Mitigating DDoS Attacks: Best Practices for an Evolving Threat Landscape

Presented by PIR and

On December 5th, PIR hosted a critical 3-hour discussion on the future of cyber security with a focus on Distributed Denial of Service (DDoS) attacks. DDoS attacks are an all-too-common reality in today’s Internet landscape and are an escalating global problem. Whether a DDoS attack is motivated by criminal intent, like cyber extortion, or is executed as an extreme form of free expression, the resulting service interruptions can have wide-ranging effects. This program addressed the motives behind and targets of DDoS attacks. Below are helpful links and information on how to mitigate DDoS attacks.

Participating Organizations

Helpful Links

• Webcast of event on YouTube
• Event blog by Paul Diaz (PIR)
• EFF's basic DDoS mitigation techniques for small sites.
• Virtual Road, a DDoS-resistant hosting provider.
  
  

White Papers

• Techniques for Cyber Attack Attribution
• The Berkman Center for Internet & Society's 2010 report on DDoS attacks. 
• The Evolving Landscape of Internet Control
• 2010 Report on Distributed Denial of Service Attacks
• Impact of Low-Rate TCP-Targeted DoS Attacks on BGP – a research effort that examines some of the same issues raised in SAC 004.

Relevant Articles

• The Right to Bear Low Orbit Ion Cannons - DDoS Attacks as Constitutional Problem: Germany’s Experience – Brings up the question of legalizing DDoS attacks as a form of free expression or protest.
• Serious Attackers Paired With Online Mob In Bank Attacks – Examines the recent NY incidents with a focus on the fact that the attacks used a comparatively new vector of launching from servers rather than PCs.
• The Worrisome Threat of DNS DDoS Amplification Attacks – An excellent discussion of DNS DDOS amplification attacks, DDOS efforts aimed at name servers. It's by Dave Piscitello from the ICANN Security staff. Old by Internet security publishing standards (2006) but still very useful.
• Implementing Pushback: Router-Based Defense Against DDoS Attacks – Heavy geekery but a good look at system based protections. I included this one partly because Steve Bellovin is one of the authors. His discovery of DNS flaws in 1990 are credited widely as the start of the path to DNSSEC. He's now the FTC's Chief Technologist, the point person for FTC tech-related policy and enforcement questions.
• DOS Attacks and DNS: How to Stay Up If Your DNS Provider goes DOWN