What To Do On Detecting DDoS Attacks?

A DDoS Attack or the Distributed Denial of Service is not a matter of joke. This is because these attacks flood your network with the detriment traffic and bring your applications down, thus preventing the legit users from accessing your service. The DDoS attacks more often result in the lost sales, damage to a hard-earned reputation, abandoned shopping carts and unhappy users. Now, you might ask what you can do if you have already detected an attack. Well, that is what we are going to discuss in the upcoming segment.

Steps You Must Take After Detecting A DDoS Attack

You cannot control or foresee if you might fall prey to an attack. But you can follow the below-mentioned crucial steps to minimize the impact of the DDoS attack while helping you push you to the path of recovery and finally help you prevent this from occurring again.

Alert The Main Stakeholders

It is always said that the initial step to fix a problem is to be sure there is one. If you happen to have one, you need to alert the main stakeholders within the company explaining calmly that you have been attacked by DDoS and also ensure the steps you are taking to mitigate it. Who are the main stakeholders? They include the CISO of the organization, Network IT director, the Security Operations Center (SOC), business managers of the affected services, the operations managers and related. Keep them informed with the latest updates. It would eliminate uncertainty, confusion and panic aiding in proper coordination.

Notify the Company’s Security Provider

Along with notifying your stakeholders, you would also need to alert your security providers and initiate any steps from their end in order to help you deal with the attack. By security provider, it refers to your Internet Service Provider (ISP), dedicated security service or a web hosting provider. Each of the vendor types bears different scope of service and capabilities. Your web hosting provider might help you to minimize the application impact and level up your service. In contrast, your ISP might help you reduce the amount of malicious network traffic from reaching your network. Similarly, the security services will have dedicated tools meant to combat DDoS attacks.

Activate The Countermeasures

If you already have countermeasures ready, then this is the right time to activate them. One of the many approaches is to implement the IP-based Access Control Lists or ACLs in the bid to block all the traffic coming from the attack sources. You can also try rate-limiting where you limit the number of concurrent applications connections. This approach is mainly used by the CDNs and the web hosting providers. Also, note that this rate-limiting approach is susceptible to high degrees of false-positives because it cannot differentiate between the legit and illicit user traffic.

Apart from this, you must also monitor the DDoS attack progression and check how it develops over time. Tracking your attack progression will also aid you to tune your defences. Plus, assess your defence performance.