Intern Insights: Pete's Top Tips

This week’s post will look at Distributed Denial of Service (DDoS) attacks, a threat that can disrupt websites and entire networks.

What is a DDoS Attack?

A DDoS attack occurs when an attacker floods a network, server, or website with a massive amount of fake traffic, overloading it and causing it to crash or slow down enough to be inaccessible to legitimate users. This attack is “distributed” because it involves multiple devices or botnets, which are networks of infected computers, all sending traffic at once. DDoS differs from DoS which would be an attack sent from a single location.

?

How DDoS Attacks Work

1. Botnet Creation: Attackers use malware to infect thousands of devices, forming a “botnet.” These devices, controlled remotely, are then directed to send large volumes of traffic to the target.
2. Traffic Overload: With the botnet activated, the devices flood the target server or network with requests. The system becomes overwhelmed, slowing down or crashing under the load.
3. Denial of Service: Legitimate users are unable to access the targeted website or service due to the excessive traffic, resulting in lost revenue and potential data loss.

?

Real-World Examples of DDoS Attacks

• The largest ever DDoS attack (to date) targeted Google Cloud in September 2017 and had a peak volume of 2.54 Tb/s (terabits per second). Imagine every person on the planet, roughly 8 billion people, sending 300 emails at the same time. That’s the kind of data flood that a 2.54 Tb/s DDoS attack generates, all hitting one target at once. (Google says it mitigated a 2.54 Tbps DDoS attack in 2017, largest known to date | ZDNET)
• In February 2022, the Russian invasion of Ukraine resulted a large DDoS attack that disrupted Ukrainian government and financial sectors. The invasion contributed to an increase in cyber aggression against Western allies, with the UK financial sector seeing a large uptick in DDoS attacks. (2022 in review: DDoS attack trends and insights | Microsoft Security Blog)

?

Best Practices for DDoS Protection

1. Content Delivery Networks (CDNs) are geographically distributed networks of proxy servers. Using CDNs such as Cloudflare can distribute content across a network of servers, which can absorb and balance traffic during an attack, minimising the impact on your primary server.
2. Implement a Web Application Firewall, i.e. Azure WAF to filter traffic and block suspicious requests.
3. Network traffic monitoring tools help detect abnormal spikes in traffic.
4. Only allow necessary devices and services to access your network. This minimises potential entry points for DDoS attackers.

If you found any of this interesting, we'd love to hear your feedback!