How to minimize the impact from DDoS attacks

In early 2000, one of the first known distributed denial-of-service (DDoS) attacks shut Yahoo down for three hours when an attacker repurposed a university’s computers to flood the Internet portal’s traffic. Such synchronized attacks from multiple sources against a sole target characterize DDoS attacks, a relatively new phenomenon as compared to “traditional” denial-of-service (DoS) attacks, which originate from a single source.

Thanks in part to the increased number of devices on the Internet and the availability of high-speed Internet access for the average user, there’s a larger pool of possible sources for all kinds of technological attacks. In the early 2000s, DDoS attacks reached a speed of approximately 4 gigabit/sec. Now, they average between 10 and 60 Gbps per second – or even faster. A DDoS incident this past February peaked at almost 400 Gbps. And the average DDoS attack now lasts 17 hours.

Three types of DDoS attacks have appeared in recent years:

Resource consumption. A common instantiation resource consumption attack is a SYN flood. Attackers initiate a large number of bogus connection requests to a single destination. The targeted server acknowledges the requests, but the attackers fail to send the final pieces of information to complete the “three-way handshake” required to establish a connection between two computers. While the server waits for the expected response, new connection requests continue pouring in until all available connections are consumed, preventing communication with legitimate users. Attackers also may launch a resource consumption attack by attempting to exhaust the target server’s disk space or another finite resource by using legitimate traffic to force the server into creating large numbers of log files.

Bandwidth consumption. Attackers consume all available bandwidth on the networks leading to the targeted server by sending bogus network traffic in quick succession. The resulting surge – which doesn’t have to come from legitimate traffic or even traffic the server usually recognizes as legitimate – renders the targeted server unavailable. Its impact is greater still because it also can take down other servers on the same immediate network.

Keeping connections open.  Attackers complete numerous three-way handshakes to establish legitimate connections, but then use Slowloris software to delay the process by designing each connection to instruct the target that it is “busy.” It’s similar to answering a phone call and then being placed on hold for an hour while the person who called takes care of something else. Allowing for the possibility that these users are operating on slow or unreliable networks, the target server waits. The attackers can keep numerous connections open for extended periods by sending a data fragment to each connection every few minutes, thus tying up the server so it can’t respond to legitimate traffic.

Government networks are frequent targets

DDoS attacks on the public sector accelerated more than on any other industry in the fourth quarter of 2014. Commonly, opposition to legislation or political activism are motivators in DDoS attacks on government. Hackers aim to damage an agency’s finances, reputation or both while gaining notoriety through claims on social media.

Government agencies and the services they offer, by their nature, always will be targeted. And, because DDoS attacks can be launched with increasing ease – even by hackers with little technological expertise – agencies should operate as if a DDoS attack is inevitable. With some advance planning, agencies can reduce the perceived gains from future attacks.

Minimizing hackers’ impact

DDoS attacks cannot be prevented. They come without warning and, equally disconcerting, can escalate from start to peak effectiveness in as little as one minute. While some Internet service providers offer automatic responses, these can cause outages and shut down legitimate traffic at the same time it shuts down bogus traffic.

What agencies can – and should – do is make themselves less appealing targets. Distributing services across various locations, instead of placing them in only one data center, is the first step. That way, a single DDoS attack cannot take the agency’s entire suite of services offline, and the agency won’t have to rely exclusively on the Internet services provider’s solution, which usually is expensive.

Agencies also should consider using a content delivery network, which can mask network connections from attackers, as an entry point to its services. Such services are beneficial, but also expensive, so agencies must consider their cost-to-benefit ratio.

Another step agencies can take is establishing a relationship with a  managed services partner that can provide built-in protections from DDoS attacks targeting services they host. The services partner can distribute the services through different data centers, reducing exposure to and impact from DDoS attacks, while the agency retains control of the mission objectives the services partner delivers.

Government agencies can protect themselves against DDoS attacks. An expert partner will help them determine – before an incident occurs – how the increasing problem of a DDoS attack can be solved.