How to mitigate and defend against DOS attacks

Part of GCN's series on DOS attacks.

Denial of service attacks against public-sector agencies have become so common they’re almost a given, especially for agencies that have a high public profile. Agencies need to have a strategy in place to cover emergency communication, as well as identify and mitigate an attack, in order to limit downtime and improve recovery time.

As with any response, "the first thing to do is have a plan," said Marc Gaffan, co-founder of Incapsula, a provider of cloud-based DDOS mitigation services. "Recognize the fact that you are a potential target, and have a plan in place."

US-CERT, in its advice to agencies, reminds that plans need to include contact information, both for outside resources such as ISPs, hosting providers and security vendors, but also for in-house security and network teams.

"Handling internal communications is of paramount importance in doing this well," said Neal Quinn, chief operating officer at Prolexic Technologies. Communications often break down in any emergency situation, and how smoothly the response is handled "has a huge impact beyond the technology used."

"Having the proper processes and plans in place "is as important as having the right tools," said Carlos Morales, vice president of global sales engineering and operations at Arbor Networks.

One decision that needs to be made when anticipating a DOS attack is to determine where responsibility for the response should reside. Agencies might not want to treat DOS attacks like other security incidents. "I tend to view the problem as focusing on availability," Quinn said. "I think it’s better viewed as a disaster response or business continuity issue" than as an incident such as a breach or other hack.

If disaster response and security are handled by different teams in an organization, putting the wrong team in charge of a DOS attack could cost valuable time. "DOS is effectively a manmade disaster that affects continuity," said Dan Holden, Arbor’s director of security engineering and response.

However agencies treat a DOS attack — security event, disaster response or continuity of operations — they need to recognize the attack to respond to it. The focus should first be on the characteristics of traffic coming into the systems, rather than their impact. If  IT staff do not identify the attack until resources have been overwhelmed and offline to legitimate users, the attack already has succeeded and precious time has been lost in responding.

This requires understanding the signatures and sources of malicious traffic. Blacklists of the IP addresses and domains of known bad actors can help, as can analysis of patterns to identify previously unknown sources of attacks. Malicious resources can be brought online quickly and moved to other platforms just as quickly, masking the source of an attack, so identifying attack traffic requires an understanding of the subtleties of the tools and techniques used.

This understanding comes from intelligence about hacker activities, and once again scale is the key. When it comes to intelligence, more is better, but it is not enough unless there are the resources to analyze and understand it, which can give a third party that specializes in security an advantage.

"The bigger the customer base, the more traffic you can see and the more accurate your intelligence becomes," said Incapsula’s Gaffan.

Even something as simple as a blacklist requires resources to maintain properly. "To some extent, they are becoming less effective," Gaffan said, because of the bad guys’ ability to rapidly switch between addresses to deliver attacks. But a blacklist can still be useful as long as it is maintained properly. This means having the intelligence sources to add to the blacklist quickly so it’s up to date. And just as important is removing old addresses and domains when they no longer are being used maliciously.

"There is more to it than just adding IP addresses," Gaffan said. If old addresses are not removed, they can create what amounts to a self-inflicted DOS when legitimate traffic is blocked.

The simplest type of DOS attack to deal with is a network attack with its flood of requests, and the simplest way to deal with it is to just absorb the traffic. It’s just a matter of capacity.

"We mitigate Layer 3 [network] and Layer 4 [transport] attacks at the edge, the same way we handle large flash crowds," said Fran Trentley, senior service line director for Akamai Technologies’ public sector business. Handling surges in demand is what Akamai was formed to do, after all, he said.

That was the technique used in the July 4 wave of DDOS attacks in 2009, targeting government, news and financial sites primarily in South Korea and the United States. Despite the apparent organization behind them, the attacks produced only about 20 megabits of data per second, which did not cause major disruptions. "Fortunately, they hit us where we were strongest," Trentley said.

Akamai and other organizations have had to adapt to respond to more subtle application layer attacks that target back-end resources. But the principle of identifying and dropping the traffic as soon and as far from the targeted servers as possible still applies. Akamai identifies and drops incomplete messages at the edge.

Deciding what DOS defenses to maintain in-house and what, if any, to outsource to a third party requires balancing the value of the services being protected with the capacity to defend them. On-premises, in-line equipment to monitor, detect and respond to attacks can react quickly and reduce downtime. But decide whether the department has the resources to devote to those defenses continuously -- even when systems are not under attack.

Using ISPs, cloud service providers and security companies for early warning and response can be cost-effective. But if third parties are not continuously monitoring agency traffic, they will depend on being notified of problems, which can delay response and result in additional downtime.

Striking the right balance will require a thorough understanding of the agency environment, mission and resources, as well as the capabilities of vendors and service providers, and then combining adequate training and resources in-house and with the right third-party agreement.

PREVIOUS: As defenses against network DDOS attacks improve, hackers find a new target

NEXT: Checklist for DDOS defense