DDoS attacks are the new cyber Boogeyman (II)

Defeat your enemy: the DDoS Post-Apocalypse

A study conducted by Cisco, with regard to the threats facing the Internet, indicates that the total number of DDoS attacks in 2020 will be of 17 million (in contrast to the current number of 6.6 million). This is a second predictive statistic of the zombie cyber-apocalypse. Therefore, the current context obliges us to change our view on the cyber-threat landscape. Those hackers favoring the use of DDoS attacks no longer discriminate among their victims. Whether you’re a banking entity or an international journal, the mechanics are the same and push companies towards implementing anti-DDoS measures.

First of all, it is highly important to integrate the threat posed by DDoS attacks in your incident response plan and detail the procedure in case of occurrence. These procedures must be simulated once or twice per year (much like fire drill exercises) to ensure that they are well mastered. One will agree that it is useless to read an instruction manual for a fire extinguisher in the aftermath of a fire.

Meanwhile, establish a precise inventory of your own network infrastructure. To identify DDoS attacks more quickly, we must first know the tension experienced by the network under normal conditions and, only then, can we move on to monitoring weak signals (deviations from the standard; for example, if your company is not at all expecting to undergo a high traffic from an Asian region, it can be that this is an indicator of a suspicious behavior).

The main principle of an identified risk is to ensure that it does not occur. There are various solutions that can be implemented to mitigate DDoS attacks and even technical means meant to prevent them altogether. Better safe than sorry, right? In the case of DDoS attacks, there’re really not that many options besides prevention. No tool is currently able to completely block these incidents. As such, we are obligated to know and understand the recommended best practices and to react effectively during their deployment.

Tools such as firewalls and load balancers (also known as filtering at the network borders) are part of the infrastructure’s first line of defense against DDoS. They can, in some cases, contribute to the absorption of DDoS attacks that generate a relatively low traffic. These solutions are based on a specific traffic filtering and can also limit the number of queries per IP address source. Nonetheless, filtering rules can be difficult to define and we must be aware that a simple firewall cannot thwart a DDoS attack (read here our previous article on the limitations of a firewall).Organizations can also employ DDoS specific filtering equipment, which, in addition to its white list and black list filtering functions, can create rules based on geolocation sources, limit the number of queries in time (for a web page) and even determine the alerting process (an alert will be sent out according to the number of queries per second or bandwidth in use).

ITrust, cybersecurity expert, offers companies the opportunity to turn on the light in their networks and confine the cyber Boogeyman in its dark corner once and for all. Our team goes beyond the mere processing of IT incidents and provides companies with a managed Security Operation Center (SOC). Our SOC engineers use the latest technology (read our article on Reveelium, behavioral analysis tool here), capable of analyzing, storing and monitoring, in real-time, the security level on your servers, routers, applications, databases, websites. This ability to understand and analyze the observable events occurring within an information system plays a vital role in detecting DDoS attacks and in the construction of a network vulnerability correction plan, to prevent such incidents in the future.

Link:

https://www.reveelium.com/en/ddos-attacks-the-cyber-boogeyman-part-ii/