We have subscribed to an upstream ISP's protection service to protect against DDoS. I am thinking of developing a incident procedure in case my ISP's DDoS mitigation fails (highly unlikely right?).

What contingency plans should I have?

  1. Blacklisting IP addresses or ranges at my firewalls
  2. Patch my systems with latest updates
  3. What else?
  • Speed dial customer support and yell at them. I suspect there's little more that you can do if a reliable service has already failed. – Neil Smithline Nov 21 '15 at 5:32
  • That would not really solve the problem at hand, if it really happens. Whether the possibility of happening is remote or not, I would still need this plan, if I am not wrong. – Pang Ser Lark Nov 21 '15 at 6:44
  • 1
    I agree. That doesn't mean it's not the best that you can do. Sometimes the bad guys win. If they overpower or outsmart an Akamai or something, then they win. Worry about problems you can solve. – Neil Smithline Nov 21 '15 at 6:46
  • If the device is connected with a cable, disable the ethernet adapter. If you're connected wireless disable the wireless adapter. Also Neil Smithline's comment is a slightly fun thing to do when you just wait for it to stop, as is google chrome's dinosaur connection problem game. – x13 Nov 21 '15 at 22:29

Like Neil Smithline already said: if the attackers can outsmart a usually reliable DOS protection then there is nothing much you can do to protect yourself. That means that you should not focus on fighting or blocking the attack itself (leave that to the experts), but on reducing the impact of the attack. This might include:

  • Reduce your attack surface by making only services public that need to be publicly available. That is don't expose your database if it is only needed as a backend for some web services.
  • Have sites all over the world or have the ability to easily setup an alternative site (somewhere in the cloud) so that at least part of the sites still work even if the others are attacked. Using DNS you then can make sure that mainly the good sites are accessed by the customers.
  • Make sure that attacks on public sites don't affect internal sites, i.e. it would be bad if you hosted some internal application on affected public systems and could not proceed with your internal business if public sites are attacked.

These are just some general concepts. Of course details depend on the kind of DOS attacks (bandwidth, application level DOS, flood of spam mail affecting specific recipients....), how critical all of this is for your business, which services are exposed to the public at all etc.

Patch my systems with latest updates

This will not specifically help against DOS, but of course you should keep your systems always current.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.