# What Is a DDoS Attack? DDoS Protection, Mitigation and Network Resilience **URL:** https://securesys.com.tr/en/learning/network-security/ddos-attacks-protection-and-mitigation ![What Is a DDoS Attack? DDoS Protection, Mitigation and Network Resilience](/images/bilgi-merkezi/covers/cover-network-10.webp) If an organization's internet line has a capacity of 1 Gbps and the attacker sends 20 Gbps of traffic to that line an important fact emerges: **Even if the firewall blocks this traffic the internet line may already be full.** For this reason DDoS security is not merely defining a few rules on the firewall. Real DDoS protection; the internet service provider, the upstream network, the scrubbing center, the CDN, Anycast, the WAF, rate limiting, BGP, network capacity and incident response requires many layers such as these to be evaluated together. The expansion of DDoS is: #### Distributed Denial of Service that is: #### Distributed Service Denial Attack as it is expressed. The fundamental aim of DDoS attacks is most often not to take over a system; **it is to make it unreachable.** The target; a website, an API, a VPN gateway, a DNS service, an e-commerce platform, the internet line, a firewall, a load balancer or another internet-facing service can be any of these. Modern DDoS attacks do not consist only of high bandwidth attacks. The attacker: the network capacity, the protocol state tables, the firewall session capacity, the web application resources, the backend database or the application thread pools may try to consume these. For this reason the modern DDoS protection approach: **Detect → Absorb → Filter → Mitigate → Recover** must be built on this chain. ### What Is DDoS? DDoS: #### Distributed Denial of Service is the attack aimed at disrupting the availability of a service by sending intense traffic or requests to a target system or network from a large number of different sources. ### What Is DoS? DoS: #### Denial of Service is the attack aimed at creating a service interruption from a single or limited source. ### What Is the Difference Between DoS and DDoS? DoS: Single Source DDoS: Distributed Sources they can be carried out through these. ### Why Is Distributed Important? Thousands of different source IPs can take part in the attack. This situation makes source-based blocking difficult. ### What Is the Fundamental Target of DDoS? Availability. That is: **To make the service unusable.** ### What Does DDoS Target Within the CIA Triad? CIA: Confidentiality Integrity Availability DDoS in particular: #### Availability has an effect on this. ### Which Systems Can DDoS Target? Web Server DNS Server VPN Gateway Firewall API Gateway Load Balancer ### Can the Internet Line Be a DDoS Target? Yes. In fact it is one of the most critical targets. ### What Is the DDoS Attack Surface? They are the parts of the services and infrastructure reachable from the internet that can be targeted in terms of DDoS. ### What Are the Types of DDoS Attack? They can generally be evaluated in three categories: Volumetric Attacks Protocol Attacks Application Layer Attacks ### What Is Volumetric DDoS? It is the attack that aims to consume the bandwidth capacity of the target network. ### What Is the Fundamental Aim of a Volumetric Attack? It is to saturate the internet link. ### What Is Bandwidth Saturation? It is the network line being filled with more traffic than it can carry. ### An Example Internet Link: 1 Gbps Attack: 15 Gbps In this case even if the firewall drops the attack traffic: **the 1 Gbps internet link is already full.** ### Why Is This Critical? Because the mitigation must be performed before it reaches the target network. ### What Is Upstream Mitigation? It is the attack traffic being filtered at the internet service provider or cloud infrastructure level before it reaches the corporate network. ### What Is a UDP Flood? It is bandwidth or processing capacity being consumed by sending a large number of UDP packets. ### Is UDP a Connectionless Protocol? Yes. For this reason it can be used to produce high-volume traffic. ### What Is an ICMP Flood? It is the attack aimed at consuming the capacity of the target or the network by sending a large number of ICMP packets. ### What Is a Ping Flood? It is the flood attack carried out using ICMP Echo Request traffic. ### What Is Protocol-Based DDoS? It is the attack that targets the state and processing mechanisms of network or transport protocols. ### What Is a SYN Flood? It is the type of DDoS that targets the TCP connection establishment mechanism. ### What Is the TCP Three-Way Handshake? A TCP connection: SYN ↓ SYN-ACK ↓ ACK is established in this way. ### How Does a SYN Flood Create an Effect? A large number of SYN requests are sent. The server or firewall: half-open connection may be forced to hold this state. ### What Is a Half-Open Connection? It is a connection whose TCP handshake has not been completed. ### What Is SYN Table Exhaustion? It is the connection table capacity being consumed because of the SYN states. ### What Is a SYN Cookie? It is one of the protection mechanisms aimed at reducing the effect of a SYN Flood. ### Can a Stateful Firewall Be Affected by DDoS? Yes. ### What Is a State Table? It is the table in which the firewall holds the active connection information. ### What Is State Table Exhaustion? It is the firewall session capacity being consumed with a large number of connections. ### What Is a Concurrent Session? It is the number of network connections open at the same time. ### What Is New Sessions Per Second? It is the number of new sessions that can be created in one second. ### Why Is the Firewall Important in DDoS Capacity? Even if the firewall looks sufficient in terms of bandwidth it can struggle because of the session rate. ### Is Datasheet Throughput Enough on Its Own? No. Among the values that must be looked at are: Firewall Throughput IPS Throughput Concurrent Sessions New Sessions/Second these. ### What Is Application Layer DDoS? It is the attack aimed at consuming server resources with Layer 7 application requests. ### What Is Layer 7? It is the Application Layer in the OSI model. ### What Is an HTTP Flood? It is the application being consumed by sending a large number of HTTP requests. ### What Is an HTTPS Flood? It is the Layer 7 DDoS attack carried out over encrypted HTTP requests. ### Why Can an HTTPS Flood Be More Difficult? TLS processing can consume additional CPU. ### What Is a GET Flood? It is a large number of HTTP GET requests being sent. ### What Is a POST Flood? It is the application being targeted with POST requests that require processing. ### Why Is Layer 7 DDoS Dangerous? The attack traffic can resemble legitimate user traffic. ### What Is Application Resource Exhaustion? It is the consumption of resources such as CPU, memory, worker threads or the database connection pool. ### Can There Be Database DDoS? Indirectly, yes. Expensive application requests can consume the backend database. ### What Is an Expensive Query? It is a database query that requires high CPU, memory or I/O. ### What Is API DDoS? It is API endpoints being targeted with a large number of requests. ### Can an Authentication Endpoint Be a DDoS Target? Yes. Login, password reset or MFA endpoints can be high-processing-cost. ### What Is a Botnet? It is the network consisting of a large number of compromised devices controlled by the attacker. ### What Is a Bot? It is the compromised device inside the botnet that receives attacker commands. ### What Is an IoT Botnet? It is devices such as IP cameras, routers or IoT devices being turned into a botnet. ### Why Are IoT Devices Used for a Botnet? A weak password, outdated firmware, internet exposure they can be compromised for reasons such as these. ### What Is a Reflection Attack? It is the attacker using third-party servers to produce attack traffic. ### What Is an Amplification Attack? It is the attack volume being increased by making a small request produce a larger response. ### Are Reflection and Amplification the Same Thing? They are different concepts but in most DDoS attacks they can be used together. ### What Is a Spoofed Source IP? It is the packet source IP information being changed to a fake one. ### Why Is IP Spoofing Used in a Reflection Attack? The response can be directed to the target victim IP. ### What Is DNS Amplification? It is the type of DDoS attack in which DNS servers are abused for amplification/reflection. ### Why Can a DNS Response Create Amplification? A response larger than the request can be produced. ### What Is an Open Resolver? It is a DNS resolver to which anyone from the internet can send a recursive DNS query. ### Is an Open Resolver Risky? Yes. It can be abused for the purpose of DDoS amplification. ### What Is NTP Amplification? It is the NTP service being abused in a reflection/amplification attack. ### What Is Memcached Amplification? It is the attack class based on incorrectly configured internet-facing Memcached services being abused for amplification. ### What Is CLDAP Amplification? It is Connectionless LDAP services being able to be abused for the purpose of a reflection/amplification attack. ### What Is SSDP Amplification? It is UPnP/SSDP services being abused for the purpose of amplification. ### What Is BCP 38? It is the network filtering best practice approach aimed at reducing IP source spoofing. ### What Is Ingress Filtering? It is the filtering aimed at validating the source information of packets entering the network. ### What Is Egress Filtering? It is the traffic leaving the network being limited according to policy. ### What Is DDoS Protection? DDoS attacks: to detect, to filter, to absorb and to provide the continuity of the service it is the body of controls used for these. ### What Is DDoS Mitigation? It is the effect of DDoS traffic being reduced by separating it from legitimate traffic. ### What Is the Difference Between DDoS Protection and Mitigation? Protection expresses the broader security architecture. Mitigation is the traffic cleaning process applied during the attack. ### What Is DDoS Detection? It is the identification of attack behaviour within the traffic pattern. ### What Can DDoS Detection Use? Bandwidth Packet Rate Connection Rate Request Rate Baseline ### Why Is a Traffic Baseline Important for DDoS? If the normal traffic is known an unusual spike is noticed more quickly. ### What Is a Dynamic Threshold? It is the alarm threshold that can change according to the normal traffic behaviour. ### What Is a Static Threshold? It is a fixed traffic limit determined in advance. ### Is a Static Threshold Enough? Not always. Business traffic can change over time. ### What Is a Traffic Spike? It is a rapid traffic increase taking place in a short time. ### Is a Traffic Spike Always DDoS? No. It can be a legitimate event such as a marketing campaign or a flash sale. ### What Is a Flash Crowd? It is real users showing intense access to a service at the same time. ### How Are a Flash Crowd and DDoS Distinguished? Source behaviour, request pattern, user behaviour, session characteristics must be analyzed. ### What Is Rate Limiting? It is the limiting of the number of requests or connections accepted in a certain time interval. ### Does a Rate Limit Provide DDoS Protection? It helps in some attack types. However, it is not sufficient on its own for a volumetric attack. ### What Is a Connection Rate Limit? It is the limiting of the new connection rate for a source or system. ### What Is a Request Rate Limit? It is the limiting of the number of application requests within a certain time interval. ### What Is a Per-IP Rate Limit? It is a separate request limit being applied for each source IP. ### Is a Per-IP Rate Limit Enough in a Distributed Attack? Not always. Thousands of different IPs can be used. ### What Is Behavioral Rate Limiting? It is dynamic rate control being applied according to request behaviour and context. ### What Is Adaptive Rate Limiting? It is the limits being changed dynamically according to the traffic and risk level. ### What Is a Scrubbing Center? It is the high-capacity network infrastructure in which DDoS traffic is cleaned and the legitimate traffic is delivered to the target. ### What Is Traffic Scrubbing? It is the separation of attack traffic from legitimate traffic. ### How Does a Scrubbing Center Work? Attack traffic: Internet ↓ Scrubbing Infrastructure ↓ Malicious Traffic Removed ↓ Clean Traffic ↓ Customer Network ### What Is On-Demand Scrubbing? It is the traffic being directed to the scrubbing center when a DDoS attack is detected. ### What Is Always-On DDoS Protection? It is the model in which the traffic continuously passes through the mitigation infrastructure. ### What Is the Advantage of Always-On? During the attack a route change is not waited for. ### What Is the Advantage of On-Demand? In normal times the traffic path can be more direct. ### What Is DDoS Diversion? It is the process of the traffic being directed to the mitigation provider. ### Is BGP Used in DDoS Mitigation? Yes. It can be used for traffic route changes. ### What Is BGP? BGP: #### Border Gateway Protocol is one of the fundamental protocols of internet routing. ### What Is BGP Diversion? It is the traffic route being changed so that it passes through the scrubbing center. ### What Is a GRE Tunnel? It is one of the tunnel mechanisms that can be used to deliver the clean traffic back to the customer network after scrubbing. ### What Is BGP Flowspec? It is the technology that provides traffic filtering policy distribution over BGP. ### Is BGP Flowspec Used in DDoS? Yes. It can be used to filter certain attack traffic patterns at the upstream level. ### What Is RTBH? RTBH: #### Remotely Triggered Black Hole is the approach of a certain destination or traffic being blackholed at the upstream level. ### What Is Blackhole Routing? It is certain traffic being dropped intentionally. ### Does Blackhole Stop DDoS? The attack traffic does not reach the target. However, the legitimate traffic can be dropped too. ### When Is Blackhole Routing Used? It can be evaluated as a last-resort containment mechanism. ### What Is a Sinkhole? It is suspicious traffic being directed to a controlled destination for analysis or containment. ### What Is Anycast? It is the same IP address being advertised from more than one geographic location. ### How Does Anycast Help DDoS Protection? The attack traffic can be distributed to different PoPs. ### What Is a PoP? PoP: #### Point of Presence is the network provider's access point in different geographic locations. ### Does Anycast Eliminate Attack Traffic? No. However, it can distribute the traffic and increase the absorption capacity. ### What Is a CDN? CDN: #### Content Delivery Network is the system that delivers content to users over distributed edge infrastructure. ### Does a CDN Provide DDoS Protection? Particularly for web traffic it can provide a serious advantage. ### Can a CDN Hide the Origin Server? If it is configured correctly the origin exposure can be reduced. ### What Is the Origin Server? It is the real backend server of the application. ### What Is an Origin IP Leak? It is the real server IP behind the CDN being exposed. ### Why Is an Origin IP Leak Risky? The attacker can bypass the CDN and send the attack directly to the origin. ### How Should the Origin Firewall Be Configured? If possible it must accept access only over the CDN/provider IP ranges. ### Does a WAF Provide DDoS Protection? It can help in Layer 7 attacks. ### What Is a WAF? WAF: #### Web Application Firewall is the security control that analyzes HTTP/HTTPS application traffic. ### Can a WAF Stop Volumetric DDoS? If internet link saturation is occurring, not on its own. ### What Does a WAF Provide in Layer 7 DDoS? Request filtering, bot management, rate limiting it can provide controls such as these. ### What Is Bot Management? It is the detection and control of automated client behaviour. ### What Is a Good Bot? It is a legitimate automated service such as a search engine crawler. ### What Is a Bad Bot? It is a bot used for scraping, a credential attack or DDoS. ### Is CAPTCHA DDoS Protection? It can help in some application-level automated attacks. However, on its own it is not DDoS protection. ### What Is a JavaScript Challenge? It is the challenge mechanism aimed at verifying the browser capability of the client. ### What Is a Proof-of-Work Challenge? It is the challenge model that asks the client to perform a certain computational work. ### What Is Challenge-Based Mitigation? It is the use of a challenge to separate legitimate client traffic from bot traffic. ### Does a Load Balancer Provide DDoS Protection? It can distribute the traffic but it has capacity limits. ### What Is Load Balancing? It is the traffic being distributed to more than one backend system. ### What Is Horizontal Scaling? It is more server instances being added. ### Does Auto Scaling Provide Protection Against DDoS? It can increase availability. However, it can create a cost amplification risk. ### What Is Economic Denial of Sustainability? It is the risk of cloud resources scaling because of the attack and creating a high cost. ### What Is Cloud DDoS Protection? It is the cloud provider providing DDoS detection and mitigation over distributed infrastructure. ### Why Is Cloud-Based DDoS Mitigation Strong? It can have a very high network capacity. ### What Is an On-Premise DDoS Appliance? It is the device that provides DDoS detection and filtering inside the organization. ### Can an On-Premise DDoS Appliance Stop a Volumetric Attack on Its Own? If it cannot reach the traffic before internet link saturation, no. ### What Does an On-Prem DDoS Appliance Do? It can provide local protection in protocol and lower-volume attacks. It can also trigger upstream mitigation. ### What Is Hybrid DDoS Protection? It is the use of on-prem detection together with cloud/upstream mitigation. ### How Does a Hybrid DDoS Architecture Work? Local Detection ↓ Attack Confirmed ↓ Cloud Scrubbing Trigger ↓ Traffic Diversion ↓ Clean Traffic Return ### What Is ISP DDoS Protection? It is attack traffic being filtered at the Internet Service Provider level. ### What Is an Upstream Provider? It is the upper network provider from which the organization receives internet connectivity. ### Should the DDoS Procedure With the ISP Be Determined in Advance? Yes. ### Is Calling the ISP by Telephone at the Moment of the Attack Enough? It can create a delay. Having an agreed process in advance is stronger. ### What Is a DDoS Runbook? It is the procedure in which the operational steps to be applied during an attack are defined. ### What Is a DDoS Playbook? It is the response plan that contains the detection, escalation and mitigation steps for a particular DDoS scenario. ### How Should DDoS Incident Response Be? Detect ↓ Validate ↓ Classify ↓ Mitigate ↓ Monitor ↓ Recover ↓ Review ### What Is DDoS Classification? The attack: Volumetric Protocol Application it is the determination of which of these it is. ### What Is an Attack Vector? It is the method used in the attack. ### What Is Multi-Vector DDoS? It is more than one attack vector being used at the same time. ### An Example Multi-Vector Attack UDP Flood SYN Flood HTTP Flood ### Why Is Multi-Vector DDoS Difficult? The network and application layers can be affected at the same time. ### What Is DDoS Telemetry? They are the network and application metrics used for attack detection. ### Which DDoS Metrics Should Be Monitored? Bits Per Second Packets Per Second Connections Per Second Requests Per Second ### What Is BPS? Bits Per Second. It is the measure of bandwidth volume. ### What Is PPS? Packets Per Second. It is the measure of packet rate. ### What Is CPS? Connections Per Second. It is the connection creation rate. ### What Is RPS? Requests Per Second. It is the application request rate. ### Why Is Looking Only at Gbps Not Enough? A low bandwidth but high PPS attack can consume the network device CPU. ### What Is Small Packet DDoS? It is the packet-processing capacity being consumed with a large number of small packets. ### Why Is Packets Per Second Important for the Firewall? Every packet consumes processing resources. ### What Is a DDoS Baseline? It is the normal network and application traffic profile. ### What Should a Normal Traffic Baseline Contain? BPS PPS CPS RPS Protocol Distribution ### What Is a Time-of-Day Baseline? It is the traffic pattern being evaluated according to the hours of the day. ### How Should the DDoS Detection Threshold Be Determined? According to the historical baseline and the business peaks. ### What Is DDoS Alerting? It is an automatic alarm being produced when attack indicators are seen. ### Should a DDoS Alert Go to the SIEM? Yes. ### What Are the DDoS SOC Use Cases? Traffic Spike SYN Flood UDP Flood HTTP Flood DNS Amplification ### Does the SOC Mitigate DDoS on Its Own? No. It must work together with the network, ISP and application teams. ### Should the NOC and the SOC Work Together in DDoS? Definitely. ### What Is the NOC? Network Operations Center. It is the operations team focused on network availability and performance. ### Why Is DDoS a SOC + NOC Event? It is both a security attack and an availability incident. ### What Is a DDoS Escalation Matrix? It is the plan that shows which team will come into play according to the attack severity. ### How Is DDoS Severity Determined? Traffic Volume Service Impact Attack Vector Duration ### What Is a DDoS SLA? It is the service level agreement that defines the detection and response obligations of the mitigation service provider. ### What Is Time to Detect? It is the time between the start of the attack and the detection. ### What Is Time to Mitigate? It is the time that passes from the detection of the attack to effective mitigation. ### What Is TTM? In the DDoS context: #### Time to Mitigate it can be used as this. ### What Should Be Looked At When Choosing a DDoS Protection Provider? Network Capacity Global PoP Attack Detection Mitigation SLA Layer 7 Capability ### What Is Scrubbing Capacity? It is the total attack traffic capacity the provider can clean. ### Why Is the Network Capacity of the DDoS Provider Important? If the attack exceeds the provider capacity the mitigation can fail. ### A Comparison of Always-On and On-Demand | Feature | Always-On | On-Demand | | --- | --- | --- | | Detection/Mitigation | Continuous | During the attack | | Route Change | Generally not needed | May be needed | | Latency | Can have a continuous effect | Normally can be lower | | Response Speed | Very fast | Depends on the diversion time | ### Is DDoS the Same Thing as High Availability? No. ### What Is High Availability? It is another node continuing the service when a system failure occurs. ### Is HA Useful Against DDoS? Partly. However, if all the nodes are receiving the same attack traffic it is not enough. ### What Is an Active-Active Architecture? It is more than one system processing traffic at the same time. ### What Is Geographic Redundancy? It is the service being run in different geographic locations. ### Does a Multi-Region Architecture Help Against DDoS? Yes. It can increase resilience. ### What Is Network Resilience? It is the network service's ability to continue working in the event of an attack, failure or disruption. ### Are Resilience and Security the Same? No. Security tries to prevent the attack. Resilience aims to continue the service despite the attack. ### What Does DDoS Resilience Contain? Redundancy Capacity Failover Diversification Mitigation ### What Is Dual ISP? It is the organization using two separate internet providers. ### Does Dual ISP Solve DDoS? Not on its own. Both lines can be attack targets. ### What Is Multi-Homing? It is the network being connected to more than one upstream provider. ### What Is BGP Multi-Homing? It is internet connectivity being provided with BGP over more than one ISP. ### Does Multi-Homing Provide Resilience? Yes. However, DDoS mitigation must be planned separately. ### What Is DNS Resilience? It is the DNS service working with a distributed and redundant architecture. ### Can Authoritative DNS Be a DDoS Target? Yes. ### If DNS Goes Down Does the Website Work? New users may not be able to perform domain resolution. ### Why Is Anycast DNS Used? In order to direct DNS traffic to distributed nodes. ### What Is Secondary DNS? It is the redundant DNS infrastructure additional to the primary authoritative DNS. ### Can Multi-Provider DNS Be Used? Yes. It can be evaluated for critical services. ### What Is Origin Resilience? It is the backend application infrastructure being designed to be resistant to failure and attack. ### What Is CDN + Multi-Origin? It is more than one origin infrastructure being used behind the CDN. ### What Is a Health Check? It is the automatic check of whether the backend service is working. ### What Is Failover? It is passing to the backup service when the primary service is not working. ### Should Auto Scaling Be Used During a DDoS Attack? In a controlled way. ### What Is a Cost Guardrail? It is the financial/technical limit that prevents unlimited cost occurring because of cloud auto scaling. ### Does Application Caching Help Against DDoS? Yes. It can reduce the backend processing requirement. ### What Is Cache Hit Ratio? It shows how much of the requests are answered through the cache. ### Should Static Content Be Moved to the CDN? If possible, yes. It reduces the origin load. ### Should an API Rate Limit Be Used? Yes. Particularly on public APIs. ### Should There Be a Separate Limit for the Authentication API? On a risk basis, yes. ### What Is an Expensive Endpoint? It is the endpoint that consumes high backend resources on every request. ### What Is an Application DDoS Assessment? It is the analysis of which endpoints can create resource exhaustion. ### What Is DDoS Attack Simulation? It is the evaluation of DDoS readiness in an authorized controlled environment. ### Can a DDoS Test Be Performed in Production? It must be planned very carefully. There is a service impact risk. ### What Is a DDoS Readiness Assessment? It is the evaluation of the organization's detection, mitigation and resilience capacity in the face of an attack. ### What Does a DDoS Readiness Assessment Examine? Internet Architecture ISP Capacity Firewall Capacity DDoS Service Runbook ### What Is a DDoS Tabletop Exercise? It is the attack scenario being applied with the teams around a table without producing real traffic. ### Why Is a Tabletop Exercise Valuable? Role and escalation gaps are seen. ### What Is a DDoS War Room? It is the incident coordination structure managed together by the network, security and business teams during a large attack. ### Why Is a Communication Plan Important? During a service outage customer and management communication is needed. ### What Is a Status Page? It is the independent platform on which users are informed about service availability. ### Should the Status Page Be on the Same Infrastructure? If possible it must work independently of the main service. ### What Is DDoS Forensics? It is the analysis of the attack through the traffic and logs after the attack. ### Which Data Does DDoS Forensics Use? NetFlow Firewall Logs WAF Logs CDN Logs ### How Valuable Is the Attack Source IP List? Because of the botnet it can change rapidly. On its own it is not enough. ### Why Can the Attack Pattern Be More Valuable? Even if the source changes the traffic behaviour can continue. ### What Is DDoS Threat Intelligence? It is the use of threat information about active botnets, attack infrastructure and new vectors. ### What Is a DDoS IOC? It is the technical indicator that shows the attack source or infrastructure. ### What Is DDoS TTP? They are the tactics and techniques the attacker uses to carry out DDoS. ### Why Is DDoS Attack Trend Monitoring Important? The protection policy can be updated. ### What Are the Firewall DDoS Protection Features? SYN Protection Connection Limit Rate Limit DoS Policy features such as these can be present. ### What Is the DoS Policy on the Firewall? It is the policy that provides protection when certain traffic thresholds are exceeded. ### Is the Firewall DoS Policy Enough? No. Particularly against upstream bandwidth saturation. ### Are DDoS Protection and IPS the Same? No. IPS performs exploit detection. DDoS protection focuses on availability attacks. ### Are DDoS Protection and a WAF the Same? No. A WAF provides application-layer web security. ### Are DDoS Protection and a CDN the Same? No. A CDN provides traffic distribution and caching. However, it can contain DDoS mitigation capability. ### How Is DDoS Protection Defense in Depth Established? Upstream Provider ↓ Cloud DDoS Mitigation ↓ CDN / Anycast ↓ WAF ↓ Firewall ↓ Application Rate Limit ↓ Backend Resilience ### Why Is Layered DDoS Protection Necessary? Different attack vectors target different layers. ### What Is Layer 3/4 Protection? It is the mitigation aimed at network and transport layer attacks. ### What Is Layer 7 Protection? It is the mitigation aimed at application-level request attacks. ### An Example of a DDoS Security Architecture Internet ↓ Global Anycast ↓ DDoS Scrubbing ↓ CDN ↓ WAF ↓ Load Balancer ↓ Application Cluster ### Should Origin Direct Access Be Closed? If possible, yes. ### Is a Network ACL Used in DDoS? It can be used to limit certain attack patterns. ### Does Geo Blocking Stop DDoS? Not on its own. ### When Can Geo Blocking Help? In reducing the traffic coming from regions in which the business does not provide service. ### Is IP Reputation Used in DDoS? Yes. However, a botnet can use compromised legitimate IPs. ### What Is ASN Blocking? It is the blocking of the traffic coming from a particular Autonomous System. ### What Is an ASN? ASN: #### Autonomous System Number is the internet routing domain identity. ### Is ASN Blocking Risky? Legitimate users can be affected too. ### Is Country Blocking Risky? Yes. A false positive can create a business impact. ### What Is a DDoS Emergency Policy? It is the stricter traffic policy brought into play temporarily during an attack. ### Should the Emergency Policy Be Active in Normal Times? It is not always necessary. ### What Is Crisis Mode? It is a more restrictive policy being applied for service survival during an attack. ### What Is Graceful Degradation? It is the service continuing to work with limited functions instead of shutting down completely. ### How Is Graceful Degradation Used During DDoS? Non-critical features can be disabled. ### Can a Static Maintenance Page Be Used? Yes. It can reduce the complex backend load. ### What Is Read-Only Mode? It is the application working in a limited mode by reducing critical write operations. ### The Relationship Between Business Continuity and DDoS DDoS is not only a cybersecurity incident. It is a business continuity problem. ### What Is a BCP? Business Continuity Plan. ### Does DR Solve DDoS? Not always. If the new site has the same internet exposure the attack can continue. ### What Is the Difference Between Disaster Recovery and DDoS Resilience? DR focuses on recovery after an infrastructure failure. DDoS resilience focuses on service continuity during an active attack. ### Is RTO Important for DDoS? Yes. A service restoration target must be determined. ### Is RPO Important for DDoS? If data loss is being experienced it can be relevant. However, the main problem of DDoS is availability. ### DDoS KPIs For example: Time to Detect Time to Mitigate Service Availability Attack Volume ### DDoS KRIs No Upstream Protection Single ISP Exposed Origin IP Unprotected DNS ### What Should a DDoS Dashboard Show? Current Traffic Attack Vector Dropped Traffic Legitimate Traffic ### What Is Peak Attack Bandwidth? It is the maximum traffic volume seen during the attack. ### What Is Peak PPS? It is the maximum number of packets seen per second during the attack. ### What Is Peak RPS? It is the maximum number of requests coming to the application per second. ### What Is DDoS Capacity Planning? It is the sizing of the infrastructure taking normal and attack traffic into account. ### Is Capacity Planning Only for the Firewall? No. ISP Router Firewall Load Balancer Application they must be thought of together. ### What Is a Bottleneck? It is the weakest point that limits the total capacity of the system. ### How Is the Bottleneck Found in a DDoS Architecture? An end-to-end capacity analysis must be performed. ### An Example ISP: 10 Gbps Firewall: 20 Gbps Load Balancer: 5 Gbps Here the bottleneck: the Load Balancer may be this. ### The Most Frequently Made Mistakes in DDoS Protection The mistakes frequently seen in organizations: - Thinking that there is DDoS protection if there is a firewall - Not taking the internet link capacity into account - Not using upstream mitigation - Not creating a runbook with the DDoS provider - Leaving the origin IP exposed - Not planning DNS resilience - Monitoring only the bandwidth metric - Not monitoring the PPS and CPS values - Not taking Layer 7 DDoS into account - Not using a WAF and rate limiting - Not creating a baseline - Not testing the BGP diversion procedure - Never testing the scrubbing service - Using a single ISP - Not performing a DDoS tabletop exercise - Not including the business continuity process ### DDoS Protection Checklist - Is the internet bandwidth capacity known? - Is the peak normal traffic known? - Are BPS/PPS/CPS/RPS being monitored? - Has a DDoS baseline been created? - Is there an ISP DDoS service? - Is upstream mitigation available? - Is a scrubbing center being used? - Is the Always-On/On-Demand model defined? - Is the BGP diversion procedure ready? - Is a CDN being used? - Is the origin IP protected? - Is the WAF active? - Is there API rate limiting? - Is SYN flood protection active? - Is DNS redundant? - Is there secondary DNS? - Has multi-ISP been evaluated? - Do the DDoS alerts go to the SIEM? - Is SOC/NOC escalation defined? - Has the DDoS runbook been tested? ### DDoS Maturity Model #### Level 1 - Firewall Protection Basic DoS policy and rate limits are used. #### Level 2 - DDoS Visibility BPS, PPS, CPS and the traffic baseline are monitored. #### Level 3 - Upstream Mitigation An ISP or cloud scrubbing service is used. #### Level 4 - Multi-Layer DDoS Protection A DDoS provider, CDN, WAF, rate limiting and a resilient architecture are used together. #### Level 5 - Adaptive DDoS Resilience Real-time telemetry, automated mitigation, a multi-region architecture and tested incident response are applied together. ### Frequently Asked Questions #### What is DDoS? DDoS is the Distributed Denial of Service attack that aims to disrupt the availability of a service by sending intense traffic or requests from a large number of sources. #### What is the difference between DoS and DDoS? DoS is generally carried out from a single source, while DDoS is carried out from a large number of distributed sources. #### What is volumetric DDoS? It is the high-volume attack that aims to consume the internet bandwidth capacity of the target. #### What is a SYN Flood? It is the protocol-level DoS/DDoS attack aimed at consuming the TCP connection state mechanism. #### What is a UDP Flood? It is the attack that aims to consume bandwidth or system resources using intense UDP traffic. #### What is Application Layer DDoS? It is the Layer 7 attack that aims to consume application resources with HTTP, HTTPS or API requests. #### Is DDoS blocked with a firewall? Some low-volume or protocol attacks can be limited by the firewall. However, if the attack exceeds the internet link capacity upstream DDoS mitigation is needed. #### What is a Scrubbing Center? It is the high-capacity mitigation infrastructure that filters DDoS attack traffic and delivers the clean traffic to the corporate network. #### How is Anycast used in DDoS protection? By advertising the same service IP from more than one location it helps the attack traffic to be distributed to a distributed infrastructure. #### Does a CDN block DDoS? Particularly in web-based attacks it can provide important protection thanks to traffic distribution and edge capacity but on its own it does not stop all DDoS attacks. #### Does a WAF provide DDoS protection? In Layer 7 HTTP/HTTPS DDoS attacks it can help with rate limiting, bot detection and request filtering. #### What is DDoS mitigation? It is the attack traffic being separated from legitimate traffic and filtered and the service impact being reduced. #### Is BGP used for DDoS mitigation? Yes. It can be used in directing the traffic to the scrubbing infrastructure during an attack. #### What is blackhole routing? It is the traffic to a certain destination being dropped completely. Because it can also make the service unreachable it is generally a last-resort containment method. #### What is the most important control for DDoS Protection? There is no single control. Upstream protection, capacity, CDN/WAF, rate limiting, telemetry and tested incident response must be used together. ### Conclusion: DDoS Protection Starts Not at the Firewall but in the Architecture One of the most widespread wrong ideas about DDoS is this: **"Our firewall is strong, it will block DDoS."** The firewall is an important security control. However, the fundamental mathematics of a DDoS attack is different. If your internet line is: 1 Gbps and the attack is: 20 Gbps then the firewall: dropping 20 Gbps of traffic is not sufficient in terms of service availability. Because before the attack traffic reaches the firewall: **it has already filled the 1 Gbps internet line.** For this reason one of the most critical principles of DDoS protection: #### Mitigate Before the Bottleneck it should be this. The attack traffic must be cleaned as far as possible before it reaches the corporate network. For this reason a strong architecture: #### Internet ↓ #### Upstream DDoS Protection ↓ #### Scrubbing / Anycast ↓ #### CDN ↓ #### WAF ↓ #### Firewall ↓ #### Application can be layered in this way. However, DDoS defense is not only traffic filtering. Real network resilience; capacity, redundancy, monitoring, incident response and business continuity requires these. Because the aim is not only to block the attacker traffic. The real aim: **is to ensure that the critical service continues to work while the attack continues.** For this reason the DDoS approach must answer these four questions: #### How quickly can we see the attack? #### Where can we filter it? #### How much attack traffic can we absorb? #### Can we continue our service while the attack continues? The fundamental equation of modern DDoS defense: **Visibility + Capacity + Upstream Mitigation + Application Protection + Resilience** is in this form. And the most critical principle is this: **Think about the capacity of your internet line before the capacity of your firewall.** Because for a volumetric attack that has reached the network the mitigation may have started far too late.