NC Nov-Dec 2023

OPINION: DDoS ATTACKS
resource - like a website or pdf - from the
targeted server.
As a result, the application is overwhelmed
and is unable to deliver content to its users.
These attacks are mostly used to target web
servers, but can also go after any digital
application, including session initiation
protocol (SIP) and border gateway protocol
(BGP) services.
VOLUMETRIC ATTACKS
Lastly, there are volumetric attacks. These
involve threat actors flooding a target with
malicious traffic in an attempt to consume
all available bandwidth either within the
target network/service, or between the
target network/service and the rest of the
internet. These attacks are simply about
causing congestion.
From 2006 to 2021, volumetric attacks
reigned supreme, with DNS amplification
attacks at the forefront. These attacks work
by sending requests that generate large
replies to multiple open domain name
system (DNS) servers from a spoofed IP
address to appear as though the request is
coming from the target. At full scale, the
large influx of DNS traffic onto a single
server can overwhelm it, forcing the server
to crash.
Adversaries will typically choose one or
more of these different types of attacks to
use against the on-premises and cloud
environments of targets in order to maximise
the degree of damage. This demonstrates
the need for organisations to integrate a
multi-faceted defence approach across both
their network availability and digital
infrastructure to effectively mitigate modern
DDoS threats.
THE NEED FOR A HYBRID DDOS
DEFENCE APPROACH
The difficulty organisations face is having to
put equal protections in place to reinforce
their security across all network
environments. This blocks DDoS attacks
which are capable of evading either onpremises
only or cloud-only defences.
For instance, conventional cloud-based
DDoS mitigation tools can defend against
larger volumetric attacks targeting internet
connectivity prior to them overwhelming
local protection. Meanwhile, to defend
against application-layer and encrypted
traffic attacks, organisations will need onpremises
defences near the targeted
applications or services. However, with both
examples, the solutions' level of effectiveness
is very limited as it protects one network
environment instead of the other.
For organisations to overcome this, it is
best practice for them to adopt a hybrid
or multi-layer DDoS defence approach
with both cloud and on-premises
components that recognise all the
different DDoS attack vectors and
methodologies.
HOW TO ESTABLISH A HYBRID
SECURITY STRATEGY
A hybrid DDoS defence strategy
incorporates an on-premises, detection
and prevention system with on-demand
cloud-based mitigation capabilities at
the edge. The combination of the
unrelenting nature of adversaries and
the growing complexity of DDoS attack
methodologies and techniques
necessitates the basis of a
comprehensive DDoS mitigation
strategy to be an on-premises, roundthe-clock,
purpose-built DDoS attack
protection system.
This must be capable of automatically
identifying and blocking all types of
DDoS attacks and other cyberthreats
prior to damage being inflicted on
business-critical online infrastructure
and services.
While traditional cloud-based DDoS
protection solutions are effective when it
comes to stopping large volumetric DDoS
attacks, they have difficulty in blocking
other types of DDoS attacks designed to
evade their systems. But cloud-based
mitigation solutions shouldn't be
discarded entirely, as they strengthen the
protection of on-premises tools.
Fundamentally, the best solution is to
use a combination of an on-premises and
a cloud solution with intelligent and
automated integration, as this provides
the most comprehensive protection
possible. Although this doesn't represent a
one-size-fits-all solution, this approach
helps organisations to ensure that new
and evolving DDoS threats can be dealt
with in real time.
INCREASINGLY EFFECTIVE THREAT
ACTORS
With cybercriminals becoming
increasingly adept at launching
dangerous attacks and evading
traditional defence techniques, an
inability to adapt and defend against
these emerging DDoS attack techniques
will significantly damage businesses.
Therefore, businesses should implement a
more comprehensive defence strategy to
secure their network edges.
Even though cloud-based solutions may
be cost-effective, ultimately, they must do
more to protect organisations from the
rapidly evolving nature of the threat
landscape and the emerging types of
DDoS attacks.
Nevertheless, a multi-layer, hybrid solution
which deploys on-premises defence at the
edge, alongside a cloud-based backup,
ensures enterprises can maintain improved
cyber hygiene and prevent extended server
downtime in the event they're impacted by a
DDoS attack. NC
WWW.NETWORKCOMPUTING.CO.UK @NCMagAndAwards NOVEMBER/DECEMBERR 2023 NETWORKcomputing 27