Disculpa, pero esta entrada está disponible sólo en Inglés, Ruso y Ucraniano.
DDoS attacks surge to record numbers in 2022 as a result of russia’s insidious war against Ukraine.
Cases this year saw some of the longest-lasting DDoS attacks ever seen as hacktivists assembled to take on their enemies in the ongoing cyberwar between russia and Ukraine.
Q1 2022 saw the total number of DDoS increase by 46%, growing 4.5 times compared to the same quarter in 2021.
The attacks also showed an unprecedented duration for DDoS sessions, particularly those aimed at state resources and banks.
The figures from 2021 were considered, at the time, to be the all-time highest number of detections by researchers but the figures have now been dwarfed thanks to hacktivists.
The busiest day for DDoS attacks and cybercriminals by the numbers was January 19th, when 2,250 DDoS attacks were recorded on that day alone.
Here are some more statistics for this period:
- 91,052 DDoS assaults
- 34% of assaults had been directed at targets positioned within the USA, which comprised 45.02% of all targets
- The biggest variety of DDoS-attacks (16.35%) come on Sundays
- Most assaults (94.95%) lasted lower than 4 hours, whereas the longest assault continued for 549 hours (almost 23 days)
- 64% of assaults had been UDP flood
- 53% of command and management servers had been positioned within the USA
- China accounted for 20.41% of bots attacking our SSH honeypots and 41.21% of these attacking Telnet traps.
All these factors have caused us to be more aware of how extensive and dangerous DDoS attacks can be. They also remind us that organizations must get prepared against such attacks.
Defending towards DDoS assaults
1. Create a DDoS Response Plan
Your security team should develop an incident response plan that ensures staff members respond promptly and effectively in case of a DDoS. This plan should cover:
- Clear, step-by-step instructions on how to react to a DDoS attack.
- How to maintain business operations.
- Go-to staff members and key stakeholders.
- Escalation protocols.
- Team responsibilities.
- A checklist of all necessary tools.
- A list of mission-critical systems.
2. Ensure High Levels of Network Security
Network security is essential for stopping any DDoS attack attempt. As an attack only has an impact if a hacker has enough time to pile up requests, the ability to identify a DDoS early on is vital to controlling the blast radius.
You can rely on the following types of network security to protect your business from DDoS attempts:
- Firewalls and intrusion detection systems that act as traffic-scanning barriers between networks.
- Anti-virus and anti-malware software that detects and removes viruses and malware.
- Endpoint security that ensures network endpoints (desktops, laptops, mobile devices, etc.) do not become an entry point for malicious activity.
- Web security tools that remove web-based threats, block abnormal traffic, and search for known attack signatures.
- Tools that prevent spoofing by checking if traffic has a source address consistent with the origin addresses.
- Network segmentation that separates systems into subnets with unqiue security controls and protocols.
Protecting from DDoS attacks also requires high levels of network infrastructure security. Securing networking devices enables you to prepare your hardware (routers, load-balancers, Domain Name Systems (DNS), etc.) for traffic spikes.
3. Have Server Redundancy
Relying on multiple distributed servers makes it hard for a hacker to attack all servers at the same time. If an attacker launches a successful DDoS on a single hosting device, other servers remain unaffected and take on extra traffic until the targeted system is back online.
You should host servers at data centers and colocation facilities in different regions to ensure you do not have any network bottlenecks or single points of failure. You can also use a content delivery network (CDN). Since DDoS attacks work by overloading a server, a CDN can share the load equally across several distributed servers.
4. Look Out for the Warning Signs
If your security team can quickly identify the traits of a DDoS attack, you can take timely action and mitigate the damage.
Common signs of a DDoS are:
- Poor connectivity.
- Slow performance.
- High demand for a single page or endpoint.
- Unusual traffic coming from a single or a small group of IP addresses.
- A spike in traffic from users with a common profile (system model, geolocation, web browser version, etc.).
Remember that not all DDoS attacks come with high traffic. A low-volume attack with a short duration often goes under the radar as a random event. However, these attacks can be a test or diversion for a more dangerous breach (such as ransomware). Therefore, detecting a low-volume attack is as vital as identifying a full-blown DDoS.
Consider organizing a security awareness training program that educates the entire staff on the signs of a DDoS attack. That way, you do not need to wait for a security team member to pick up on the warning signs.
5. Continuous Monitoring of Network Traffic
Using continuous monitoring (CM) to analyze traffic in real-time is an excellent method of detecting traces of DDoS activity. The benefits of CM are:
- Real-time monitoring ensures you detect a DDoS attempt before the attack takes full swing.
- The team can establish a strong sense of typical network activity and traffic patterns. Once you know how everyday operations look, the team easier identifies odd activities.
- Around-the-clock monitoring ensures the detection of signs of an attack that happens outside of office hours and on weekends.
6. Leverage the Cloud to Prevent DDoS Attacks
While using on-prem hardware and software to counter the DDoS threat is vital, cloud-based mitigation does not have the same capacity limitations. Cloud-based protection can scale and handle even a major volumetric DDoS attack with ease.
You have the option of outsourcing DDoS prevention to a cloud provider. Some of the key benefits of working with a third-party vendor are:
- Cloud providers offer well-rounded cybersecurity, with top firewalls and threat monitoring software.
- The public cloud has greater bandwidth than any private network.
- Data centers provide high network redundancy with copies of data, systems, and equipment.
A business typically has two choices when setting up cloud-based DDoS protection:
- On-demand cloud DDoS mitigation: These services activate after the in-house team or the provider detects a threat. If you suffer a DDoS, the provider diverts all traffic to cloud resources to keep services online.
- Always-on cloud DDoS protection: These services route all traffic through a cloud scrubbing center (at the cost of minor latency). This option is best suited for mission-critical apps that cannot afford downtime.
If your in-house team has the necessary know-how, you may not need to solely rely on a cloud provider for cloud-based DDoS protection. You can set up a hybrid or multi-cloud environment and organize your traffic to get the same effects as either on-demand or always-on DDoS protection.
Сyber protection programs should be on standby in case of assault to both assist defend towards an impending assault and in addition to help in information restoration ought to an organization fall sufferer to a DDoS assault. Getting out forward of a possible catastrophe might imply a considerable amount of time, income and work saved for enterprises, so using a zero-trust approach could possibly be the distinction between warding off an assault and having to interact catastrophe restoration on the fly.
P.S. What Is a DDoS Attack?
A DDoS (Distributed Denial of Service) is a cyberattack that aims to crash a network, service, or server by flooding the system with fake traffic. The sudden spike in messages, connection requests, or packets overwhelms the target’s infrastructure and causes the system to slow down or crash.
While some hackers use DDoS attacks to blackmail a business into paying a ransom (similar to ransomware), more common motives behind a DDoS are to:
- Disrupt services or communications.
- Inflict brand damage.
- Gain a business advantage while a competitor’s website is down.
- Distract the incident response team.
DDoS attacks are a danger to businesses of all sizes, from Fortune 500 companies to small e-retailers. Statistically, DDoS hackers most often target:
- Online retailers.
- IT service providers.
- Financial and fintech companies.
- Government entities.
- Online gaming and gambling companies.
Attackers typically use a botnet to cause a DDoS. A botnet is a linked network of malware-infected computers, mobile devices, and IoT gadgets under the attacker’s control. Hackers use these «zombie» devices to send excessive numbers of requests to a target website or server’s IP address.
Once the botnet sends enough requests, online services (emails, websites, web apps, etc.) slow down or fail. According to a Radware report, these are the average lengths of a DDoS attack:
- 33% keep services unavailable for an hour.
- 60% last less than a full day.
- 15% last for a month.
While a DDoS typically does not directly lead to a data breach or leakage, the victim spends time and money getting services back online. Loss of business, abandoned shopping carts, frustrated users, and reputational harm are usual consequences of failing to prevent DDoS attacks.
