On August 28, 2018, The Bank of Spain reported that they were the victim of a Deliberate Denial of Service, or DDoS, attack at the hands of political hacktivist group Anonymous Catalonia. Reportedly, no data was breached and all financial services were still available. But, their website was brought down.
So what exactly is a DDoS attack, and how does it work? A DDoS attack is when websites or servers are overloaded by a constant barrage of computers or users. This unwanted traffic is often more than a site can handle. The site is then overwhelmed by the amount of data being processed. The impact from this attack would likely reach farther than the site and its owner, but also the website’s ISP or cloud hosting partner. These attacks are often perpetrated by a single user commanding a botnet, or a network of machines infected by a malware. This allows a single user to send nuisance traffic at the rate of 300+ gigabits per second, depending on the size of the botnet. The IP address that falls victim to such an attack will likely be brought down until the DDoS attack is ceased, bringing online services to a grating halt. According to Verising/Merril Research, attacks like these account for 1/3 of all downtime incidents worldwide.
What’s truly terrifying about DDoS attacks is the potential IoT devices give bad actors. Don Shin, A10 Network’s Senior Product Marketing Manager, has this to say “It used to be that in order to be able to create a high volume attack you had to go and create your own botnet. However, right now there’s so little effort needed to accumulate an IoT botnet that we’re seeing these underground DDoS-for-hire services coming down into the $15 per week range.” According to Gartner, there will be around 25 billion IoT devices in service by 2021. Unless IoT security improves, DDoS threat actors will have an open buffet of devices to enslave into their botnets.
Defending against a DDoS attack doesn’t have to be tricky. There are appliance-based solutions offered by companies like Cisco and Radware. There are also cloud-based solutions from businesses like Sucuri and Akamai. These solutions offer state of the art protection from DDoS attacks that can withstand the majority of attacks. Managed Services providers, like CHR, can even help architect a network with DDoS protections built in.
