Which Is A Method To Prevent Denial-of-service Attacks

MAY 2020

Sensation SERIES

ITSAP.eighty.100

Figure 1: Process

Threat actors carry out denial of service (DoS) attacks to disrupt the availability of an organisation'south services and data. If successful, a DoS attack prevents people from accessing online services (e.g. email, websites, online accounts), information, and other network resources. Threat actors comport out DoS attacks (and are sometimes hired to do so) for dissimilar reasons, such as attacking for fun or attempting to disrupt a competitor organization or some other country'southward democratic systems during elections. DoS attacks are also used by hacktivist groups to protest political or social bug.

DoS attacks can target specific infrastructure, network applications, and internal services. In a DoS attack, the threat actor floods the target (e.1000. a server hosting a website or an organization's network) with traffic. The target is so overloaded past this traffic and cannot reply to information technology or the arrangement crashes. When this occurs, a user may receive an error message when trying to access a website. Threat actors use different methods to carry out DoS attacks:

Flooding attacks: Flooding attacks are the most common attack method. The threat actor repeatedly sends requests to connect to the target server but does not consummate the connections. These incomplete connections occupy and consume all available server resources. As a result, the server cannot reply to legitimate traffic and connexion attempts.
Crash attacks: Crash attacks are less common. The threat actor exploits system vulnerabilities to crash a organization.

DISTRIBUTED DoS Assault

A distributed DoS (DDoS) assail has the same goal of disrupting and preventing access to services and information, but it looks a bit different. To carry out a DDoS, a threat actor uses multiple machines to attack one target. While a DDoS attack can exist a coordinated endeavor betwixt a group of threat actors, it can also exist carried out by ane person using a botnet.

A botnet is a grouping of hijacked Cyberspace-connected devices. To create a botnet, a threat actor takes advantage of security vulnerabilities or device weaknesses to control numerous devices. To foreclose systems and devices in your network from becoming function of a botnet, protect your devices past running updates and security patches.

Run into ITSAP.10.096 How Updates Secure Your Device, which is bachelor on the Cyber Centre website: cyber.gc.ca

IMPACTS OF A DoS ATTACK

DoS attacks are designed to exhaust your network's resources, such as its bandwidth, calculating power, memory, and storage.

In improver to losing access to services and resources, a threat actor may also apply a DoS set on to distract your organisation while other malicious activities are carried out, such as attempting to steal data.

Your organisation may also exist impacted in the post-obit means:

Costs associated with responding to a DoS assail
Lost or limited functionality of the affected service
Decreased productivity

Figure 1: Process

Your organization does not accept to be the target of a DoS set on to be impacted. If your service providers (e.g. Internet service provider, deject service provider) is attacked, your arrangement may experience loss of service.

Figure 1: Process

RECOGNIZING A DoS ATTACK

Look out for the post-obit signs that may betoken that you're the victim of a DoS assail:

Slow network performance, such as when opening files or accessing websites
Unavailable or inaccessible websites

These signs tin can resemble not-malicious performance and availability bug (due east.g. a surge of visitors to your website post-obit a press release). Over an extended period, your organization should establish a baseline of what is considered normal network activity. Yous tin can use this baseline to sympathize large increases or decreases in network activity and betoken whatsoever attempts to flood the network. To distinguish a possible DoS assault from non-malicious issues, your organization should continuously monitor and analyze traffic and logging information, which you can use to identify crashing and restarting services.

If you lot think a DoS set on is happening, contact your network administrator and your Internet service provider to confirm the crusade of the outage.

PREVENTING A DoS ATTACK

You tin can reduce the possibility and the impact of DoS attacks with the following actions:

Work with your deject and Internet service providers to implement service level agreements that include DoS defence provisions. Your service providers may employ multiple tools and techniques to assist your organization protect itself against DoS attacks.
Ensure your system administrators are familiar with DoS protection services. Familiarity with these services can help them effectively charge per unit limit or whitelist.
Monitor network and systems. Configure monitoring tools to warning you when in that location is an increase in traffic (outside of your baseline) or whatever suspicious traffic overloading a site.
Install and configure firewalls and intrusion prevention systems. You can use these tools to monitor traffic and block known-malicious and illegitimate traffic.
Update and patch operating systems and applications. Update and patch systems and applications, including your firewalls, to ensure that security problems are addressed and prevent threat actors from taking reward of vulnerabilities.
Use a website hosting service that emphasizes security. Earlier yous choose a service to host your website, verify that the vendor has security measures in place its customers.
Defend your network perimeter. To protect your network, utilise a layered approach to security past implementing multiple controls and techniques.
Program for an assault. Have a recovery plan that prioritizes systems and processes based on their tolerable downtime. You should also place points of contact and an incident response team.

If your organisation has been the victim of a DoS attack, keep in listen that it can happen again. Organizations are susceptible to multiple attacks. Threat actors can go along to exploit vulnerabilities and may continue to target your organization.

RESPONDING TO A DoS ATTACK

Below are examples of actions to take if your organisation is the victim of a DoS assail:

Identify. Flag any DoS indicators, such as poor network performance, and reference them against your normal traffic baseline. Contact your network ambassador and Internet access provider to confirm the cause of the outage or issue.
Contain. Identify your organization'southward network perimeter and any exposed assets. Use network security systems, such equally firewalls, or consider using DoS protection services that may exist available through your service provider. Contact your Internet or cloud service provider every bit soon equally possible.
Recover. Check for signs of other malicious activity that may have taken identify during the DoS attack. Re plant connections and communicate that services are dorsum online. Ensure you have a strategy to gradually reconnect customer sessions.
Review lessons learned . After you have recovered from the assail, review all the actions taken. Make improvements and document changes in your response plan.

If your organization is the victim of a DoS attack, notify the Canadian Centre for Cyber Security: contact@cyber.gc.ca