Any self-respecting webmaster or site administrator should be familiar with the different security techniques to mitigate potential Distributed Denial of Service (DDoS) attacks a security threat that utilizes a network of compromised systems to flood a web server with traffic and deny access to legitimate users. With the high costs and opportunity losses associated with downtime, administrators need to step up and explore every option to protect the integrity of the website infrastructure.
Protecting against DDoS basically involves three methodologies, which range from free to costly, and which are applicable to web deployments of different sizes.
Mod_evasive: a DIY approach
The most basic line of defense against DDoS is the do-it-yourself approach, which involves an Apache web server module called mod_evasive. Formerly known as mod_dosevasive, the mod_evasive module is built into Apache and is designed to stop traffic-based attacks by setting thresholds and IP blacklisting. Mod_evasive monitors traffic using a dynamic hash table and denies access to IP addresses with suspicious activity.
Given that it is already included in Apache, its a popular choice for small web deployments that dont expect much traffic. However, it does require some tweaking and setting up, in order to be effective against basic attacks. Using mod_evasive requires you to modify your server configuration files, which means it can be a time-consuming activity for webmasters.
By default, the module blocks an IP for 10 seconds if it sends 2 or more page requests in a single second. You may adjust these limits as you see fit.
After blocking a potential attack, mod_evasive keeps syslog reports so you can monitor and tweak how it performs. You can also enable mod_evasive to send automated notifications thru email, so you are always updated.
This approach is quite rudimentary and limited, though. Such DIY solutions are deployed mostly as a reactive measure after a website suffers its first DDoS incident. Remember that attackers are usually one step ahead of you, however. Many will deploy their attacks through distributed infrastructure and harder-to-detect approaches, which can severely limit the effectiveness of mod_evasive.
Hardware Appliances
Web administrators who expect regular traffic surges and spikes can deploy onsite equipment to better mitigate the effects of an all-out DDoS attack. These devices have traffic-filtering and analytics capabilities and use several means of detecting and blocking malicious traffic.
The biggest limitation to hardware appliance, however, is cost. It is therefore not a viable option for businesses that prefer not to spend too much on capital and infrastructure expenditure. In addition, deploying hardware DDoS protection can be limited in terms of scalability, as it is still dependent on the networks uplink capacity.
In addition, each on-premise device can only protect the website infrastructure within its physical location. If you have a distributed infrastructure, you will need to deploy an appliance in all of these data centers. Also, hardware-based DDoS mitigation will usually require manual deployment, significantly lengthening the time it takes before you can successfully fight back against an attack.
In many cases, the use of on-premises appliances is done in combination with an off-premise or cloud-based solution to ensure better scalability and faster time-to-mitigation.
Cloud-Based DDoS Protection
This type of DDoS protection is usually offered as a managed service by either your internet service provider or a dedicated DDoS mitigation service. This includes both application-layer and network-layer protection, which provide additional protection options on top of a server-based and appliance-based approach.
In addition, cloud-based DDoS protection offers unlimited scalabilityyou can start small, although it will still protect your infrastructure even as the demand grows. Off-premise protection also has the advantage of faster time-to-mitigation, since it can be deployed either on-demand or as an always-on service.
Another advantage of cloud-based DDoS protection is the reduced capital and human resource expenditure. Being a managed service, you no longer need to invest in on-premise infrastructure or the staff to maintain and support it.
Conclusion
It is best to consider your needs and budget, especially if you are looking into invest in hardware-based DDoS mitigation. Remember that it is always better to prevent security breaches proactively than to deal with the damages later. In the event of a DDoS attack, it may already be too late, once your server infrastructure is no longer able to react due to the massive network traffic and requests it is handling. These safeguards may involve a bit of time, effort and money, but ensuring service uptime for your customers and users will be worth it.
