In our final section we are going to examine data from multiple sources. We will begin by introducing the notion of attackers working together; then we will discuss defenders working together. From an attacker’s standpoint, there are two primary advantages to coordinated or distributed attacks: | Coordinated Attacks multiple attackers working together to increase their stealth and firepower IDIC - SANS GIAC LevelTwo 2000 2001 1 In our final section we are going to examine data from multiple sources. We will begin by introducing the notion of attackers working together then we will discuss defenders working together. From an attacker s standpoint there are two primary advantages to coordinated or distributed attacks - Stealth. By working from multiple IP addresses the attackers are more difficult to detect. In addition stealth is enhanced by the development of hard-to-detect probing techniques. - Firepower. By coordinating multiple attacking IP addresses the attackers will be able to deliver more exploits at a target in a smaller time window. The target in this case can be one or more sites. Further the defense technique of blocking an attacker site shunning will be less effective. 1 External Network Mapping Simultaneous Traceroutes 10 32 udp 12 10 32 udp 12 10 32 udp 12 10 32 udp 12 10 32 udp 12 10 32 udp 12 10 32 udp 12 10 32 udp 12 10 32 udp 12 10 32 udp 12 10 32 udp 12 10 32 udp 12 10 32 udp 12 10 32 udp 12 10 32 udp 12 10 32 udp 12 10 32 .
