DDoS Defense: Tips to Stop DDoS Attacks And Protect Your Business

In recent years, the threat of DDoS attacks has significantly improved both in terms of scale and sophistication. The impact of a DDoS attack can cripple the whole network and system, and can even cause long-term or even permanent financial and reputational damages. Even worse, sophisticated DDoS attacks, like application-level (layer 7) DDoS, can be very challenging to detect and mitigate.

While detecting and stopping a DDoS attack can be a significant challenge, however, doesn’t mean it’s impossible. In this guide, we will discuss some important tips to stop DDoS attacks and protect your business.

What Is a DDoS Attack?

DDoS stands for Distributed Denial of Service, not to be confused with DoS or Denial of Service attacks, although they are related.

A DoS is a type of cybersecurity attack that is aimed to prevent the target device, system, or network to perform service for its users, hence the name. We call it just DoS when the attack is performed by just a single computer/device, but we call it DDoS when the attack is distributed among two or more machines.

The distributed nature of the DDoS attack allows the firepower of the attack to be amplified, while at the same time it’s also more difficult for the victim to pinpoint the origin of the attack due to the larger number of machines involved.

The most popular method of performing DoS and DDoS attacks is to overwhelm the server with a massive amount of requests so the server can’t handle it. However, that’s not the only method of performing DoS. Other popular DoS techniques include:

• ICMP flood: ICMP flood attacks are also called ‘Ping of Death’ or POD attack, and are performed by sending spoofed packets to ping every computer within the target network, causing these computers to crash because they can’t understand the ping and can’t send an appropriate reply.

• Teardrop: in a teardrop DoS attack, the perpetrator sends fragmented IP data packets to a network. The victim network or system then attempts to recompile these fragments but can’t find the appropriate solution, exhausting its resources and causing a crash.

• SYN flood: a type of DoS attack that rapidly sends requests to a server but doesn’t finish the handshake. This will result in the network becoming overwhelmed with connection requests, preventing users from accessing the network.

There are various other techniques in performing DoS and DDoS attacks, but the basic principle is the same: overwhelming or confusing the system so it can’t provide service for its users. However, in general, we can divide DoS and DDoS attacks into three major types:

1. Volumetric DDoS: the classic, most popular form of DoS attacks, the main characteristic of volumetric DDoS attacks is the massive volume of requests to deliberately consume bandwidth resources, so the network bandwidth won’t be available to the network’s users. The result of a volumetric DoS or DDoS is an overloaded server (or routers upstream of the server).

2. Protocol DDoS: this type of DDoS attacks target parts of the network that verify protocols. This type of attack is mainly launched by sending deliberately malformed or delayed packets/pings. When the victim network attempts to verify these pings, it will confuse and overwhelm the network.

3. Application DDoS: also called layer 7 DDoS (referring to the OSI model’s application layer), this type of attack attempts to overwhelm layer 7 features like HTTP, FTP, SNMP, and others, and layer 7 manipulations typically require a lot less bandwidth for attackers to be able to disrupt the network. In an HTTP flood attack, for example, the attacker only needs a relatively few numbers of packets to perform a large-scale DDoS attack. Application DDoS attacks are typically the most difficult to detect and mitigate since it can be hard to differentiate the attack from legitimate website traffic.

How To Stop DDoS Attacks and Protect Your Business

Monitoring Your Website Traffic

A core aspect of stopping a DDoS attack is to detect the presence of DDoS-related activities in the first place.

Above, we have discussed three main categories of DDoS attacks, and each of them will require different approaches in detecting them:

1. Volumetric DDoS attacks, as discussed, are the most common forms of DDOS attacks, and mainly affect the network and transport layers of the OSI model (layer 3 and 4). The most important symptom of volumetric DDoS attacks is a sudden, unexplained spike in traffic. You can use various traffic monitoring tools (i.e. Google Analytics) to monitor your traffic, and regularly check your traffic logs for anomalies.

2. For protocol, low-and-slow DDoS attacks, monitoring traffic surge isn’t effective. Protocol DDoS attacks may only attempt a single request per second but targeting a vulnerable exploit. Instead, you can monitor:

   1. The location source of the request. If you are suddenly getting traffic from locations you don’t serve, it can be a red flag.

   2. The time of the request. If there’s a regular visit within a similar time frame each day, creating a pattern, then it can be a red flag.

3. Application-layer attacks can be extremely difficult to detect, and a dedicated solution is an absolute necessity. Besides protecting your system from layer-7 DDoS attacks, you also need to protect your site and apps from all other malicious activities as well as block bots.

Develop a DoS Response Plan

An important thing to understand when defending against DDoS attacks is that, by the time you’ve detected an incoming attack, it will be too late to plan a response. On the other hand, responding just a few minutes too late can be crucial and may cause irreversible damage.

This is why preparing a preventive response plan for DDoS attacks is very important, so you can ensure prompt reactions. Your DDoS response plan should be based on a comprehensive assessment of your network, your assets, and your human resources: the bigger and more complex your system is, the more complex your DDoS response plan will be.

The objective of the response plan is to make sure your whole team (and not only your security team) are aware of their roles and responsibilities during an impending attack. By doing so, we can mitigate the impact of a DDoS attack and preventing it from happening altogether:

With that being said, here are the key elements of a proper DDoS response plan:

• System Audit: auditing and listing all assets that might act as DDoS attack surfaces, and also identify required infrastructure like filtering and detection tools (as discussed above) and security-enhanced hardware infrastructure.

• Defining Roles and Responsibilities: define roles and responsibilities for your response team that is going to be accountable in the time of a DDoS attack. Make sure everyone properly understands their responsibilities to ensure an organized and timely response for impending DDoS attacks.

• Internal communication policies: develop a proper chain of notifications so your team members know exactly who they should contact when an attack happens.

• External communication policies: develop a list of external contacts that should be notified in the event of an attack. This may include your third-party security solution vendors, ISP, and even your clients.

Reduce Attack Surface Exposure

Another important practice in stopping and mitigating the effects of DDoS attacks is to reduce the surface area that is potentially vulnerable to the attack. For example:

• Implementing load balancers to protect servers and other essential network assets. We place these assets behind the load balancing solution.

• Using a CDN (Content Distribution Network) so that your content isn’t served by your original server. This allows users to access our content that is distributed via the CDN in the event of DDoS.

• Using Web Application Firewall (WAF) with the same purpose to ‘block’ attackers from reaching your original server.

• Eliminating irrelevant services and ensuring all software/applications are up-to-date. This is to eliminate potential vulnerabilities that can be exploited by attackers as an entry point for DDoS attacks.

Conclusion

Modern DDoS attacks can target different layers of the OSI model, and attackers can even combine different techniques to create really sophisticated DDoS attacks that are very difficult to detect and manage.

This is why the best approach to stop DDoS attacks and protect your business is to invest in a DDoS mitigation solution that can both identify and mitigate incoming DDoS attacks that is not only effective against volumetric attacks but also all types of attacks including the most sophisticated layer 7 (application-level) DDoS.