Does a Unified Threat Management appliance (UTM) with Intrusion Prevention (IPS) enabled have the ability to prevent a DDoS attack? I have read some articles and none of them have a perfect explanation.
No, generally not, although of course they say they can.
- DDoS is about volume
- UTM is almost always at the local end of Internet access
- Therefore, DDoS can usually fill the Internet pipe before even reaching a UTM device.
The reasoning -
By definition a DDoS - being Distributed - is taking advantage of multiple attack points to generate a level of traffic which overwhelms the victim. Unlike a DoS, which may rely upon clever tricks and fragile IP stacks to cause problems based on the parsing of traffic, a DDoS is all about the volume.
Let's say that you've got a big site sitting at the end of a 10 Gigabit link. Your ISP, of course, can handle much higher volume, but when their router connects to your router, they're only allowing 10 Gbps through.
Now an attacker sends 321 Gbps of traffic to you. What's your UTM going to do? It can only work with the meager 10 Gbps trickle, and the most it can do is turn it away - but at that point, the damage has already been done. Your legitimate traffic is already disrupted and probably not making it in to you because the line is busy.
For protection from DDoS, you need to turn to someone like Prolexic (now part of Akamai, but Akamai does other stuff too, so I use their old name to reduce ambiguity). These providers have massive bandwidth, and during an attack your re-route your traffic through them, and only they're allowed to send traffic along to you. They can buffer the attack and try to identify and drop the bad traffic before it traverses your puny 10 Gig link.
I don't doubt many UTM devices still say they can help with DDoS. My car also claims to be rustproof, but I've got rust spots. A true DDoS can't be mitigated at the endpoint, and UTMs are almost always at the endpoint.
No single measure can effectively prevent DDoS attacks. You can, however, reroute traffic or reconfigure the network infrastructure (both logical and physical, which might cause a bit of an overhead, but still, availability is key) in attempt to still deliver your content and reduce the incoming DDoS traffic.
The reason why DDoS is such a lingering threat is that, besides from its source being external to your data center, DDoS traffic can also come from within the data center. As such, IDS and IPS, which are traditionally placed at the borders, are both useless in this case. The following is a scenario in which internal DDoS attacks can happen and that alternate preventive mechanisms are needed:
A number of data centers are under-provisioned, which means an uplink connecting multiple subnets have the same transmitting capacity as does a single device residing in each of the subnets. As a result, if four machines start pushing out 1 GB of data each over a 1-GB uplink, the link will be saturated and effectively disconnecting the associated subnets from the rest of the data center. That is an internal DDoS - maybe one by poor architectural design in this case. However, utilizing this design weakness, attackers can simply identify one of these under-provisioned uplinks and the connected subnets, legitimately sign up for an account (say, at Amazon EC2) to host some virtual machines in it, and begin transmitting data to a targeted machine in an adjacent subnet via the vulnerable link. The result is a DDoS attack. There would be no way of telling it is going to happen. No single protective measures can instantaneously "block" the coming traffic.
Some data centers implement the heartbeat protocol to detect congestion. Congestion might happen at the point the novice attacker is probing for vulnerable subnets to flood them, so ideally this is the stage when you should begin rerouting your traffic and reconfiguring the network. However, experienced attackers will be careful in not completely flooding the network with probes. As a result, heartbeat will not detect unusual amount of traffic and therefore will not activate a standby.
Actually, the question is about can or cannot, not about how or how much, and therefore IDS and UTM systems claims some level of DDoS defense. Not complete defense, because in theory there is no complete defense against DDoS attack. Almost every modern firewall and intrusion protection system (IPS) claims some level of DDoS defense.
Some Unified Threat Management (UTM) devices or Next Generation Firewalls (NGFWs) offer Anti-DDoS services and can mitigate many DDoS attacks.
UTM devices and IPS devices can effectively identify the DDoS attack messages through use of advanced techniques, most of these devices are usually designed to conduct in-depth stateful inspection of all the messages.