Monday, 20 May 2013

How to defend yourself and your company from a DDoS attack


DDoS mitigation

DDoS stands for Distributed Denial-of-Service attacks. They have become increasingly popular and have gone up in scale, intensity and frequency.

DDoS Map
Image Courtesy of
There are a wide range of reasons for DDoS attacks, including political (hacktivism), criminal, or just simply for their own amusement; which makes anyone with an online presence a potential target.

If you find that your site or organization is under attack, it’s important that you report such attacks quickly to parties that are best positioned to help you mitigate, weather, and restore normal service.

Here are some steps you can take to take out the sting

Simulate your own DDoS attacks

Create a simulated DDoS attack on your network. This will help you or your management see the best options to mitigate when under a real attack. Here’s a simple video of how to perform your own DDoS attack.

Manage communications

If you do get a DDoS attack, make sure you are prepared to have a single point of contact streamless information sharing. This contact can keep more of the organisation up to date with short updates so everyone understands the situation. By already completing the simulation process mentioned above, everyone in the team will know their specific roles in the mitigation process and how they can continue ‘business as usual’.

Make a plan, and keep planning again

Make a call tree, keep it updated and in the same place so it is easily referenced. Call trees are an important part of every disaster recovery plan. They are a telecommunications chain for notifying specific individuals of an event. It is very helpful if you need to reach certain employees after hours to notify them of a situation. This is in order to make sure the mitigation process is contained and in order. It helps turn an attack into an incident as everyone will know their role after the simulation and the plan created from it. You should also have teleconference bridges (where engineers can coordinate response efforts), a troubleshoot bridge for application owners to report issues, and a security and forensics bridge. This will help with the confusion and add speed again.

In April 2013, Prolexic (a DDoS mitigation service provider) mitigated a sustained DDoS attack peaking at 160 GBPS and 120 million packets per second - which is a very heavy attack. In the video below they explain and show you how they did it.

Source: Prolexic

Defend your business with a Certified Ethical Hacker (CEH) professional

EC-Council CEH logo

You too can learn how to perform DDoS attacks and help companies like PayPal defend themselves against it. Become a Certified Ethical Hacker (CEH) and earn on average £42,750 in the UK ( The CEH certification from the EC-Council is widely recognised as the entry into the hacking world. As an ethical hacker, you’d attempt to penetrate the networks or computers of your organisation or any organisation that hires you. "White hat" ethical hackers are widely sought after to help find and fix the vulnerabilities that would otherwise be exploited by "black hat" criminal hackers.

About the Author:
Sarah writes for Firebrand Training on a number of IT related topics. This includes exams, training, certification trends, project management, certification, careers advice and the industry itself. Sarah has 11 years of experience in the IT industry.