What is DDoS mitigation and how does it work?

This blog was written by a third party author.

Distributed denial of service (DDoS) attacks are a favorite method for attackers to disrupt or debilitate firewalls, online services, and websites by overwhelming systems with malicious traffic or transaction requests. DDoS attackers accomplish this by coordinating an army of compromised machines, or 'bots', into a network of devices they control from a remote location that focus a stream of activity toward a single target. These botnets may be used to perpetrate DDoS with a range of malicious techniques including:

• Saturating bandwidth with massive volumes of traffic,
• Filling up system resources with half-open connection requests
• Crashing web application servers with voluminous requests for random information    

What is DDoS mitigation?

DDoS mitigation is the practice of blocking and absorbing malicious spikes in network traffic and application usage caused by DDoS attacks, while allowing legitimate traffic to flow unimpeded.

DDoS mitigation strategies and technologies are meant to counteract the business risks posed by the full range of DDoS attack methods that may be employed against an organization. They are foremost designed to preserve the availability of resources that attackers seek to disrupt. But DDoS mitigation is also meant to expedite the amount of time it takes to respond to DDoS, which is frequently used by the bad guys as a diversionary tactic to carry out other kinds of attacks, such as exfiltration, elsewhere on the network.

Techniques and strategies for DDoS mitigation

There are several crucial strategies and techniques that typically contribute to DDoS mitigation's ability reduce the impact of these attacks.

The foundation of DDoS mitigation certainly rests in building up robust infrastructure. Keeping resilience and redundancy top-of-mind through the following are all crucial first steps for DDoS mitigation:

• Strengthening bandwidth capabilities
• Securely segmenting networks and data centers
• Establishing mirroring and failover  
• Configuring applications and protocols for resiliency
• Bolstering availability and performance through resources like content delivery networks (CDNs)

However, beefier architecture and CDN services alone are no match for modern DDoS attacks, which require more layers of protection for effective DDoS mitigation. Security researchers are increasingly running into massive DDoS attack volumes over 500 Gps and even over 1 TBps and intensely long attacks that can last over days and even weeks. What's more, attackers are increasing the cadence of attacks and the diversity of protocols and system types they target with their DDoS attempts.

Without some means of detecting and blocking malicious DDoS traffic, the most resilient system resources—even those backed by CDN services--can still easily be exhausted by modern DDoS techniques, leaving none left to fulfil legitimate connections and activity requests.

This is why effective DDoS mitigation requires some method for scrubbing out the bad traffic in as quickly as possible without impeding legitimate traffic, connection requests, or application transactions.

Additionally, most organizations bolster their DDoS mitigation strategies through effective incident response planning. This includes developing playbooks for numerous attack scenarios and regularly stress-testing capabilities to ensure that defenses can perform as expected.

What people or technologies are needed to respond to an attack?

Security teams running DDoS mitigation programs usually seek out technology or services that help them automatically determine the difference between legitimate traffic spikes and actual DDoS Attacks.

Traffic analysis

Most DDoS mitigation strategies lean on 24x7 traffic monitoring to keep an eye out for threats and spot the early signs of DDoS activity before it snowballs into unmanageable volumes or lingers on through low-and-slow DDoS techniques that may degrade performance without taking a system completely offline. Organizations that do not have the staff to provide around-the-cloud monitoring frequently turn to managed service providers to fill that role. Managed DDoS mitigation can make all the difference in minimizing the cost of downtime and productivity in the wake of an attack.

Anomaly detection

Monitoring capabilities are typically backstopped by anomaly detection technology that's tuned to network baselines and polices, as well as to threat intelligence sources that track the latest indicators of compromise (IOCs) associated with the most recent DDoS attack tactics. These detections then trigger reactive responses from DDoS mitigation experts and/or automated technology.

Rerouting and scrubbing

Many organizations utilize a combination of on-premises solutions such as DDoS mitigation appliances, firewalls, and unified threat management appliances to block DDoS activity as it is detected. However, this requires significant appliance tuning and the hardware limits how much traffic these devices can deflect or absorb.

As a result, many organizations are turning to cloud-based DDoS mitigation solutions or managed security solution providers. When the monitoring and anomaly detection senses malicious traffic or activity, DDoS mitigation infrastructure will then ideally reroute that traffic through cloud-based filtering system before crossing the network edge, leaving legitimate traffic to continue unabated through existing systems as usual. The scrubbing done by that external resource helps organizations better block and absorb high-volume DDoS activity, maintaining uptime even in the face of targeting by massive botnets.

While much of the initial attack response is automated through technology, effective DDoS mitigation also requires a well-trained team to  make changes on the fly when attack scenarios throw unusual volume, techniques, or extended attacks at the network. In addition to incident response capabilities, organizations may need to lean on security analysts to conduct post-mortem reviews that could help them adjust future DDoS mitigation planning or tuning of tools.