10 ms·
DDoS Attacks: Best Practices for Prevention and Response
- lima 10y agoGoogle cache: http://webcache.googleusercontent.com/search?q=cache:https://insights.sei.cmu.edu/sei_blog/2016/11/distributed-denial-of-service-attacks-four-best-practices-for-prevention-and-response.html&num=1&strip=1&vwsrc=0 http://webcache.googleusercontent.com/search?q=cache:https:/...
- hamilyon2 10y agoDoes anyone else notice irony.
- stcredzero 10y agoI've heard rumors of such a word.
- deleted 10y ago[deleted]
- barking 10y agoNice to see an accurate use of the word, it's becoming a rarity.
- TeMPOraL 10y agoIt also compensates for improper use of punctuation ;).
- user5994461 10y agoAll I notice is a case of "leading by example".
- dgacmu 10y agoIf you'd like more: I'm a professor at CMU, and my office is currently offline because someone decided to throw 5gbit/sec at my machine starting last Thursday. CMU's response - which I can't really fault, given that my office is not geo-distributed - was to filter inbound traffic at our upstream provider. No Internet for me; I'm back on the wifi. :)
- jlgaddis 10y agoYou should send your infosec department a link to this article. <g>
- dogma1138 10y agoThey might want to consider implementing a few of those controls.
- CiPHPerCoder 10y agoSadly, just because you know what the best practices are doesn't mean your university's IT department will let you implement them. Same can often be said if you replace "university" with "company". Internal political problems are beyond NP-hard.
- seanwilson 10y ago> Sadly, just because you know what the best practices are doesn't mean your university's IT department will let you implement them. The common saying is "the cobbler's children have no shoes".
- Demcox 10y agoOh the irony....
- AndrewStephens 10y agoWell I finally got the article on DDoS attacks to load (I haven't been this put out since it raaaained on my wedding day). I didn't find it particularly illuminating. > Deploy appropriate hardware that can handle known attack types and use the options that are in the hardware that would protect network resources... > If affordable, scale up network bandwidth... > There are several large providers that specialize in scaling infrastructure to respond to attacks... This advice all seems rather obvious.
- sriehl 10y agoarchive.is link with all formatting: https://archive.is/ASz1w https://archive.is/ASz1w
- AgentK20 10y agoUnfortunately, all of these "Best Practices" are "spend more money," which effectively means the attacker wins. They're forcing you to spend more money, even if they're not attacking you now/recently. Would love to see more things that reference open source mitigation software and such like that, e.g. tossing a hardened nginx in front of your Tomcat server, stuff like that. Granted, at some point, you're going to have to spend money to mitigate the attack no matter what, but if mitigation of DDoSs becomes entirely focused on "Go with a big centralized provider" or "Spend lots of money to mitigate the attacks," we end up in a much different Internet.
- dorianm 10y agoCloudflare is free, so there is that :)
- Thaxll 10y agoCloudflare only works for http/https.
- dorianm 10y agoThey have DNS too, and they also protect at lower OSI levels (like TCP / etc.) https://www.cloudflare.com/security/ https://www.cloudflare.com/security/
- jaawn 10y agoWhoah, I did not know they had a free plan for personal use. Thanks for the tip!
- AgentK20 10y agoTrue, and while Cloudflare is a great company, putting all our eggs in one basket isn't particularly wise. Not saying that this'll happen, but we've seen "great companies" that were great while there was strong competition, but eventually when they became the monopoly began to strangle out anything that they were against. Protection providers like Cloudflare would have enormous power to simply kick out a user for being "too costly to host," like Akamai did to KrebsOnSecurity, and then you'd get destroyed by attacks.
- 0xmohit 10y agoI'm not so sure if the best practices for prevention would be of any good.
- nailer 10y ago15 years ago: wow DDoS attacks are a thing. ISPs need to implement egress filtering. Now: wow DDoS attacks are still a thing. ISPs need to implement egress filtering. A consumer internet user who visits baidu doesn't need to be flooding an anti-censorship project's github page. A consumer internet user with an internet-of-shit camera doesn't need to be hitting dyn that frequently. ISPs need to coordinate and rate limit customers towards something that looks like reasonable traffic.
- erikb 10y agoDo you know that there are people who actively fight against ISPs filtering the internet?
- marcosdumay 10y agoWhat kinds of filtering are they fighting? Because null-routing malformed packets, for example, is completely different from null-routing the port of a service the ISP don't want. What is again, completely different from null-routing bittorrent.
- citrin_ru 10y agoPeople usually fight against filtering which limit legitimate usage (like filtering port 80 to prevent hosting web-site at home). I doubt that anybody fight against RFC2827, but there are still many ISP which don't implement this.
- hueving 10y agoThese points are so high level and obvious that this is basically useless: >Locate servers in different data centers. >Ensure that data centers are located on different networks. >Ensure that data centers have diverse paths. >Ensure that the data centers, or the networks that the data centers are connected to, have no notable bottlenecks or single points of failure. Getting Robbed: Best practices for Prevention and Response * Don't carry all of your money with you at all times. * Don't advertise that you're carrying large sums of money. * Have enough money that getting robbed doesn't really affect you. * Pay someone else to do your errands so you're not at risk.
- erikb 10y agoNot really getting your point. All but "having enough money" are actually good advice to not getting robbed. E.g. if carry around a golden Rolex and/or the newest iPhone you are much more likely to get robbed than if you have no watch and a $150 Android device in your hand. And most people don't carry around all their money for exactly the reason to not lose too much.
- haimez 10y agoExcept UNLIKE the Rolex analogy, the recommendation is not "do not carry your role" it is more akin too "do not own a Rolex". Or more directly, "avoid the problem by not having enough resources to own a Rolex".
- 23234242 10y agoTrue but now there's a separate danger with botnets. Now, instead of saying "don't own a Rolex" it's "don't own any silver, because that could be used to make a knife and steal someone else's Rolex." With botnets like Mirai, innocent networks need to protect themselves not to avoid getting attacked themselves but rather to ensure that they don't participate in an attack against someone else.
- TeMPOraL 10y agoI suppose anything more specific - both in case of DDoS and robbery prevention - would require a person/organization specific analysis that takes into account what you want to protect, what resources you have at your disposal and what threat model you operate under. I would love a link to some resources about how to do such analysis. Maybe someone here knows a good one?
- criddell 10y agoThis is offtopic, but did CMU ever face any consequences for their attack on Tor a year or two ago?
- tomschlick 10y agoWhy would they? From what I remember (helping to de-anonymize users) they didn't do anything illegal...
- criddell 10y agoUniversity studies often have to meet an ethical as well as legal standard.
- tomschlick 10y agoCould still be construed as ethical so long as they were focused on catching anonymized criminals (CP, scammers, etc). Of course that kind of research can lead to others using the same strategy to de-anonymize all TOR users.
- lossolo 10y agoAs someone that experienced DDoS which made whole leaseweb feel it (site i was operating was on servers in leaseweb), I can tell you one thing.. Unless you are ddosed by someone from their home connection or one server you need professional DDOS protection. No guide will help you here, you probably don't have the pipe big enough in case of UDP flood and don't have enough resources in case of sophisticated TCP attacks. If you only want to protect your website then go for cloudflare pro, it will be enough for 95% of ddosers. If cloudflare is not enough then you need thousands or ten of thousands of dollars to get protection.
- dx034 10y agoDo you know if anyone has ever been kicked from cloudflare pro because the attack was too large? I'd guess that they're one of the largest companies providing DDos defenses. I'd guess if they can't handle it there aren't many more that could. But don't know if that has ever happened.
- jester23947 10y agoSo how do you prevent volumetric attack?
- Kephael 10y agoYou must have excess bandwidth in order to absorb the flood or your upstream transit provider(s) need to filter the attack.
- based2 10y agohttps://tools.ietf.org/html/rfc2827 https://tools.ietf.org/html/rfc2827 http://www.bcp38.info/index.php/Main_Page http://www.bcp38.info/index.php/Main_Page
- cft 10y agoI was hoping that ipv6 would help with the attacks from non-spoofed IPs: each DDoS participating device would get a permanent sticky IP address, and there would be a global list of blacklisted IP addresses maintened by a neutral organization, such that these IPs would get null routed by transit carriers.
- jlgaddis 10y agoThe routing tables would fill up very, very quickly. Not to mention that IPv6 doesn't really help solve the "ISPs aren't dropping invalid packets as they are received" problem.
- velox_io 10y agoSo are there any ways to mitigate a DDoS attack, aside from throwing money at it by buying a large pipe? Null routing/ taking the site offline doesn't sound like a solution.
- WhiteHat1 10y agoGreat points. A few things: 1. Definitely need to educate oneself about DDoS. Incapsula's DDoS Knowledge Center is a great resource tool https://www.incapsula.com/ddos/ https://www.incapsula.com/ddos/ 2. Everyone - whether an individual blogger or a large enterprise - out to use a hybrid or cloud-based DDoS mitigation service like Imperva Incapsula. It's the only service with security first (other providers are CDNs and other add-ons with security as a second thought, but whomever you use, something is better than nothing). Note as well for small operations that Incapsula also has a free service (they don't always promote their free offering as well as others) https://www.incapsula.com/pricing-and-plans.html https://www.incapsula.com/pricing-and-plans.html Anyone who has any devices needs to protect themselves, just as we all have firewalls and antivirus, at the appropriate level.
- deleted 10y ago[deleted]
- assafridman 10y agoSpread over several servers in several continents , limit each server to serve its own region and use geo located dns if you dont want to waste money on the server, just use incapsula
- IHG 10y agoMake sure you understand your infrastructure and web deployment. Lock this down as tightly as possible. Use a 3rd part to protect your web infrastructure such as Incapula
- breaker9691 10y agothe best way to prevent the ddos attack is using money, there're nothing you can do more than money can.
- andhix 10y agoI have no idea, still learning about ddos attack and how to protect from it. Just call ddos expert, i thought.
- andhix 10y agoI have no idea, still learning about ddos attack and how to protect from it. Just call ddos expert, i thought.