If my website is targeted for a DDoS attack after I have been paid for completing the website, and I get an angry phone call from the client regarding outage of service, what do I do?

It hasn't actually happened yet, but the idea haunts me.

closed as unclear what you're asking by D.W., M'vy, RoraΖ, Xander, Steve DL May 20 '15 at 14:55

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • I hope my edit didn't totally squash your intent. – schroeder May 19 '15 at 23:32
  • It seems fine. Thanks. Although I felt the original gave more context. – Dmitry May 19 '15 at 23:33
  • 1
    What kind of website? A static one or did you build a web application? – spickermann May 20 '15 at 5:13
  • 1
    It depends. What type of DDoS? Is it targeting server resources such as connection limits? Network resources en route to your app? Are specific resources within your app being targeted? The point I'm trying to make is there are different layers at which a DDoS operates. – user2320464 May 20 '15 at 6:17
  • 1
    Make the client aware of the difference between development and operations, and make sure your contract/agreement doesn't include anything on operations. – Qwerky May 20 '15 at 9:57
up vote 43 down vote accepted

The following is all hypothetical:

First off you should NEVER sign a SLA in this case, or guarantee any uptime whatsoever. (you are delivering a website, not the service to host that)

Secondly, a hosting company should be used who can defend against a DoS attack in some way. (be aware of SLA's and their limitations)

You need to think of yourself in the same way a plumber does. The plumber is not responsible for your water service, just for leaks and work on the pipes. A DDoS would be like an over pressure on the water lines (like a 1000 times more than they are designed for) and the fact that the pipes break then is not the plumber's fault but the water company's. All the plumber can do is fix it after the water has been turned off.

  • I think that's exactly what I wanted to know. Thanks! – Dmitry May 20 '15 at 0:02
  • 1
    I can think of mistakes that a developer could do that would actually allow DoS attack to be be more likely to be successful. I your plumber analogy: Using pipes that not strong enough for expected peaks in pressure. If a developer does such a mistake I think he is responsible. – spickermann May 20 '15 at 5:20
  • 3
    This is 100% accurate (I +1'd it), but I'll add here that it won't stop an angry and clueless customer from trying to blame you anyway, especially if you helped them provision hosting and deploy the site. – Joel Coehoorn May 20 '15 at 5:23
  • 2
    @spickermann Don't confuse DDoS and DoS. If a bug in the software causes downtime, it's the developper's responsability to plug the hole. If the issue is that the software (and the systems it runs on) is being flooded with valid input, then it has nothing to do with the software. The exception is if the requirement specifically requested protection against some form of DDoS (in which case the shouldn't have been accepted without VERY serious considerations). – Stephane May 20 '15 at 8:28
  • @Stephane if a bug in the software makes possible a DDoS attack that would otherwise has been impossible, and if it can be demonstrated that the developer did not take measures to make the risk of the DDoS happen ALARP, there are cases where the developer can be legally liable (depending on context, contract, legal environment and stuff we infosec experts have no clue about). Lawri's answer brushes off OP's responsibilities as non-existent, and I'm afraid I disagree. – Steve DL May 20 '15 at 15:10

As Lawri points out, for the most part the site being DDoSed is not your problem. It's up to the hosting provider to take the steps necessary to mitigate (not stop; there aren't really any ways to completely stop one) a DDoS attack.

Note the qualifier: "for the most part".

There is one responsibility you do have, at last as a professional designer, and that is to make as certain as possible that, should your site fail under a DDoS attack, it fails safe -- IE, suffers no data loss or corruption because of the flood of connections.

This is mostly an informal checklist to confirm your code is clean -- IE, database writes use transactions and are atomic, all input is properly validated before any of it is stored, database connections are properly closed on script termination, and so on; basically, once the flood waters recede the site should be back up and running without requiring any manual intervention.

  • 1
    Could you please provide authoritative evidence why OP would have more of a legal liability to make sure the site fails "safely" than s/he has to make sure the site fails reasonably rarely? – Steve DL May 20 '15 at 15:11
  • Not a legal liability per se, more a professional obligation. Like I said, most of those were basically sound programming practice... although legally someone might decide to argye it's due diligence. IANAL though so don't take this as read. – Shadur May 20 '15 at 15:34
  • My point was that a lawyer is precisely what OP needs :-) We should only be giving advice if we're confident that we're giving correct one, and when law is involved and we don't even know the operating domain or country of OP, it's impossible to have such guarantees ;-) – Steve DL May 20 '15 at 15:43
  • @SteveDL The question has the confines of a Client calling you on the phone. not a law suit. (originally even a student was part of the context). Why add the legal dimention to the awnsers if the OP did not add one? – LvB May 20 '15 at 17:33
  • Because the relationship between OP and his/her client is bound by law, and because it is courts that will force OP to hold up to his/her responsibilities. – Steve DL May 20 '15 at 17:43

Not the answer you're looking for? Browse other questions tagged or ask your own question.