Planning Your DDoS Protection Strategy

DDoS attacks target databases, applications, and infrastructure simultaneously to increase their chances of success. Businesses need a strategy, as well as a reliable DDoS prevention and mitigation solution. Here are some tips to consider when implementing a DDoS mitigation strategy.
January 22, 2021 
Samir Desai, GTT
Samir Desai
Director, Managed Security Services, Products
Samir has over 20 years' experience in the Telecoms industry, having enjoyed senior product development roles with some of the worlds largest providers. He holds an MSc in Data Communications from Brunel University in London.

Planning Your DDoS Protection Strategy

With thousands of businesses encouraging their employees to work remotely, Distributed Denial of Service (DDoS) attacks are on the rise with no signs of slowing down. Attacks are continuing to grow in volume, frequency, and sophistication. According to a 2020 study produced by DDoS mitigation technology provider Corero, multi-vector DDoS attacks have increased by more than 200% since 2007, as most attacks today leverage multiple attack vectors simultaneously. DDoS activity also tends to be pervasive with short duration and repetitive attacks. According to the same Corero study, 4 out of 5 attacks last less than 10 minutes, with a 25% probability of a repeat DDoS attack within the first 24 hours.

A detailed and strong defense strategy is critical for efficient and effective mitigation to keep businesses protected and operating.

With rising levels of DDoS activity, attacks can be impossible to mitigate without early threat detection and automated traffic profiling systems. It’s not uncommon for businesses to realize they’ve been attacked once a website application slows to a halt or crashes. This is especially true for sophisticated attacks, which use a blended approach and simultaneously target multiple layers of the OSI model.

DDoS attacks target databases, applications, and infrastructure simultaneously to increase their chances of success. To protect against these attacks, businesses need a strategy, as well as a reliable DDoS prevention and mitigation solution. IT security buyers need to invest in an integrated security strategy that protects all infrastructure across multiple layers.

Here are some tips to consider when implementing a DDoS mitigation strategy.

1. Develop a DDoS Response Plan

Develop a DDoS defense plan based on a thorough security assessment. Larger enterprises may require complex infrastructure and involve multiple teams in DDoS planning.

When a DDoS attack strikes, there is no time to think about the best steps to take. They need to be defined in advance to enable prompt reactions and avoid any negative impacts.

Depending on the infrastructure, a DDoS response plan can become quite exhaustive. The first step taken when a malicious attack happens can define how it will end. Developing an incident response plan is a critical first step toward a comprehensive defense strategy.

The key elements of the plan are relevant to all organizations and include:

  • Formulate a systems checklist. Define a full list of “assets,” e.g., web servers, network elements, or applications directly connecting to the internet with corresponding public IP addresses that should be protected in the event of an attack.
  • Organize a response team. Define responsibilities for key team members to ensure an organized reaction to the attack as it happens.
  • Define notification and escalation procedures. Make sure your team members know exactly whom to contact in case of an attack.
  • Include the list of internal and external contacts. This is a list of contacts that should be informed about the attack. Develop communication strategies with customers, cloud service providers, and any security vendors.

2. Secure Network Infrastructure

Mitigating network security threats can only be achieved by implementing multiple protection strategies in parallel.

This includes next-generation security features such as advanced intrusion prevention and threat response systems, which combine firewalls, VPN, anti-spam, content filtering, and network security with DDoS mitigation solutions.

Together, these next-generation security features enable constant and consistent network protection to manage a DDoS attack. Most standard network equipment comes with limited DDoS mitigation capabilities; therefore, businesses should consider outsourcing DDoS protection to ensure more comprehensive protection. With cloud-based outsourced solutions, businesses can access advanced mitigation and protection resources for a fixed budget. This is an excellent option for businesses that may want to keep their security budgets within projected limits.

In addition, businesses also should make sure their systems are up to date. Outdated systems may have vulnerabilities that can be exploited by DDoS attackers.

3. Practice Basic Network Security Measures

Implementing strong security practices can keep business networks from being compromised. Secure practices include complex passwords that change on a regular basis, anti-phishing methods and secure firewalls that allow minimal outside traffic. These measures alone will not stop DDoS, but they serve as a critical security foundation to lessen its adverse business impact.

DDOS Protection

4. Maintain Strong Network Architecture

Focusing on a secure network architecture is vital to security. Businesses should create redundant network resources; if one server is attacked, the others can handle the extra network traffic. When possible, servers should be located in different places geographically. Dispersed resources are more difficult for attackers to target.

5. Leverage the Internet Service Provider (ISP)

Outsourcing DDoS prevention to ISPs with cloud-based DDoS mitigation services offers several advantages. Seek out providers offering “always-on” solutions that can absorb huge volumes of malicious traffic, with minimal latency impact, before it ever reaches its intended destination. Where enterprises need to augment their always-on solutions with some control over how and when mitigation can be applied, ISPs that offer customer-initiated traffic redirect capabilities in an automated fashion have a significant advantage. In addition, DDoS solution services provided through an integrated Tier 1 Internet Service Provider benefit from threat intelligence capabilities that constantly monitor the larger internet for the latest DDoS tactics and emerging attack trends.

6. Understand the Warning Signs

Some symptoms of a DDoS attack include network latency, poor connectivity or performance on a company intranet, or intermittent website shutdowns. No network is perfect, but if a lack of performance seems to be prolonged or more severe than usual, the network is most likely experiencing a DDoS attack and the business should take action. However, the safest way to be protected against DDoS attacks is by investing in a real-time, always-on solution.

In summary, DDoS attacks will continue to form a significant part of the enterprise security threat landscape. Being well prepared and implementing consistent and stringent measures to mitigate attacks is key to limiting and negating the potential business impact.

About GTT

GTT connects people across organizations, around the world, and to every application in the cloud. Our clients benefit from an outstanding service experience built on our core values of simplicity, speed, and agility. GTT owns and operates a global Tier 1 internet network and provides a comprehensive suite of cloud networking services. We also offer a complementary portfolio of managed services, including managed SD-WAN from leading technology vendors.

 

 

Thank you!


A GTT sales representative will be in contact with you shortly.

 

 

 

 

Call
Email
Contact Us
Newsletter
Sales Enquiries:
+32 (0)2/588 5333
"GTT NOC:
Toll Free: +32 800 29 43 3 Toll Free: +31 800 488 3333 Non Toll Free: +44 800 640 6433
Sales Enquiries:
[email protected]
GTT NOC:
[email protected]