DDoS Protection: 14 Unique Ways to Protect Your Organisation

DDoS attacks have become a nightmare for organisations with an active online presence. Here are 14 ways to protect your business. 

If your website goes down due to an overload of website traffic, you’re probably a victim of the notorious distributed denial of service (DDoS) attack. DDoS attacks have become a nightmare for companies with an active online presence. From BBC to Twitter and from Donald Trump’s website to Netflix, 2016 saw some of the most unprecedented cyber attacks in the history of the internet.

From BBC to Twitter and from Donald Trump’s website to Netflix, 2016 saw some of the most unprecedented cyber attacks in the history of the internet.

In the ever-changing world of high-tech gadgets and rising popularity of Internet of Things, DDoS attacks have increased 2.5 times over the last 3 years, and are believed to become increasingly frequent in the coming years.

Furthermore, according to a report by Cisco in 2016, the average size of DDoS is accelerating and approaching 1Gbps, which is enough to bring large business offline. Globally, the DDoS attacks grew by 25% in 2015 and are likely to increase by 260% by 2020.

From monetary to brand value, DDoS attacks drastically affect every part of the business. The cost a business can incur from a DDoS attack range up to $20,000 and for airline Virgin Blue lost $20 million in an IT outage that lasted for 11 days in 2010.

Today, businesses need to tighten their seat belts to work and land safely in the highly advanced internet world. Here are 14 unique ways to protect yourself from DDoS attacks.

1. Create an Action Plan in Advance
Why wait for a DDoS attack to ruin your business? Intelligence is in responding to the potential attacks before they happen.

Focus on creating a system that absorbs a potential DDoS attack. Though creating an action plan in advance is not 100% foolproof way of DDoS protection, it does help in mitigating the risk to a great extent.

An action plan might consist of the following items:

  • Use sensors that send an alert whenever the website is down.
  • In case of any malicious activity, dump the logs quickly.
  • Consider contacting your ISP to understand about the free and paid DDoS protection plans.
  • Confirm the DNS TTL (time-to-live) for systems that can be attacked in the future.
  • Document your IT infrastructure and create a network topology diagram with an asset inventory.
  • Purchase DDoS protection products to mitigate the monetary loss due to the attacks.

An action plan comes in handy when your website is under attack because it would reduce the extent of damage caused by the hackers.

2. Monitor Traffic Levels
A DDoS attack brings an unprecedented amount of traffic to your server, which spikes the traffic beyond your imagination.

In fact, an ideal time for any hacker to strike is when your website is likely to witness huge amount of traffic such as Thanksgiving or Christmas. They mix with the genuine traffic and overloads the server with unprecedented traffic, which eventually crashes the server.

Therefore, the best way to quickly notice a DDoS attack is to look out for abnormal traffic increase to your website. If you expect 500 visitors per 10 minutes, an influx of 4000 visitors per minute should trigger an alert.

Staying alert, monitoring the traffic and setting threshold limits when traffic goes beyond a certain level will help you in DDoS protection.

3. Pay Attention to Connected Devices
Internet of things is the latest buzz and a growing topic of conversation both in the workplace and outside. From wearables to retail, healthcare to agriculture, IoT is making an impact in every sector, but even this burgeoning technology is not spared by attackers. Hackers find their way through these connected devices to disrupt the services of a brand.

Paying special attention of the connected devices will help you wade through the DDoS attack. For stronger DDoS protection, change the passwords of the devices regularly, switch off the devices when not in use and verify every device before connecting it.

Until the procession begins, focus on mitigating the threats to protect the connected device and your server.

4. Ensure You Have Extra Bandwidth
It makes sense to have more bandwidth than you would plausibly need because overprovisioning your bandwidth provides extra time to identify and deal with the attack. It also enables the server to accommodate unprecedented spikes in traffic and to some extent lowers the intensity of the attack.

If you overprovision the bandwidth by 200 percent or 600 percent, it will not stop the DDoS attack, but it will buy you crucial time before your resources are overwhelmed.

Therefore, when determining the requirement of bandwidth give your business a healthy margin of error to mitigate the risk of cyberattacks.

5. Train Your Customers On Security
An informed and a trained customer is an asset to your business as they walk with you hand-in-hand for higher DDoS protection.

Explain to the customers the necessity and dire need of safeguarding their systems because hackers target computers with weak passwords.

Gone are those days when birthdate or family name was considered as a strong password for a computer. Urge your customers to keep difficult passwords to protect their privacy. Furthermore, educate the clients to skip any attachments received from email addresses they don’t recognize.

Today, customer education is an essential component of any company’s strategy for DDoS protection. To proactively guard the customers against such cyber bullies, encourage them to review and follow best practices to secure their device.

6. Set up Secured VPS Hosting
In order to save a few dollars, many businesses opt for the lowest price hosting plans available in the market. While the initial cost is low, the threat of DDoS is attack is outrageous. Setting up a secured VPS hosting provides DDoS protection and reduces the probability of an attack.

With a secured VPS, your website has its own portioned space, unique IP address and operating system, thereby isolating the site from cyberattacks. Furthermore, secured VPS hosting provides full access to console, which helps in eliminating the potential malware.

In short, DDoS secured VPS hosting takes away the headache and makes use of the latest technology to put your website in the driving seat.

7. Drop Packets from Obvious Sources of Attack
DDoS attacks have the potential to create a havoc on your business and you need to stop traffic from false sources at any cost. Focus on using the access list at the perimeter of network to prevent malicious activities. Furthermore, instruct the router to drop packets from IPs that are obvious sources of attack. You can also rate limit your router to add another layer of protection.

Again, with the increasing size of online attack, this strategy will only buy time and delay the ramping up of the threat.

8. Purchase a Dedicated Server
Purchasing a dedicated hosting server will provide you with more bandwidth, control over security, and countless resources. With a dedicated server as your first layer of defense, you can successfully run your online site with thousands of legitimate customers without worrying about anything. Undoubtedly, dedicated servers are expensive, but the benefits clearly outweigh any monetary issue you face due to lack of DDoS protection.

Our DDoS protected dedicated servers provide DDoS protection of 20 Gbps with a bandwidth of 10 terabytes. We manage 100% of the server operation, giving you room to focus on other important business aspects.

9. Block Spoofed IP Addresses
“Things are not always what they seem; the first appearance deceives many”.
-Phaedrus

These words hold true, especially for IP address spoofing. For those of you who are new to the word ‘spoofing’ – in simple English, it means ‘presenting the wrong facts in a decorated manner’. Prevention of IP address forgery leads to harmful DDoS attack and you need to focus on the following tips to stop IP address spoofing.

  • Create an access control list (ACL) to deny all inbound traffic with a particular source IP.
  • Focus on using reverse path forwarding (RPF) or IP verify. It works similar to an anti-spam solution.
  • Filter both outbound and inbound traffic to enhance DDoS protection.
  • Change the configuration of your switches and routers such that they automatically reject packets coming from outside your network.
  • Focus on encrypting different sessions on your router to allow trusted hosts who are outside your network.

10. Install Patches and Updates Frequently
Installing updates on open source platforms like WordPress as soon as possible mitigates the risk of attack because the potential security loophole is filled with an update. Therefore, deploy an update within your network as soon as possible. The longer the lag time between the update and the application, the more vulnerable your system becomes.

This is often neglected by many businesses, mainly because of the frequency of updates and they consider it irrelevant to update the application.

11. Aggressively Monitor Half-Open Connections

In a usually three-way handshake:

  • The client request connection by sending SYN (synchronize) packet to the server,
  • The server returns the SYN-ACK (synchronize-acknowledge) packet to the client,
  • The client answers with an ACK (Acknowledge) that the package is received and communication begins.
  • In half-open connections, the packets are not sent to the hostile client. However, the client sends multiple requests to the server ports using fake IP addresses. Such a connection is not closed and remains open making it vulnerable to attack.

Detection of such half-open connections is done by:

  • Adding an empty keepalive message to the application protocol framing
  • Adding a null keepalive message to the actual application protocol framing
  • Using an explicit timer
  • Altering the TCP keepalive settings

12. Use Proxy Protection
Proxy protection provides an extra layer of DDoS protection for any website and keeps your website safe from complex cyber threats. Our remote DDoS proxy protection hides your real IP from hackers and sends proxy traffic through their mitigation network. The best part is that the entire process occurs without the visitors realizing it. Furthermore, remote proxy protection increases the security and performance of HTTP applications. It’s a must for any business looking to create an impact in the online world.

13. Set up RST Cookies
RST cookies are a strong defense against the DDoS because the server sends incorrect ACK + SYN to the client and then the client forwards a packet telling the server about the potential error. Therefore, it prevents the business from potential attack.

14. Filter UDP Traffic With Remote Black Holing
Filtering the UDP traffic with remote black holing can effectively stop undesirable traffic to enter a protected network. These remote black holes are areas where the traffic is forwarded and then dropped. And, when an attack is detected it drops all the traffic based on the IP address and the destination. Here are the three steps to set it up:

  • Prepare a null route
  • Prepare a route map
  • Generate a victim route on the management router

To learn more about various types of DDos attack and appropriate hosting go to RivalHost:

  

« Directors Report March 2017. Cloud Computing For Management (£)
Snowden Helping To Protect Journalists »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

European Defence Agency (EDA)

European Defence Agency (EDA)

EDAs mission is to improve European defence capabilities. Programme areas include Cyber Defence.

Eden Legal

Eden Legal

Eden Legal provides legal services on commercial and regulatory issues affecting digital businesses.

Centre for International Governance Innovation (CIGI)

Centre for International Governance Innovation (CIGI)

CIGI research areas include Conflict Management & Security which encompass cyber security and cyber warfare.

ObserveIT

ObserveIT

ObserveIT helps companies identify & eliminate insider threats. Visually monitor & quickly investigate with our easy-deploy user activity monitoring solution.

ESL Bangladesh

ESL Bangladesh

ESL is the Largest IT Infrastructure & Telecom Service Provider in Bangladesh.

Security BSides

Security BSides

Security BSides is the first grass roots, DIY, open security conference in the world!. BSides is a community-driven framework for building events for and by information security community members.

IP2Location

IP2Location

IP2Location provide services to identify geolocation by IP address, and to detect IP addresses associated with anonymous proxy servers, which are often used for fraud and spamming purposes.

Control System Cyber Security Association International (CS2AI)

Control System Cyber Security Association International (CS2AI)

CS2AI is the premier global not for profit workforce development organization supporting professionals of all levels charged with securing control systems.

Robo Shadow

Robo Shadow

Robo Shadow are trying to bridge the gap between the top tier organisations that can afford everything and everyone else who has to “Make it up as they go along” when it comes to Cyber.

ISECURION Technology & Consulting

ISECURION Technology & Consulting

ISECURION is an information security consulting company. We provide a unique blend of services to our customers catering to the current information security landscape.

AMSYS Innovative Solutions

AMSYS Innovative Solutions

AMSYS is a full-service, 24/7/365 IT solutions, Cybersecurity & Managed Service Provider.

Avrem Technologies

Avrem Technologies

Avrem Technologies is a business IT and cybersecurity consulting firm. We design, implement, manage and monitor the networks, servers, computers and software that our clients rely on each day.

Logiq Consulting

Logiq Consulting

Logiq Consulting provide a full range of Cyber Security, Information Assurance and System Engineering services.

Walacor

Walacor

Walacor’s secure data platform represents the next generation of secure data and blockchain storage with a trust-first approach that revolutionizes enterprise data, and database management systems.

BBS Technology

BBS Technology

BBS Technology is a company that develops and delivers next-generation cyber security technologies worldwide.

Symbiotic Security

Symbiotic Security

Symbiotic Security revolutionizes code security by integrating an AI-driven security coach directly within developers' IDEs.