2020 has been a golden year for cybercriminals due to COVID-19. With major events like federal elections and a global pandemic causing chaos in the world, cybercriminals utilized every opportunity to wreak havoc. According to the Cisco Annual Internet Report (2018 “2023) White Paper, Compounding the problem, the nature of the threats is becoming more diverse. The list includes Distributed Denial-of-Service (DDoS), ransomware, Advanced Persistent Threats (APTs), viruses, worms, malware, spyware, botnets, spam, spoofing, phishing, hacktivism, and potential state-sanctioned cyberwarfare. Globally, there was a 776% growth in attacks between 100 Gbps and 400 Gbps Y/Y from 2018 to 2019, and the total number of DDoS attacks will double from 7.9 million in 2018 to 15.4 million by 2023.
As reported by Cisco, the Distributed Denial of Service (DDoS) attacks have indeed continued rising in 2020, causing disruption of services provided by digital platforms in 2020. Whether it is a startup, a small business, or a large conglomerate, cybercriminals use DDoS attacks to disrupt, halt, or even stop the services provided by an organization. Sometimes, DDoS attacks are used by cybercriminals to distract the cybersecurity teams for masking and completing other attacks, say data theft, network infiltration, or ransomware.
In 2020, though ransomware attacks played a prominent role in cyberattacks, DDoS attacks remain a serious threat as well. According to Netscout 1H 2020 Threat Report, Attackers targeted COVID-era lifelines such as e-commerce, healthcare, and educational services with short, complex, high-throughput attacks designed to quickly overwhelm and takedown targeted entities. The first half of 2020 witnessed a radical change in DDoS attack methodology to shorter, faster, harder-hitting complex multi-vector attacks that we expect to continue.
Netscout reported that 4.83 million DDoS attacks were noticed in the first half of 2020, a 15% increase than the same period in 2019. And though the average duration of attacks was dropped by 51% if compared to 2019, attacks in the first half of 2020 had intended to hit and impact targets before getting detected and blocked.
Cyberattacks ” like any task ” are carried out for making profits. And attackers target businesses more than individuals for the same reason. Any organization ” big or small ” proves as a more lucrative target than an individual. Businesses provide services, which if disrupted or stopped, frustrate their users, which may damage the reputation of the organization and/or incur losses. For example, if Amazon.com is unreachable to users, it will potentially lose millions in revenue every minute. Or if Twitter is unreachable to users, they will get frustrated and may stop using it.
Moreover, DDoS attacks are also used to mask other attacks, say data theft, which is one of the most lucrative tasks for cybercriminals. After all, businesses host a variety of sensitive data including but not limited to their customers’ data, financial data, intellectual property, and market research data. If cybercriminals can get their hands on this data and/or encrypt or lock it using ransomware, they may sell or ask for ransom for this data. It has happened in the past, and any business can be the next target if it is not very well secured.
For instance, Amazon Web Services (AWS) ” the cloud computing giant arm of Amazon ” was hit by a humongous DDoS attack in February 2020. The attack was maxed out at 2.3 terabytes per second (Tbps), making it the second-worst disclosed DDoS attack in history. It targeted an unknown customer using Connectionless Lightweight Directory Access Protocol (CLDAP) Reflection. Due to the customer using a vulnerable third-party software for CLDAP, attackers were able to multiply their attack by at least 56-70 times.
Fortunately, this organization was saved, thanks to a DDoS protection service, which proves the importance of installing security controls and having DDoS protection service with a high Tbps bandwidth.
It raises the question: how to protect against DDoS attacks? A business must focus on making its infrastructure as resilient as possible. That means it must improve its network architecture to add redundancy and improve resiliency. It should consider installing data centers across geographic locations or providers, multiple access paths for the incoming traffic, and redundant infrastructure. That is, there must be two or more sets of servers, routers, data centers, etc.
If the business cannot work on such measures, it is suggested to migrate to the cloud, which provides better resiliency and security than on-premises data centers and/or servers. For example, Amazon Web Services (AWS) Cloud offers high availability, redundancy, and resiliency that help to prevent bottlenecks due to single point infrastructure, which eventually helps prevent DDoS attacks. Moreover, next-generation firewalls, load balancers, and multiple internet connections must be installed to avoid any disruption due to DDoS attacks.
However, this is not enough ” especially for preventing modern-day attacks that use very sophisticated threat vectors. That is why, cybersecurity companies develop and offer DDoS protection services, which assist in detecting and preventing DDoS attacks. Also, it helps save extra charges ” if using a cloud infrastructure ” incurring due to extra spikes in traffic due to DDoS attacks.
