The Cyber Defense eMagazine November Edition for 2023

do untold damage to a company’s reputation. Gartner estimates that downtime can cost up to $5,600 per
minute; meanwhile other estimates suggest that even small businesses may lose over $100,000 per
hour. Unfortunately, those daunting figures do more than emphasize the importance of the internet in
modern commerce—they put companies squarely in the crosshairs of malicious actors looking to launch
distributed denial of service (DDoS) attacks.
Modern DDoS attacks pose a triple threat.
Nearly 30 years after the first known DDoS attack, whereby a perpetrator floods their victim with traffic
from across the internet, it remains a favorite attack type. From the standpoint of a cybercriminal, they
have a lot to offer: they can be launched from anywhere in the world; they can be automated and multivector;
and increasingly, they can be crafted to behave similarly to “normal” internet traffic, thereby
evading human observation and manual, or legacy, mitigation techniques. Best of all, for the attacker
perhaps, is the fact that many legacy DDoS mitigation solutions can also take more than ten minutes
before their defenses kick in. This has led attackers to engineer shorter, sub-saturating attacks that are
capable of inflicting as much, if not more damage, than their larger, longer-running volumetric
counterparts.
Disconcertingly, malicious attackers have taken a page out of modern warfare and, increasingly, are
launching carpet-bomb (also known as “spread spectrum”) DDoS attacks, which distribute themselves
across a large number of targets rather than a more easily identifiable single target.
This carpet-bomb technique poses a triple threat to defenders in that it’s able to evade detection by flying
under the radar of legacy, per-IP analysis techniques and thresholds. This attack technique also
invalidates the use of black-hole or null-route mitigation, making it even more difficult for companies to
avoid collateral damage. And because they more easily overwhelm scrubbing lane capacity (where traffic
is redirected to be cleansed of malicious DDoS packets), cloud service budgets are exceeded and
reporting systems are overloaded.
Counter the critics.
IT security leaders have the unenviable responsibility of selecting exactly the right solutions to defend
against a host of ever-evolving threats, and when (not if) an attack occurs, everyone’s an armchair critic.
Luckily, there are several basic tenets to follow when selecting the right DDoS defense solution.
Less bad isn’t good enough. The best solutions are those that do more than mitigate attacks—they
prevent them entirely. Unfortunately, all too many DDoS defense solutions don’t go the extra mile to stave
off attacks. Instead, they only make them “less bad” by mitigating them, meaning that organizations must
still deal with downtime and lost productivity and/or revenue while they recover.
Semantics matter. There is a big difference between “always on” and “on demand.” The former means
that your solution is always there, protecting your systems and devices against intrusions. On-demand,
Cyber Defense eMagazine – November 2023 Edition 97
Copyright © 2023, Cyber Defense Magazine. All rights reserved worldwide.