Blog

How to Avoid DDoS Attacks?

Admin Globaldots
29.12.2012
image 3 Min read

A couple of milliseconds delay of your page load time can cause a significant loss of revenue. We have explained this in length, recently. What about a complete stop to all of your website functions? For hours, days, weeks? Such attacks on websites, especially those websites that deal with payment, business transactions or transfer of personal data, are becoming more and more frequent. They are known as denial-of-service (DoS) attacks. Distributed denial-of-service (DDoS) attack means that the attacker/hacker is choosing one computer system as a master system to control sometimes as many as hundreds of thousands other computer systems, known as zombies or bots. They all work with a uniform goal of flooding the targeted host with as many communication packets as possible to stop the website from working. Entirely.

As an online vendor, you are not only under the threat of being flooded with the denial-of-service packets, but also of being used as a zombie machine to perform such attacks.

Not even giants are immune to distributed denial-of-service (DDoS) attacks. Yahoo! was inaccessible for 3 hours in 2000, and the revenue lost was estimated to about $500,000. In the same year, Amazon was down for 10 hours, with a loss estimated to $600,000. The attacks in the past were not avoided by CIA, or even The Pirate Bay. Each time, the attacks have not only affected businesses, but also individuals, trading companies, file sharers and end-customers.

DDoS attacks are one of the biggest threats to the security on the Internet, since the users of controlled computer systems are usually not aware of the attack performed. And since packets are not coming from a single source, they can not be stopped by simply blocking a single IP address.

If not stopped, how can DDoS attacks be prevented?

Not that using one method of prevention alone can actually protect you. However, by using a combination of a few, you have a better chance of defending your business space. Or, to walk you through defense strategies:

  1. Updates, updates. You should make sure that all of your security patches are always up to date. That your firewalls are the latest versions of those firewalls. That your system is clean and all unused ports are always disabled on the host system.
  2. Use a CDN hosting. Content delivery networks (CDNs) use servers located at different data centers. Not only one, but many communication channels are used. Since the emergence of cloud computing, CDNs are employed not only as a tool for unclogging the internet (see the history of CDNs >>link to post), but also as a tool for mitigating (avoiding) DDoS attacks. CDNs will absorb less-sophisticated DDoS attacks, simply with bandwidth. With CDNs, you gain the advantage of – size.
  3. IP Broadcast and IP Hopping. See that IP broadcast is disabled on the host computer. Also, see that you change location of your active server proactively, using a pre-specified set of IP address ranges.
  4. Filters, filters. See that only trusted IP connections are accessing your website. Drop traffic with others. For this, you will, again, need to apply multiple methods of IP address filtering.
  • Ingress filtering: drop traffic with IP addresses that do not match a domain prefix connected to the ingress router
  • Egress filtering: ensure that only assigned or allocated IP address spaces leave the network
  • Connection limiting: the number of new connection requests is limited, existing connections are preferred
  • Age filtering: idle connections are removed from the IP tables in firewall and servers
  • Source rate filtering: when there are limited number of IP addresses involved in a DDoS attack, outer IP addresses that break the norm are identified
  • Dynamic filtering: create a short-span filtering rule and remove that rule after that time-span
  • Active verification: combined with SYN proxy, legitimate IP addresses are cached into a memory table for a limited period of time and are being let out without the SYN proxy check
  • Anomaly checks: works for scripted DDoS attacks
  • Black List/White List: deny/allow access to certain IP addresses from the lists
  • Dark address prevention: drop traffic with all IP addresses not assigned by IANA

Comments

0 comments

There’s more to see

How Separating Data & Network Security Protects Your Supply Chain
Supply-Chain Data Protection
Dr. Eduardo Rocha, Senior Solutions Engineer & Security Analyst @ GlobalDots 09.05.22

Software supply chain security is an enormous concern for businesses today. According to a 2021 Argon cybersecurity report, software supply chain attacks increased threefold in 2021 compared to the previous year.  The constant race of companies to do things faster while delivering a better, richer user experience adds a multitude of vulnerabilities to the supply […]

Read more
SASE vs. SD-WAN: A Quick Guide
SD-WAN and SASE
Miguel Fersen, Senior Cloud Consultant @ GlobalDots

New technologies have a wicked tendency to pile up. With cloud solution categories now emerging on a weekly basis, the result of bringing them into your estate is usually more complexity and confusion. But sometimes, a single new technology allows us to rid a bunch of old ones in a snap. SASE pretends to be […]

Read more
Old Dogs, New Tricks: Innovating with CDNs
Content Delivery Network (CDN)
Dror Arie, Senior Solutions Architect @ GlobalDots 20.04.22

Today’s digital businesses with global customers cannot afford slow page loads and applications caused by physical distance and latency issues. Page load speeds can have a significant effect on customer acquisition and retention. Walmart discovered that a 1% increase in page load time results in a 2% increase in conversion rates. So businesses are using […]

Read more
Unlock Your Cloud Potential
Schedule a call with our experts. Discover new technology and get recommendations to improve your performance.
Contact us