Hit By DDoS? You Will Be Hit Again…
More than 80% of DDoS victims are attacked a second time.
More than half of all DDoS strikes have resulted in some kind of customer data loss, intellectual property theft or disappearance of money, according to a new report from Neustar, a marketing, IT and security services, data services and domain registry company.
It’ll happen again, too. The IT firm also discovered that the vast majority of organizations (82 percent) are attacked again after the first DDoS onslaught.
“DDoS attacks continue to pose a legitimate threat as a dangerous weapon used to create chaos and hold organizations hostage,” Neustar says in the report. Not many are “spared,” the security outfit says, and almost half of those blitzed once were thrashed six or more times.
Company responses to DDoS attacks
DDoS attacks are “an institutionalized weapon of cyber warfare,” says Rodney Joffe, head of IT security research at Neustar, in a press release. “The reverberations are felt like a domino effect throughout all departments.”
The consequences appear to be an overall increase in investment in DDoS protection, though. “Participating in security consortiums to share information on threats and counter measures” is also becoming popular, the release says.
About three quarters (76 percent) of the battered companies increased spend on protection in 2015. Half (47 percent) joined in with others to share information.
Sharing information is critical
Interestingly, another recent report complains of private-sector cybersecurity folks not sharing enough. Fedscoop writes about McAfee’s March 2016 study of 500 business professionals who said they “were aware of cyber-threat sharing initiatives” but weren’t convinced they wanted to reciprocate—even though they would be happy to receive such information.
“Ninety-one percent said they would be interested in receiving information relevant to their industry. Only 63 percent said they would be likely to reciprocate by sharing their own intelligence,” Fedscoop says of the McAfee study.
Sharing is important to get a picture of who the attackers are, what they are assailing and how they’re doing it. A “lack of understanding” and corporate policy issues are “barriers to sharing,” Fedscoop explains.
The increase in DDoS protection spending uncovered by Neustar wasn’t across the board.
Thirty-seven percent of the companies surveyed say they’re investing more than a year ago, and that it’s “in proportion to the threat of DDoS attacks.” Another 39 percent say they are investing but think they should invest even more.
Sixteen percent aren’t investing more, though. A further 5 percent not only aren’t investing more, but they say DDoS isn’t a high priority. Only 3 percent have no specific anti-DDoS budget.
Neustar surveyed 1,005 executives across the tech, financial services and government sectors in late 2015. Seventy-nine percent of the organizations “report yearly revenues of more than $100 million, with $1 billion or more in annual revenue,” it says.
The loss numbers are big, too. Half of the organizations “would lose at least $100,000 per hour in a peak-time DDoS-related outage, [and] 33 percent would lose more than $250,000 per hour.”
And almost half (42 percent) “needed at least three hours to detect that they were under DDoS attack,” Neustar says.
