9 steps that help defend against DDOS
Connecting state and local government leaders
Most experts agree that you can't do it all by yourself, but there are practical measures agencies can take to shore up their networks against denial of service attacks.
Part of GCN's series on DOS attacks.
Most experts agree that agencies can’t defend against and mitigate the impact of denial of service attacks all by themselves, but there are step they can take to strengthen their defenses.
Denial of service — DOS — is a blanket term for a variety of types of attacks, carried out in numerous ways, all directed at making online resources unavailable to the public. Attacks can be launched from multiple platforms, creating a distributed denial of service attack, or DDOS. Although they usually do not damage the target systems or compromise data, they can damage reputations, cost money and interfere with carrying out missions.
Specifics will vary with each attack, but the U.S. Computer Emergency Readiness Team notes that, “In general, the best practice for mitigating DDOS attacks involves advanced preparation.”
Some recommendations for advance preparation from US-CERT include:
- Develop a checklist for standard operating procedures to follow in the event of an attack, including maintaining a checklist of contact information for internal firewall teams, intrusion detection teams and network teams, as well as for service providers. Identify who should be contacted during an attack, what processes should be followed by each and what information is needed.
- ISPs and hosting providers might provide mitigation services. Be aware of the service-level agreement provisions.
- Identify and prioritize critical services that should be maintained during an attack so IT staff will know what resources can be turned off or blocked as needed to limit the effects of the attack.
- Ensure that critical systems have sufficient capacity to withstand an attack.
- Keep network diagrams, IT infrastructure details and asset inventories current and available to help understand the environment. Have a baseline of the daily volume, type, and performance of network traffic to help identify the type, target and vector of attack. Identify existing bottlenecks and remediation actions needed.
- Harden the configuration settings of the network, operating systems and applications by disabling unnecessary services and applications.
- Implement a bogon (bogus IP address) block list at the network boundary to drop bogus IP traffic.
- Employ service screening on edge routers where possible to decrease the load on stateful security devices such as firewalls.
- Separate or compartmentalize critical services, including public and private services; intranet, extranet, and Internet services; and create single-purpose servers for services such as HTTP, FTP, and DNS.
Some additional advice for preparing yourself from Marc Gaffan, cofounder of Incapsula:
Have the capacity to absorb additional traffic. It might be impractical to provision all the bandwidth needed, and the exact amount to have available will be a business decision. But a good rule of thumb would be to maintain about 150 percent of normally needed capacity.
Maintain customer transparency. Ideally, people coming to the site shouldn’t know it is defending itself against an attack. “People don’t like to hang around where something bad is going on,” Gaffan said. And if a bogus connection is suspected, give the user a chance to verify. It might be impractical to use additional security such as Captcha verification for every connection during an attack, but don’t arbitrarily drop every questionable connection.
Differentiate between legitimate automated traffic and DOS traffic. There can be a high volume of legitimate automated traffic generated by search engine crawls and management tools that should not be blocked. Knowing what this traffic looks like in advance can help identify DOS traffic.
Be prepared to quickly identify and respond to DOS attacks so that defenses can be brought to bear quickly, minimizing downtime.
NEXT STORY: Can DNS be protected from spikes in attacks?