection
▪ Inventory hoarding
▪ Ad fraud / Skewed
metrics
▪ Scalping
Unwanted/
Objectionable/ Legal
▪ Credential stuffing
▪ Account takeover
▪ Others (future?
unknown?)
Security Threat/ Fraud /
Possibly Illegal
The Bot Risk Spectrum
21© IDC 21
▪ Bot risk is a spectrum that is unique for each industry and organization

22. Bot Risk Is Escalating
22
▪ Awareness of bot risk increased substantially in 2018.
© IDC22
Source: various media clips, 2018 -2019

23. Bot Risk Evolves but Never Disappears
23© IDC
▪ Some types of bots are still used for DDoS attacks..

24. ▪ Get the facts. To assess the imminent risk and determine what action to take and, perhaps more importantly,
communicate to senior management, you must determine who, what, where, when, and how at a broad level.
▪ Identify, friend or foe. With facts in hand, now you can determine whether your organization is a target, in line
for collateral damage, or reasonably unaffected.
▪ Take action. If you haven't planned for an outage or the attack exceeds your capacity, your immediate response
options are limited to network reconfiguration or isolation (e.g., pulling the plug).
▪ Spread the (accurate) word. With major outages, communication is key. Remember, there could be all sorts of
rumors spreading that can only be addressed with specifics of the organization's plan.
▪ Kick the tires. Even if your organization is not the target, these are excellent real-world scenarios that allow
organizations to work through their protection mechanisms as if they are affected.
▪ Watch your back. Perhaps the more insidious opportunity for attackers during big splashy failures like these is to
execute targeted attacks undercover, using the event as a distraction.
▪ Be a good neighbor. In today's interconnected world, your technical presence on the internet affects others.
Downstream liability due to perceived negligence is a budding concern for many.
© IDC 24
The CIOs’ Seven-Step Checklist for Internet Availability
Source: IDC #US41895416, Nov2016 DNS DDoS Debacle: The CIO's Seven-Step Checklist for Internet Availability

25. Timothy Fong
Security Lead, Product Marketing Manager @ Cloudflare

26. Industry Legacy Scrubbing vs. Cloudflare Always-On
26
Industry Legacy Scrubbing
- Long propagation times (up to 300 sec)
- Asynchronous routing
- Adds significant latency
- Typically requires manual intervention
Always-On
- Zero propagation time
- Synchronous routing
- No added latency
- Immediate, automated mitigation,
with no “cut over” required

27. Cloudflare DDoS Solution
27
Protect Non HTTP Ports
Spectrum protects non-
HTTP ports open to the
Internet with the same
distributed architecture
Custom Rate Limiting
Customers can tune
Layer 7 protections to
their specific
applications and traffic
profile through rate
limiting rules.
Resilient DNS
Cloudflare’s resilient
DNS protects customers
from going down
because their DNS is
overwhelmed by a
volumetric attack.
Always On DDoS
With automatic
heuristics and a
distributed Anycast
network, Cloudflare’s
Always On DDoS detects
and mitigates Layer ¾
and Layer 7 attacks at
scale.

28. Cloudflare DDoS Differentiation
28
Easy Deployment
Easy to turn-on
protections that mitigate
within minutes and
remain “always on”
without requiring
ongoing maintenance or
configuration.
Integrated
Our integration with Bot
Management and
Firewall Rules gives
additional capabilities
from a single control
plane.
Scale
As our network
continues to grows, so
does our capacity and
data-driven insight to
block attacks
automatically.

29. Bot Management Use Cases
Attempts to log into and
take-over a user’s
account by automatically
applying previously
stolen account
credentials
Steals public information
from a website
Adds malicious content to
web properties such as
forums and registration
forms
Credential
Stuffing
Content
Scraping
Content
Spam
Fraudulently purchases
goods to deprive legitimate
customers or resell for a
higher price
Inventory
Hoarding
Credit Card
Stuffing
Tries to validate stolen
credit cards to then
make fraudulent
purchases
29

30. Cloudflare Bot Management
One-Click Deployment
● With a single click, deploy rules with Cloudflare recommended bot score thresholds
● No instrumentation with third-party JavaScript required
Control and Configurability
● Scope rules by path or URI pattern, request method, and bot score thresholds
● Select mitigation methods, such as log, CAPTCHA, or block
Rich Analytics and Logs
● Time-series graphs with drill-down tables
● Logs bot management rule, action, and rich request meta-data for every request
Detect and mitigate bad bots by leveraging intelligence from over 13 million Internet
properties. All with one click.

31. Cloudflare Bot Management Methods
Machine Learning
Cloudflare’s ML trains on a
curated subset of more than
475 billion requests per day
across 13M+ Internet properties
to create a reliable “bot score” for
every request.
Behavioral Analysis
Behavioral analysis detects
anomalies in site-specific traffic,
scoring every request on how
different it is from the baseline.
Automatic Whitelist
Because not all bots are bad,
the solution automatically
maintains and updates a
white list of "good" bots, such
as those belonging to search
engines.
Mobile SDK
The mobile SDK prevents
attacks against mobile
application APIs by
impersonation and emulation
bots.
31
Detection Protection

32. Cloudflare Bot Management Differentiation
32
Integrated Complete not Complex
Cloudflare Bot Management is best-in-class
both as a stand-alone solution and as
integrated with WAF and DDoS protection:
● Streamlines deployment by integrating
with a CDN and smart routing for origin
traffic.
● Shares control plane through UI and API
with WAF and Firewall Rules for better
consistency and lower context switching
● Gives a holistic view through common
analytics and logs
Deploys a bot management solution against a
full range of bot attacks with a single click:
● Deploys protections against content/price
scraping, credential and credit card
stuffing, content spam, and inventory
hoarding -- all in one click.
● Fingerprints all traffic without requiring
Javascript injection
● Suggested rules work out-of-the box. No
fiddling and endless configuration required
to get solid results
Smart Data
Cloudflare Bot Management leverages the
trillions of requests per day processed from
protecting 13M+ Internet properties:
● Machine learning trains on data curated
from 475B requests per day and analyzed
on a state-of-the-art GPU cluster
● Our data set contains traffic from over 150
countries
● Learnings from one website are
immediately applied to the whole network

33. Summary
33
How DDoS is evolving Why should bot management
also be part of your DDoS
mitigation strategy
How Cloudflare helps you
address these challenges

34. Questions?

35. Thank You