DDoS Protection

Distributed Denial of Service (DDoS) is a type of digital or cyber attack in which a group of compromised computers or servers are used to flood a target system with traffic. These compromised computers or servers are called a “botnet” and can be located anywhere, making such attacks very hard to block. As such, these attacks are often referred to as “distributed”. If the attack is successful, the target system can become overwhelmed, and therefore unresponsive to users.

There are several steps involved in a DDoS attack:

Infection: The first step in DDoS attacks occurs when the attacker identifies and infects vulnerable systems such as computers and servers with malware. Once infected, these systems are known as “zombies” or “bots”. However, the DDoS attack doesn’t begin at the moment of infection. Instead, compromised systems remain dormant initially.

Command and control: These “zombies” or “bots” can be controlled from a remote location. It is from this location where the attacker can issue commands to the network of “bots” and “zombies”.

Attack: DDoS attacks have the greatest effect when all “bots” or “zombies” flood the target system with traffic at the same time. In the “attack” phase, the attacker instructs all compromised systems to send traffic to the target system.

Denial of Service: The target becomes overwhelmed with traffic, which can cause legitimate requests to be dropped. The target becomes slow or, in a worst case scenario, entirely unresponsive.

Hardening systems and networks against DDoS attacks requires several different approaches designed to reduce overall vulnerability and increase resilience. Here are some of the key measures Storm employs to keep you safe:

24/7/365 Monitoring: The entire Storm infrastructure is carefully monitored 24/7/365 by our data centre partners and our internal security specialists to ensure early detection and mitigation of DDoS attacks.

System and network hardening: All Storm hardware is secured from the ground up, then regularly patched and maintained throughout the entire lifecycle. We only use cutting-edge servers and networking equipment which are regularly audited to ensure maximum security and performance.

Data centre protection: All Storm’s UK servers are hosted in Tier 4 ISO 9001, 14001 and 27001 audited and certified data centres which are Public Sector Network(PSN) and N3 compliant. Storm’s extensive DDoS mitigation infrastructure is complemented by our data centre partners’ own proprietary security measures, ensuring multi-layer DDoS protection for optimal continuity.

Anti-DDoS architecture: Storm employs extensive state-of-the-art anti-DDoS architecture throughout our network to ensure that your sites and servers remain protected 24/7. Some of these include:

• Load balancers – Designed to distribute network traffic across multiple servers. This ensures that no single point on a network becomes overwhelmed.
• Proxies and firewalls – Proxies and firewalls are employed to make infrastructure harder to detect, filter out and block unwanted traffic, assume load-balancing tasks, and cache static content (among other things) – all of which can further protect against DDoS attacks.
• Redundancy and Failovers: Storm employs redundant infrastructure to eliminate single points of failure. This means that, if one server or node is attacked or down for any reason, there are others to take its place to ensure uninterrupted continuity.

Anti-DDoS tools: In addition to ant-DDoS architecture, Storm also employs various tools to detect and protect against system exploits. These include intrusion detection and prevention systems, web application firewalls (WAFs), and DDoS scrubbing technologies.

There are three main types of DDoS attacks employed by attackers. These include:

Volume-based Attacks: The premise behind a volume-based DDoS attack is to flood a target network with so much traffic that legitimate traffic can’t access resources and services. Types of volume-based DDoS attacks include UDP floods (ports on the target host are flooded with data packets containing the UDP protocol), DNS amplification (redirecting high amounts of DNS requests to the target), and ICMP floods (a target’s network bandwidth is overloaded with ICMP traffic).

Protocol Attacks: With a protocol attack an attacker targets part of the network infrastructure by exploiting protocol weaknesses. Examples include Ping of Death (an attacker freezes or crashes a target with oversized data packets), SYN flood (a target system is brought down with a high volume of incomplete TCP handshakes), and Smurf DDoS (uses malware to create an infinite loop of data packets), among others. The intensity of these attacks is typically measured in packets per second (Pps).

Application Layer Attacks: These attacks target a specific application with traffic that seems legitimate. The purpose is to exhaust a server’s resources by overwhelming the server with requests or exploiting weaknesses in the application. Examples include HTTP floods, Slowloris attacks, and DNS query floods. These attacks are measured in requests per second (rps).