NMCI 0 Best Practices for Internal DDoS Attacks

Best Practices for Internal DDoS Attacks

2013

Best Practices for DDoS Attack 1

What is a DDoS?
A Distributed Denial of Service, DDoS, is an attack which is implemented to take down a server and make it unavailable to legitimate users. This attack can be very costly as it suspends services and causes a break in connection to the internet. The reason this attack is called ‘Distributed’ is because there is a large number of computers that are used to overwhelm the web servers. These computers are called bots or slaves. They are controlled by one computer, which is called the master or handler. The master sends a command to the bots to that will cause an attack. In this case, the master sent a command to flood the web server with fake traffic, which will cause the server to become unreachable. Most of the time, the attack comes from an external source. The attack on the university’s web server originated within the schools network. There was a password sniffer used to capture an Administrator password. The password allowed the attacker to have elevated privileges. This allowed for the bots to be controlled and the attacker to do whatever he or she wanted to do. In this case, the attacker chose to bring down the registration system.

Best Practices to Practices to Prevent Internal DDoS
There are several measures that can be taken to prevent DDoS. This Guide will focus on steps to prevent these attacks from originating internally. Actively monitor the network Be familiar with the inbound traffic profile. Be able to differentiate between the normal pattern of traffic and suspicious traffic.

Best Practices for DDoS Attack 2

-

DDoS attacks are not slow and subtle. They will appear aggressive and sharp when viewed on the network.

Designate Network Security Team This structure should consist of Administrators of all security devices, which is lead be a Security Manager. All team members should be educated on the network’s security policies in-place, including the network infrastructure and implementation practices. Develop a Incident response team tailored to dealing with DDoS.

Security Policy and Procedure Development There should be a security policy in-place which consists of a ‘User Policy’, where the levels of privileges are defined. Educate all network users. A user agreement should be created. This agreement will educate the user on their access privileges and responsibilities related to network security. An administrator agreement should also be established. This agreement may highlight specific policies regarding privileges and password. Network Security Standard of Procedures should be created and made available to all users with a need to know. User Authentication Method Incorporate a multi-factor authentication method. This method can consist of a something the user knows, something the user has and something the user is.

Best Practices for DDoS Attack 3

-

The multi-factor will make it extremely difficult for a DDoS to happen because of all the layers of authentication.

-

Encrypt all passwords to prevent the use of password sniffers.

Have a Disaster Recovery Plan This plan should be created and reviewed annually by the Network Security Team. Make the plan available on-demand to all team members. All staff should have be well educated on the plan and their individual role. Incorporate a response and a restoration plan for the incident. A review session after every incident is important to establish lessons learned. Scheduled drills for the plan should be in-place to monitor the effectiveness.

Internally protecting the network against DDoS attacks a can be down is many different ways. Developing the most cost effective and manageable way for University is very important. This guide only highlights five best practices to prevent internal DDoS, as it occurred on the University’s network; however, there are several more possible measures that could be considered. The University is encourage to take an in-depth look at the security posture and invest wisely on the best protection methods.