2006 FIFA World Cup Germany network withstands two months of relentless hacker attacks, still reaches goal line free of penalties for security or appl

Despite more than five million unique firewall events that occurred each day - including 128 000 that made it past the network firewalls - not a single security-related or application outage occurred from 15 May to 9 July, on the world`s largest converged communication network built by Avaya Inc for the 2006 FIFA World Cup Germany.

The converged network Avaya built for FIFA handled more than 21 trillion bytes of voice and data traffic - including players` and journalists` accreditations, photo transmissions and match details sent around the world in real-time and ultimately transmitted to millions of stadium spectators and fans worldwide. Avaya, a leading global provider of business applications, systems and services, is an official partner of the 2006 FIFA World Cup.

Security consultants from the Avaya Network Management team at the 2006 FIFA World Cup event removed 70-80 viruses/Trojans/malware during the event. These included a number of widespread malware that are currently circulating in the world, such as W32/Mydoom.M@mm, Net-worm.Win32.Mytob. All of the worms, viruses or Trojan incidents were brought into the network on laptops that were already infected. All of these malware were all detected and removed before the laptops were allowed to connect to the system.

Key to ensuring the security of the converged communication network for the FIFA World Cup was a world-class Network IDS System (NIDS) called Sentarus that was provided to Avaya by Demarc Security. The NIDS detected in real-time, attempted attacks by hackers, malware, worms and viruses on the FIFA IT solution infrastructure. The NIDS analysed and correlated data in real-time, and used both open source and Avaya Labs tools to analyse network attacks, and to quickly rectify any potential problems.

Network security monitoring began on 15 May. Over the next two months, approximately 128 000 security events were recorded by the sensors located in 16 venues throughout Germany. Approximately 12% of these events were rated as "critical", and were subjected to further analysis. The overwhelming majority of these events were false positives - as determined by security analysts whose task it was to analyse whether recorded events were real or not.

In addition, the Avaya team used a number of other tools to enhance and extend security monitoring and response capabilities. These included: HIDS (Host-based Intrusion Detection Systems) console (ISS RealSecure - SiteProtector), anti-virus management console (McAfee Antivirus & ePolicy Orchestrator), Proxy management console (Microsoft ISA server), Firewall syslog data parsing tools, and IP-based video surveillance in all technical areas.

One of the main security goals was to help ensure that viruses or worms did not slow down critical applications traffic and ongoing log analyses showed that no denial-of-service or attacks took place. "From a security standpoint, we never lost bandwidth or network resources due to resource exhaustion," explained Dr Tom Porter, head of IT security for the FIFA World Cup network for Avaya. "Providing highly reliable, secure, communications solutions is what we do every day for customers around the world. This event was no different and it paid off for FIFA, the teams, players, journalists and spectators alike. The communications network from Avaya operated flawlessly because we planned, prepared and put a team of highly skilled Avaya networking and security experts in place," added Porter.