Like spam emails and pop-up ads, distributed denial of service (DDoS) attacks have been around since the arrival of the internet. Unlike those annoyances, however, DDoS attacks can be a genuine threat to your business – and they’ve been on something of a tear lately.
DDoS attacks, in fact, have been growing exponentially – both in rate and in size. In the first quarter of 2024, for example, HTTP DDoS attacks went up by 93 percent YoY, while the average attack size increased by more than 200 percent. And this escalation has only continued since then.
It seems, unfortunately, that we’re living in a golden age of DDoS. And while some companies and industries are more susceptible than others, odds are almost every business is going to fall victim to an attack at some point.
That’s why now is the time to talk with your managed services provider about how to mitigate the risk of a DDoS attack. These questions are a good place to start. The first three cover the business side: your risk, how you stay online and what you should pay. The last four cover the technical details that separate one mitigation service from another.
Business Questions to Ask About Your DDoS Risk
1. Is DDoS a threat to our business readiness?
Unfortunately, that’s kind of the point of DDoS: DDoS attacks take your business offline. That’s why this is a great time to be proactive.
To review, the goal of a DDoS attack is to overwhelm server resources with huge numbers of requests to force an interruption of work. The result? Downtime.
No company wants its services to be down for any length of time. But not every DDoS attack hits the same. So start by assessing the threat landscape to your business, taking into account these key questions:
- Are we more susceptible to a DDoS attack than other businesses? (Hint: if you’re in an industry like financial services or academia, the answer is probably yes.)
- Is the downtime from an attack more likely to be a minor disruption for customers or a major outage that costs us far more in lost business? The average DDoS attack cost nearly half a million dollars in 2023. What would that mean to your balance sheet?
- In addition to any opportunity cost losses from that downtime, how much will it cost to recover from the attack itself? What about the cost of rebuilding trust with affected customers?
- How big is our risk for a DDoS attack that goes beyond mere disruption and veers into the more malicious territory of ransomware?
The answers will vary for different companies. But given the explosion in DDoS activity over the past several years – and the significant revenue at stake – it’s a good idea to have this conversation now (so you don’t have to panic later).
2. If we can’t stop DDoS attacks, how do we stay online?
The good news about DDoS attacks is that while you can’t prevent them, you can mitigate the risks.
And the good news is that advances in technology have increased the number of options for companies looking to protect themselves from DDoS attacks. For instance, instead of relying on old-fashioned protections like firewalls and router ACLs, many managed service providers (including Summit) now offer more modern options like scrubbing services.
A scrubbing service is essentially a filter. When a massive amount of traffic is detected, an alert is triggered to reroute that surge to a scrubber. The scrubber analyzes this load, removes the junk traffic meant to overwhelm the system, and sends the clean traffic back to the business. Or it may shut down the one IP address among many that’s absorbing all of the suspicious traffic.
In either of these scenarios, service may be degraded for a short period, but there’s no costly long-term outage. And that’s the goal of scrubbing – not to be perfect, but to keep things up and running instead of getting shut down completely.
Of course, threat actors have been keeping up with technology as well. Which means they’ve been able to launch more complex attacks – and stay several steps ahead of the protections meant to thwart them. That’s why the more pertinent question here for your managed services provider – how can you help protect us? – is one that needs to be revisited often.
3. Are we overpaying for DDoS protection (especially if it doesn’t always keep us online)?
If you’re satisfied with the protection options your managed services provider offers, this is the next question to ask (if you’re not, it may be time to look elsewhere). The discussion surrounding question 1 should help guide your answer here.
DDoS protection isn’t free, so you want to be sure you’re paying for a level of protection that makes the most sense given your risk exposure.
For example, if you’re a higher-profile business – say a bigger company or one in a more vulnerable industry – you may want to splurge for the highest level of protection available, regardless of the cost. After all, if you’ve determined that persistent DDoS attacks are probable, and that those attacks could result in significant losses, the cost of ever-present protection is likely worth the investment.
On the other hand, if you’re a smaller company that doesn’t expect frequent attacks, you might decide you’re fine with a lower, less expensive level of protection.
In either case, you’ll likely be choosing between two kinds of scrubbing models:
- An on-demand model, where you hold a sum of money in a DDoS reserve fund. If an attack happens, you can call your service provider for on-demand DDoS scrubbing and write them a check.
- A service model, where you pay for a DDoS scrubbing service that is set up and ready to go at all times. The provider monitors traffic and triggers action when necessary. One advantage of this model is the opportunity to basically dry run the scrubbing to give the system an idea of your company’s traffic patterns. This way, when an actual attack unfolds, everyone has a better idea of what that looks like.
The model you choose also affects how fast mitigation starts. Always-on protection sits in line with your network and is already scanning for attacks. On-demand scrubbing has to reroute your traffic first, through BGP route diversion or DNS redirection, before it can clean it.
| Mitigation type | What causes the delay | Known attack | Unknown attack |
|---|---|---|---|
| In-line (always on) | Fingerprinting and addressing the attack | Under 5 seconds | Under 30 seconds |
| On-demand (off-network scrubbing) | Rerouting traffic, sending it to and from the scrubbing center, and any queue when it arrives | 15–90 minutes | 15–90 minutes |
The key to determining what level of protection makes sense goes back to doing a risk and budgetary assessment. If being down for 20 minutes is going to mean $100,000 in lost revenue, the cost of a dedicated scrubbing service that is online and ready to go at any time is probably money well spent.
Technical Questions to Ask Before You Choose a Provider
Once you know your risk and budget, these questions help you compare what different providers actually deliver.
4. Do regulations in our industry require a DDoS mitigation strategy?
Some industries already have formal requirements. Financial institutions, for example, are expected to address DDoS risk under the FFIEC IT Examination Handbook’s business continuity guidance. Even if your industry has no rule today, requirements tend to arrive eventually, and compliance work is slow and technically dense. It pays to understand what’s coming and confirm your provider can document its controls.
5. Is the support team onsite and available around the clock?
This should have a simple answer. When an attack hits, having network engineering and security staff already on hand can mean the difference between a small hiccup for your users and a full outage. Ask who responds, how fast, and whether they’re the same people who run the network.
6. Do you protect against Layer 7 (application) attacks?
You need this. A growing share of attacks target the application layer, and they’re designed to look like legitimate traffic, often after network-layer (Layer 3 and 4) attacks fail. Even simple ones can overload CPUs and databases, like hammering a login page with random credentials or firing off repeated random searches on a dynamic site. Ask whether Layer 7 protection is included or sold separately.
7. How do you mitigate SSL/TLS-based attacks?
Not every organization needs this. But if your business relies on encrypted traffic and transactions, find out whether and how your provider handles attacks hidden inside it. Look for in-line decryption and re-encryption that keeps data on your network with your security policies intact. If decryption happens on the provider’s network instead, make sure that process meets your security and service-level requirements.
These seven are a starting point, not a complete checklist. Use them to open the conversation, then dig into the details that matter most for your business.
Don’t Go Dark. Avoid the Costs of Downtime with DDoS Protection
DDoS attacks aren’t going away. If anything, they’re becoming more frequent and potentially more damaging. That’s why you need to understand what your threat level is and what steps you can take to protect yourself.
We understand the DDoS risk landscape. Get in touch to learn how we can help. Or see how Summit DDoS Mitigation answers these seven questions.