A couple of milliseconds delay of your page load time can cause a significant loss of revenue. We have explained this in length, recently. What about a complete stop to all of your website functions? For hours, days, weeks? Such attacks on websites, especially those websites that deal with payment, business transactions or transfer of personal data, are becoming more and more frequent. They are known as denial-of-service (DoS) attacks. Distributed denial-of-service (DDoS) attack means that the attacker/hacker is choosing one computer system as a master system to control sometimes as many as hundreds of thousands other computer systems, known as zombies or bots. They all work with a uniform goal of flooding the targeted host with as many communication packets as possible to stop the website from working. Entirely.
As an online vendor, you are not only under the threat of being flooded with the denial-of-service packets, but also of being used as a zombie machine to perform such attacks.
How One AI-Driven Media Platform Cut EBS Costs for AWS ASGs by 48%
Not even giants are immune to distributed denial-of-service (DDoS) attacks. Yahoo! was inaccessible for 3 hours in 2000, and the revenue lost was estimated to about $500,000. In the same year, Amazon was down for 10 hours, with a loss estimated to $600,000. The attacks in the past were not avoided by CIA, or even The Pirate Bay. Each time, the attacks have not only affected businesses, but also individuals, trading companies, file sharers and end-customers.
DDoS attacks are one of the biggest threats to the security on the Internet, since the users of controlled computer systems are usually not aware of the attack performed. And since packets are not coming from a single source, they can not be stopped by simply blocking a single IP address.
If not stopped, how can DDoS attacks be prevented?
Not that using one method of prevention alone can actually protect you. However, by using a combination of a few, you have a better chance of defending your business space. Or, to walk you through defense strategies:
- Updates, updates. You should make sure that all of your security patches are always up to date. That your firewalls are the latest versions of those firewalls. That your system is clean and all unused ports are always disabled on the host system.
- Use a CDN hosting. Content delivery networks (CDNs) use servers located at different data centers. Not only one, but many communication channels are used. Since the emergence of cloud computing, CDNs are employed not only as a tool for unclogging the internet (see the history of CDNs >>link to post), but also as a tool for mitigating (avoiding) DDoS attacks. CDNs will absorb less-sophisticated DDoS attacks, simply with bandwidth. With CDNs, you gain the advantage of – size.
- IP Broadcast and IP Hopping. See that IP broadcast is disabled on the host computer. Also, see that you change location of your active server proactively, using a pre-specified set of IP address ranges.
- Filters, filters. See that only trusted IP connections are accessing your website. Drop traffic with others. For this, you will, again, need to apply multiple methods of IP address filtering.
- Ingress filtering: drop traffic with IP addresses that do not match a domain prefix connected to the ingress router
- Egress filtering: ensure that only assigned or allocated IP address spaces leave the network
- Connection limiting: the number of new connection requests is limited, existing connections are preferred
- Age filtering: idle connections are removed from the IP tables in firewall and servers
- Source rate filtering: when there are limited number of IP addresses involved in a DDoS attack, outer IP addresses that break the norm are identified
- Dynamic filtering: create a short-span filtering rule and remove that rule after that time-span
- Active verification: combined with SYN proxy, legitimate IP addresses are cached into a memory table for a limited period of time and are being let out without the SYN proxy check
- Anomaly checks: works for scripted DDoS attacks
- Black List/White List: deny/allow access to certain IP addresses from the lists
- Dark address prevention: drop traffic with all IP addresses not assigned by IANA
