Playbook for a DDoS Attack

How to prepare for a DDoS attack

Imagine the day. It’s a Friday, you just got back from a long lunch, and are thinking ahead to your weekend. A meeting, a couple of last items to clear off your desk, and then you can head home for whatever, or whomever, awaits you.

Suddenly, you get a call. Your website is down, and systems are non-responsive. Phone lines are jamming up with angry customers. Senior management is banging down your door and wants to know what is happening and when you are going to fix it. Your team is in a panic. Someone tells you that it’s a DDoS attack.

What do you do?

This is the moment at which you realize something: Every emergency needs a plan, and DDoS attacks most definitely constitute an emergency.

Just like any kind of major emergency, managers must plan and prepare for a DDoS attack.

Below are some of the things you need to think about in order to prepare for a DDoS attack.

1. Situation awareness
   1. Understand the environment in which your business or organization operates. Potential threats from competitors, activists, or people who might have something against your org.
   2. Understand what device types and browsers normally access your public websites.
   3. Monitor social media.
2. Know thy network, and protect it
   1. Have a detailed depiction of your network topology. An essential for team co-ordination.
   2. Have baseline measurements of all network activity as it relates to your public access points. Examples are graphing and threshold alerts for bits per second and packets per second on major ingress and egress links in your network.
   3. Deploy technology at the edge of your network to defend as best as possible. Understand that they will have very finite capabilities and specific applications, but can be of use in thwarting a small attack or identifying a ramping attack.
   4. Design a secure remote access configuration, preferably out of band, to allow for remote management of your systems while they are under attack.
   5. Identify all critical services (eg. DNS, Web, DB’s) running in your network and define monitoring indices to assess health in real time.
3. Create a strong DDoS response team
   1. Designate a strong team leader.
   2. Create a standard operating procedure for a DDoS attack that includes:
      1. Who should be notified and when (emergency contact info for your ISP, your own senior management, customer service and PR managers)
      2. iWhat info needs to be collected and when, and where is it logged.
      3. iWhat action needs to be taken to protect infrastructure or service.
      4. What is the escalation path for critical decisions.
4. Communicate the DDoS plan. It’s not enough to have created a DDoS plan, but you need to share it and staff needs to know exactly when to initiate a DDoS response. It is part of orientation for new staff, you have hard copies at stations, and it is in your wiki or online shared resources. Run drills periodically, including contacting your ISP.
5. Be vigilant.
   1. Keep your documentation up to date
   2. Monitor DDoS industry changes, and ensure your technology is on top of the latest threats.
   3. Test your DDoS defense strategy and team.
6. Partner with an industry specialist in case the attack is beyond you or your ISP’s capabilities to handle. There are companies whose sole expertise is preparing for and defending against large scale and very sophisticated DDoS attacks, like DOSarrest. Make sure they complement your existing operations. For example, DOSarrest monitors the performance of your site once every minute, and our team will contact your company designate as soon as they see an issue arise, lowering your TCO. Furthermore, DOSarrest will run a website performance test, and if desired a vulnerability assessment, to ensure your systems are hardened as much as possible, all for free. Don’t hesitate to contact us to discuss these features further.

Whatever your situation, do not delay putting a DDoS response plan in place. It could save your business.

Jag Bains,

CTO, DOSarrest Internet Security