figures
Blog

How to Avoid DDoS Attacks?

Admin Globaldots
29.12.2012
image 3 Min read

A couple of milliseconds delay of your page load time can cause a significant loss of revenue. We have explained this in length, recently. What about a complete stop to all of your website functions? For hours, days, weeks? Such attacks on websites, especially those websites that deal with payment, business transactions or transfer of personal data, are becoming more and more frequent. They are known as denial-of-service (DoS) attacks. Distributed denial-of-service (DDoS) attack means that the attacker/hacker is choosing one computer system as a master system to control sometimes as many as hundreds of thousands other computer systems, known as zombies or bots. They all work with a uniform goal of flooding the targeted host with as many communication packets as possible to stop the website from working. Entirely.

As an online vendor, you are not only under the threat of being flooded with the denial-of-service packets, but also of being used as a zombie machine to perform such attacks.

Not even giants are immune to distributed denial-of-service (DDoS) attacks. Yahoo! was inaccessible for 3 hours in 2000, and the revenue lost was estimated to about $500,000. In the same year, Amazon was down for 10 hours, with a loss estimated to $600,000. The attacks in the past were not avoided by CIA, or even The Pirate Bay. Each time, the attacks have not only affected businesses, but also individuals, trading companies, file sharers and end-customers.

DDoS attacks are one of the biggest threats to the security on the Internet, since the users of controlled computer systems are usually not aware of the attack performed. And since packets are not coming from a single source, they can not be stopped by simply blocking a single IP address.

If not stopped, how can DDoS attacks be prevented?

Not that using one method of prevention alone can actually protect you. However, by using a combination of a few, you have a better chance of defending your business space. Or, to walk you through defense strategies:

  1. Updates, updates. You should make sure that all of your security patches are always up to date. That your firewalls are the latest versions of those firewalls. That your system is clean and all unused ports are always disabled on the host system.
  2. Use a CDN hosting. Content delivery networks (CDNs) use servers located at different data centers. Not only one, but many communication channels are used. Since the emergence of cloud computing, CDNs are employed not only as a tool for unclogging the internet (see the history of CDNs >>link to post), but also as a tool for mitigating (avoiding) DDoS attacks. CDNs will absorb less-sophisticated DDoS attacks, simply with bandwidth. With CDNs, you gain the advantage of – size.
  3. IP Broadcast and IP Hopping. See that IP broadcast is disabled on the host computer. Also, see that you change location of your active server proactively, using a pre-specified set of IP address ranges.
  4. Filters, filters. See that only trusted IP connections are accessing your website. Drop traffic with others. For this, you will, again, need to apply multiple methods of IP address filtering.
  • Ingress filtering: drop traffic with IP addresses that do not match a domain prefix connected to the ingress router
  • Egress filtering: ensure that only assigned or allocated IP address spaces leave the network
  • Connection limiting: the number of new connection requests is limited, existing connections are preferred
  • Age filtering: idle connections are removed from the IP tables in firewall and servers
  • Source rate filtering: when there are limited number of IP addresses involved in a DDoS attack, outer IP addresses that break the norm are identified
  • Dynamic filtering: create a short-span filtering rule and remove that rule after that time-span
  • Active verification: combined with SYN proxy, legitimate IP addresses are cached into a memory table for a limited period of time and are being let out without the SYN proxy check
  • Anomaly checks: works for scripted DDoS attacks
  • Black List/White List: deny/allow access to certain IP addresses from the lists
  • Dark address prevention: drop traffic with all IP addresses not assigned by IANA

Comments

0 comments

There’s more to see

slider item
Cloud Web Application Firewalls (WAF)
Webinar: Safer, Smarter – Cloud WAF 2.0 (Hebrew)
Dror Arie 18.10.21

Cloud transformation is an opportunity to implement a WAF that fits your new, agile IT infrastructure. Appliance-based WAF, or a migrated one, is insufficient for 2021’s security challenges. However, many organizations are concerned that the current range of Cloud WAFs is insufficient for their needs. Starting today, this concern belongs in the past. In this […]

Read more
slider item
Your Innovation Feed
Hear It From 3 Security Leaders: How Security Can Accelerate Business
Dror Arie

Which is more important: security or speed? This question has long been a source of concern for businesses worldwide, and it can leave many organizations vulnerable to hacks in the name of doing things fast and improving employee work experience.  Starting today, to foster corporate security and growth, you do not need to compromise your […]

Read more
slider item
Bot Mitigation & Anti-Fraud
Case Study: Retailers Saves $500K/mo with Anti-Bot Innovation
Dr. Eduardo Rocha 14.10.21

Today’s bots are too clever for CAPTCHAs. Yet, their financial and reputational damage potential is sometimes immeasurable. eCommerce retailers are left helpless, with overwhelming compute overspend and fraud costs: Bots can be responsible for up to 99.8% of an online store’s traffic. Credential stuffing campaigns can generate 250,000 requests per hour.  Fraudulent transactions may cost […]

Read more

Unlock Your Cloud Potential

Schedule a call with our experts. Discover new technology and get recommendations to improve your performance.
Contact us
figure figure figure figure figure

Don’t Fortify. Amplify | Cloud Security Reimagined