As online cyber-crime continues to be a concern for organisations of all sizes, it’s important that not only is your businesses website protected but your customers are as well. Distributed Denial of Service (DDoS) attacks are some of the largest available and security concerns facing customers that are moving their applications to the Cloud.
What is a Distributed Denial of Service (DDoS) Attack?
A Distributed Denial of Service (DDoS) attack is one of the most popular forms of cyber-attack as it has a low cost and is relatively easy to execute. Every time a customer visits your website, it requires access to the website’s content and DDoS attacks work where cyber criminals send through more traffic than your businesses targeted server or organisation’s website can cope with. This results in either a long delay for a user to view the content on the website or a server failing completely – rendering your organisation’s website completely inaccessible. DDoS attacks can be targeted at any endpoint that is publicly reachable through the Internet.
Exploited machines can include computers, laptops and other networked resources such as IoT devices. From a high level, a DDoS attack is like a traffic jam clogging your IT Infrastructure up like a motorway, preventing regular traffic from arriving at its desired destination.
Some of the common symptoms of a DDoS attack includes the slowdown of your business network, spotty connectivity on a company intranet, or intermittent website shutdowns. If your business network is experiencing a lack of performance that seems to be prolonged or more severe than usual, the network likely is experiencing a DDoS attack and your business should take action immediately.
What are the types of DDoS attacks?
Different types of DDoS attacks target varying components of network components. In order to the differing types of how DDoS attacks work, it has to be understood how network connections are made. The Internet is comprised of different “layers”, and each step in the Internet model has a different purpose, network connectivity typically has 7 distinct layers, the types of DDoS attacks are as follows.
- Volumetric DDoS Attacks: A volumetric DDoS attack is the most common DDoS attack. Its’ goal is to flood the network layer with a substantial amount of what seems like legitimate website traffic. Because the bot floods your business network ports with data, the machine continually has to deal with checking the malicious data requests and doesn’t have any room to accept legitimate website traffic. It includes UDP floods, amplification floods, and other spoofed-packet floods. DDoS Protection Standard mitigates these potential multi-gigabyte attacks by absorbing and scrubbing them, with Azure’s global network scale, automatically.
- Protocol Attacks: A protocol DDoS attack renders a target inaccessible and focuses on damaging connection tables in network areas that deal directly with verifying connections. It does this by rendering a target inaccessible, by exploiting a weakness in the layer 3 and layer 4 protocol stack. It includes SYN flood attacks, reflection attacks, and other protocol attacks. DDoS Protection Standard mitigates these attacks, differentiating between malicious and legitimate traffic, by interacting with the client, and blocking malicious traffic. Protocol DDoS attacks basically work by sending successively slow pings, deliberately malformed pings, and partial packets. This can cause the attacking computer to memory buffer the target to overload and potentially crash the system. A protocol attack can also target firewalls. This is why using a firewall alone to protect your business will not stop denial of service attacks.
- Resource (application) Layer Attacks: These attacks target web application packets, to disrupt the transmission of data between hosts. Application layer DDoS attacks make use of the application layer focus primarily on direct Web traffic. Potential avenues include HTTP, HTTPS, DNS, or SMTP. Application-layer DDoS attacks, however, are not as easy to catch or identify as they typically make use of a smaller number of machines, sometimes even a single device. Therefore, the server can be tricked into treating the attack as nothing more than a higher volume of legitimate website and user traffic.
How can my business protect itself from DDoS cyber-attacks?
There are many ways you can protect your businesses IT Infrastructure to prevent DDoS attacks. The simplest way to prevent a DDoS attack is to allow as little user error as possible. Your organisation can do this by raising awareness with your employees about the risks of cyber-attacks and also using multi-level protection strategies.
Engaging in strong IT Security practices can keep business networks from being compromised by cybercriminals. Secure practices include complex passwords that change on a regular basis, multi-factor authentication, anti-phishing methods, and firewalls that are secure enough that they allow little outside traffic. While these measures alone will not stop DDoS, they do serve as a critical security foundation.
The evolution of DDoS attacks shows no signs of slowing down. As the working world relies more and more, DDoS attacks keep mutating and growing in volume and frequency, today most commonly involving a “blended” or “hybrid” approach. There are many ways you can protect your businesses IT Infrastructure to prevent DDoS attacks.
By developing a DDoS prevention plan within your business IT Strategy, that is based upon a security assessment, your business can be much better prepared for when a DDoS attack hits your company network. When these types of attack occur, there is no time to think about the best steps to take so therefore these processes need to be defined in advance to enable a prompt response and avoid an impact on your day to day business operations.
Below are some key things to take away that your organisation needs to implement to be prepared for an attack.
Systems Checklist
It’s imperative that your organisation develops a full list of assets you should implement to ensure advanced threat identification, assessment, and filtering tools, as well as security-enhanced hardware and software-level protection, is in place.
Form a Response Team
Key members of your team need to have defined responsibilities to ensure an organised reaction to the attack as it happens.
Define Notification and Escalation Procedures
Should a DDoS attack occur, it’s important that your organisation is sure your team members know exactly whom to contact in case of the attack and at which stage they are needed.
Your organisation should also have a list of internal and external contacts who should be informed about the attack. The development of communication strategies with your customers, Cloud Service providers, and any IT Security vendors should also be implemented.
DDoS Protection and the Cloud
Another way to help mitigate the risk of a DDoS attack is to leverage the power of the Cloud to a specialist outsourced provider. The Cloud has far more bandwidth and resources than a private network does. With an increased magnitude of DDoS attacks, solely relying on an on-premise solution increases the likelihood of hardware failing completely. Secondly, Cloud-based solutions such as Microsoft Azure can absorb malicious traffic before it reaches its’ intended destination – which is your organisation’s server.
By implementing Microsoft Azure, this lessens the risk of a DDoS attack. The built-in protection within Microsoft Azure blocks attack traffic and forwards the remaining traffic to its intended destination. Within a few minutes of attack detection, you are notified using Azure Monitor metrics. By configuring logging on DDoS Protection Standard telemetry, you can write the logs to available options for future analysis. This data within Azure Monitor for DDoS Protection Standard is retained for 30 days. The intelligent traffic profiling feature learns your application’s traffic over time. It then selects and updates the profile that is the most suitable for your service, adjusting as traffic changes over time.
Microsoft Azure does this by providing multi-layered, full-stack DDoS protection when used with a web application firewall and also has the ability to detect over 60 different attack types that can be mitigated, protecting against the largest known DDoS attacks.
Should an attack occur detailed reports are available in five-minute increments and a complete summary after the attack ends. Stream mitigation flow logs to an offline security information and event management (SIEM) system for near real-time monitoring during an attack. Alerts can be configured at the start, during, and stop of an attack using built-in tools. The alerts within Microsoft Azure integrate into your operational software like Microsoft Azure Monitor logs, Splunk, Azure Storage, Email, and the Azure portal.
Infinity Group are IT Security experts and Cyber Security Consultants. If you are interested in implementing Microsoft Azure or looking for Cyber Security Consultancy, please get in touch.
Speak to us
Our specialist team of Consultants look forward to discussing your requirements in more detail.
Telephone: 03303 333 648
Livechat now: Click below button
Request a call back
[contact-form-7 id=”6″ title=”Contact form” html_class=”contact_form_box”]
Latest posts
BT Sets date to swit…
Read More
No Comments
December 20, 2015
Spear Phishing Email…
Read More
No Comments
December 27, 2015
Employees working re…
Read More
No Comments
February 13, 2016
