How to Prevent DDoS Attacks
Distributed denial-of-service (DDoS) attacks are malicious attempts that focus on interrupting normal traffic of a targeted server, network or service by overwhelming the target or its surrounding infrastructure with an overflow of Internet traffic. DDoS attacks employ multiple compromised computer systems as sources of attack traffic. Exploited machines can include computers and several other networked resources such as Internet of Things (IoT) devices. A DDoS attack can thus be compared to a traffic jam clogging up with a highway, preventing regular traffic from arriving at its chosen destination.
Let’s take a look at a 8 key ways to protect against DDoS attacks:
-
Let your architecture be as resilient as possible
To strengthen resources against a DDoS attack, it is essential that you make the architecture as resilient as possible. This concept of strengthening network architecture is a vital step not just in DDoS network defense, but also in guaranteeing business continuity and protection from various kinds of unforeseen situations. On the whole, priorities for architecture should be provider diversity, elimination of bottlenecks, and geographic diversity. While these are considered to be best practices for general business continuity and disaster recovery, they will indeed help in guaranteeing organizational resiliency in response to a DDoS attack. -
Create a DDoS action plan
Your business will have to start planning to defend from DDoS attacks, before you get hit by one such attack. Develop a system that can help you survive a DDoS attack, enabling you to mitigate the risk if one does take place. A DDoS action plan could deal with the use of automated reports in order to send an internal alert when your traffic goes far beyond normal levels. Documenting your IT infrastructure to develop a network topology diagram with an asset inventory is also important. -
Ensure you have additional bandwidth
Overprovisioning your bandwidth provides additional time to detect and deal with a DDoS attack. Furthermore, extra bandwidth allows your server to accommodate unanticipated spikes in traffic, cushioning you against a powerful attack. -
Improve the security of your IoT devices
DDoS attacks are increasing on a daily basis and hackers are now leveraging huge worldwide botnets composed of IoT devices. To reduce the attack power of DDoS attacks, businesses and consumers must enhance the security of their devices. One effective way to get this done is by updating from default factory-set passwords – easily guessed by hackers employing brute force methods. Always make sure to create strong passwords and change them on a regular basis. -
Use a Content Delivery Network (CDN)
Using a Content Delivery Network (CDN) is considered to be one of the best defenses against a DDoS attack. CDNs are responsible for identifying traffic launched as part of a DDoS attack and then diverting it to a third-party cloud infrastructure. -
Blacklist and Whitelist
Using blacklists and whitelists will help you to control who can access your APIs and network. However, you need to be careful as it is important not to automatically blacklist IP addresses that activate network alerts. To gauge whether it is malicious or real you will have to temporarily block traffic and analyze how it responds. Generally, legitimate users will try again after a few minutes while illegitimate traffic tends to switch IP addresses. -
Block spoofed IP addresses
Spoofing is considered to be an impersonation of a device, user, or client on the internet, frequently used during a cyberattack in order to disguise the source of an attacker’s traffic. During a DDoS attack, IP spoofing is employed to mask botnet device locations and stage what is called a reflected attack. A number of services are available to block spoofed IP addresses. The existing solutions need deep packet inspection (DPI), which examines packets instead of just sourcing IP addresses. However, DPI is resource intensive and expensive, so you will probably need to outsource this service to a third-party provider. -
Hardware upgrades
A lot of network hardware can mitigate specific types of DDoS attacks. For instance, a number of commercially available network firewalls and load balancers can actually protect a business against application-layer attacks and layer 4 attacks. Hardware upgrades are also effective in safeguarding against SYN flood attacks.
Get Comodo cWatch to Obtain Protection Against DDoS Attacks
Comodo has developed cWatch an all-in-one web security tool capable of preventing DDoS attacks. This web security tool has a Web Application Firewall (WAF) that can eliminate application vulnerabilities and protect web applications and websites against advanced attacks such as DDoS, SQL injection, and cross-site scripting.
The Comodo WAF offers the following features:
-
DDoS protection: Globally-distributed Anycast network enables effective distribution of traffic. It explicitly blocks all non HTTP/HTTPS-based traffic, with a current network capacity in excess of 1 TB/s. Each PoP comprises multiple 10G and 100G ports, designed to scale and absorb extremely large attacks.
-
Malicious bot and brute force prevention: This WAF blocks malicious bots and brute force attacks from websites. It also provides protection of account registration forms and login pages from different attack vectors including protection from application denial of service, web scraping, and reconnaissance attacks.
-
Zero day immediate response: Comodo WAF provides regular updates of virtual patches for all websites under management and instant response to apply a patch for the zero day attacks when they become known to the public.
-
Stop website attacks and hacks: Protects vulnerable websites by detecting and removing malicious requests and preventing hack attempts. This WAF also focuses on application targeting attacks, for example, Drupal, Joomla, WordPress and plugins etc.
Other security features offered by Comodo cWatch include:
-
Malware monitoring and remediation: Detects malware, provides the methods and tools to remove it, and prevents future malware attacks
-
Security Information and Event Management (SIEM): Advanced intelligence that can leverage existing events and data from 85M+ endpoints and 100M+ domains
-
Cyber Security Operations Center (CSOC): A team of always-on certified cybersecurity professionals providing round-the-clock surveillance and remediation services
-
PCI scanning: This scanning enables service providers and merchants to stay in compliance with the Payment Card Industry Data Security Standard (PCI DSS).
-
Secure Content Delivery Network (CDN): A global system of distributed servers to enhance the performance of web applications and websites
