What is a DDoS Attack?
The basic volumetric denial of service (DoS) attack often involves blasting an IP address with a lot of traffic. If the IP address points to a Web server, official traffic will not communicate with it, and the website will not be available. Another type of DoS attack is flooding, in which a group of servers is flooded with applications that need to be processed by the victims’ equipment. This is often produced in large quantities by text that works on compromised botnet components and has led to the termination of victim server resources such as CPU or memory.
DDoS attacks apply to the same principles, except that malicious traffic is generated from multiple sources, albeit from one central location. The fact that traffic sources are still distributed – often globally – makes blocking DDoS even more difficult than preventing DoS attacks from a single IP address.
Six steps to prevent DDoS attacks
1. Increase bandwidth
One of the basic steps you can take to protect yourself from DDoS attacks is to make your hosting infrastructure “DDoS resistant.” This means that you are setting up enough bandwidth to handle traffic spikes that cyber attacks could cause.
Please note that purchasing large bandwidth is not enough as it is a complete solution to reduce DDoS attacks. Increasing the bandwidth raises the bar that attackers must overcome before launching a successful DDoS attack. Still, it would help if you combined this with other mitigation strategies to completely protect your website.
2. Build Redundancy Into Your Infrastructure
To make it as difficult as possible for an attacker to successfully launch DDoS attacks on your servers, make sure you distribute them across multiple data centers with a sound load balancing system to distribute traffic between them. Where possible, these data centers should be located in different countries or other regions of the same country.
This strategy must work to ensure that the data centers are connected to different networks. There are no obvious network barriers or single points of failure in these networks.
Distributing your servers and geographically will make it harder for an attacker to successfully attack more than half of your servers, leaving other servers unaffected and able to take at least some of the extra traffic that the affected servers would normally handle.
3. Configure Your Network Hardware Against DDoS Attacks
There are a few hardware fixes you can take to help prevent DDoS attacks.
For example, setting up your firewall or router to dispose of incoming ICMP packets or blocking DNS responses from outside your network (by blocking the UDP port 53) may help prevent specific DNS-based volumetric attacks.
4. Deploy Anti-DDoS Hardware And Software Modules
Your servers should be protected by network firefighters and special web application firefighters, and you should also use loading balancers. Many hardware vendors now incorporate software protection against DDoS protocol attacks such as SYN flood attacks, for example, by monitoring how many incomplete links are present and rubbing them when the number reaches a manageable limit.
5. Deploy A DDoS Protection Appliance
Many security vendors, including NetScout Arbor, Fortinet, Check Point, Cisco, and Radware, offer devices that stay in front of network firewalls and are designed to prevent DDoS attacks before they start operating.
They do this using several strategies, including conducting traffic jams and blocking unusual traffic and blocking traffic based on known attack signatures.
The biggest weakness of this type of DDoS attack prevention method is that the operating systems are limited to the traffic flow they can handle. While high-tech devices may be able to monitor incoming traffic at speeds of up to 80 Gbps anyway, today’s DDoS attacks could be an order of magnitude larger than this.
6. Protect Your DNS Servers
Don’t forget that an evil character can bring your web servers offline via DDoSing your DNS servers. For that reason, your DNS servers must have a shortage, and installing them in various data centers behind load balancers is also a good idea. A better solution would be to move to a cloud-based DNS provider that can provide higher bandwidth and more points-to-presence data centers worldwide. These services are designed explicitly for DDoS thinking. For more information, see How to Prevent DNS Attacks.
