Types of DDoS Attacks

1. Volumetric Attacks: This is the most common type of DDoS attack. A bot overwhelms the bandwidth of a network by sending large numbers of false requests to every open port. This implies that legitimate traffic is blocked out.
2. Application-layer Attacks: This type of DDoS attack majorly targets the applications that users interact with. It obstructs web traffic by directly attacking HTTP, HTTPS, DNS or SMTP protocols. This type of attack can be hard to catch and troubleshoot, as a machine may only respond as usual to unusually high web traffic. Here the devices thinks these are legitimate web traffic & tries to keep up with the increased traffic and ultimately dies down.
3. Protocol Attacks: Protocol attacks are usually targeted at parts of the network used to verify network connections. They send slow or malfunctioned pings so that the network uses up a lot of memory to verify those pings. This type of attack can also target firewalls by sending large amounts of purposefully irregular data.

Prevention of DDoS Attacks:- Despite the threat and difficulty of identification, it is possible to prevent a DDoS attack with careful planning and implementing security measures. Below are a few methods one can use to prevent DDoS attacks on a network:

• Organizing a Denial-of-Service Response Plan: A thorough DDoS response plan should document how to maintain business operations if a DDoS attack is successful, technical expertise that will be necessary for mitigation, and a checklist to ensure that assets have advanced threat detection features. An incident response team can also be established to battle a DDoS attack and to notify stakeholders throughout the organization. Well-defined notification and escalation procedures can also help keep an organization in good stead as it battles such a cyber-attack.

 

• A risk assessment or network vulnerability assessment: A risk assessment involves the identification of security exposures so that infrastructure can be patched up and prepared for a DDoS attack or any other cybersecurity risk. The risk assessment will take inventory of all devices, their purpose, prepare for future upgradation etc. Conduction of audits is also necessary on the devices, servers and networks. It may be impossible to avoid a DDoS attack altogether, but knowing the strengths and vulnerabilities can go a long way in mitigating the effect of the attack.

 

• Knowledge of network traffic: Shutting off network traffic altogether may not be possible, but the first thing an organization must do is to determine the quality or source of abnormal or suspicious traffic. Knowing the general traffic pattern will help an organization establish a baseline, and when any unusual activity occurs, the symptoms of a DDoS attack can be identified.

 

• Reduce surface area for an attack: By reducing the surface area to attackers, their options to orchestrate DDoS attacks will be minimized. Load balancers can be leveraged to protect web servers from exposure by placing them behind them. Keeping applications clean by removing unrelated services, unrequired features and processes etc. is also helpful in reducing the chances or opportunities of attack.

 

• Multi-layered DDoS protection: Earlier DDoS attacks used to be volumetric attacks that would attack the network or transport layers. Now, different types of DDoS attacks target a different layer (transport, network, session, application layers) or a combination of layers. DDoS mitigation solutions should provide multiple layer protection to an organization’s network.

 

• Firewalls and other prevention solutions: It is important to equip the network, applications and infrastructure with multi-level protection strategies. This includes systems that combine firewalls, VPN, anti-spam, content filtering and other security layers to monitor activities and identify inconsistencies that may be symptoms of DDoS attacks. Organizations also opt for a Web Application Firewall (WAF). A WAF is software that sits between the internet and the servers of the organization and acts as a reverse proxy. The use of firewalls with DDoS protection can be one of the most effective mitigation strategies to prevent such cyber-attacks. There are dedicated DDoS appliances which are used by very large organization and ISP service providers. These are quite expensive but large organization compare the investment compared to the cost of data breach .

 

• Cloud usage: Cloud providers offer a high level of cybersecurity, including firewalls with DDoS protection, dedicated anti-DDoS devices and other threat monitoring software. The cloud also has greater bandwidth than most private networks and provides duplicate copies of the data, systems, equipment etc, so that, one can switch to secure access on backed-up versions without wasting a moment, should any disaster happen.

   

• DDoS Protection Solution: A fully robust protection solution includes elements that help in defence and monitoring. A dedicated DDoS Protection Solution should employ a range of tools that can defend against every type of DDoS attack and monitor thousands of parameters simultaneously. As mentioned before, these are quite expensive but large organization compare such investment compared to the likely cost in case of data breach.

About SNS Secure Network Solutions India (SNS) provides a quantifiable, risk-based approach to building corporate cybersecurity based on globally recognized frameworks and standards. We have been protecting businesses for the last 21 years! Write to us at [email protected]