Get Ready to Prevent DDoS Attacks

Because no organization is immune to an attack, and because the consequences can be very expensive for your company, it is better to anticipate. While we are seeing an increase in the size of DDoS attacks since 2015, here are some tips for getting ready for the best.

1. Measure the extent of the risk

The very first thing to do is to perform a vulnerability test to identify the flaws in the defense of your information system that could be exploited by malicious people. This consists of a thorough review of the strengths and weaknesses of your network, in order to tailor DDoS protection to your needs.

An intrusion test can be performed. It will simulate an internal or external network attack and will see if unauthorized access can reach the data. Even if it is not directly related to a DDoS attack, doing so eliminates a risk because some CIOs who were the victims of a denial of service attack initially thought it was a matter of diverting their attention a direct attack on their network.

And if your network is vulnerable to traditional hacking aimed at stealing data, in addition to being fragile in the face of a DDoS attack, you are the perfect target!

2. Bring adapted responses

The test revealed the vulnerabilities of your organization, the next step is to equip you with the necessary technologies and services or to refine their use if you are already equipped.

Home technologies were perfect in the 2000s, when DDoS attacks were simple and rarer. But, as often in computer science, what was valid ten years ago is no longer sufficient today. DDoS attacks have evolved so much in such a short time, both in complexity and size, that it is very difficult to build an effective solution yourself.

With the specialized equipment installed, it is often necessary to add additional hardware to the data centers to protect the servers and routers. Expensive hardware that needs to be configured and updated regularly to stay efficient despite the evolution of DDoS attacks. Not to mention that they remain sensitive to an increase in network capacity.

The most practical solution is to use cloud mitigation providers. Most vulnerability tests reveal that one of the most obvious weaknesses is the network capacity limit: as soon as the threshold is reached - either naturally or because of a DDoS attack - the network no longer responds. Cloud mitigation providers have a network capacity that far exceeds that of a single data center and have robust protection solutions, even against the largest DDoS attacks. They also have the staff and expertise to monitor networks and update client protection as the DDoS landscape changes, while filtering data to ensure that only legitimate traffic passes.

3. Prepare for the worst: set up a business continuity plan

Generally speaking, until you are hit by an attack, the damage is difficult to measure, and is often minimized. As strong as your protection is, in theory, and even if you have anticipated the resilience of your data, you need to plan your business continuity. Remember that an attack can have catastrophic financial, legal and/or regulatory effects, including for your reputation.

In addition to the technical constraints of data duplication and the verification that the data recovery time objectives (RTO) and the maximum allowable loss (RPO) correspond to the needs of your business, there are other procedures to put in place. At the top of the list are the people to mobilize in case of attack: the crisis team. Who should be reachable at any time among your security partners, how to contact them, what is the exact role of each, and who to prevent internally and externally?

Many companies have planned a communication plan but have omitted the fact that in case of a big DDoS attack, a certain number of means of communication will no longer be effective. Blogs and e-mails may not work anymore, so plan on using other communication methods such as social media to keep your partners, employees, customers, and even the media informed.

4. Define your ransom policy

Sometimes, DDoS attacks are committed by cybercriminals who ask for a ransom in exchange for stopping their action.

In this case, it is not recommended to pay. Firstly because you have no guarantee that pirates will honor the pact once the money is collected. On the other hand, because if you pay once, there is a good chance that the same pirates will come back. It's organized crime, racketeering: they can offer protection against money.

The best response is to inform your legal team of the attack and provide them with the ransom demand. Sometimes requests for extortion have been requested even before the attack begins.

In the event of a successful attack, depending on its duration and impact, some companies may need to disclose the attack as soon as possible.

5. Think about insurance

The war between brands and cybercriminals is nothing more than an arms race, and sometimes criminals win. Aware of this risk despite the defenses put in place, some companies subscribe to insurance policies against data theft or cyberattacks.

Above all, if you subscribe to it, make sure that the insurance policy covers not only the immediate and pragmatic damages but also the possible fines that would apply.