Needed: Better emergency playbook for DDoS attacks
Akamai says DDoS attacks are growing steadily more vicious, aided by massive botnets. At Metricon 5, a senior service line manager warned that companies are short on emergency response playbooks to meet the threat.
By Bill Brenner , Senior Editor
August 10, 2010 — CSO —
WASHINGTON, D.C. -- Akamai Technologies continues to study the massive DDoS attacks that brought government websites to a standstill last year. The picture keeps getting uglier, but emergency planning hasn't improved.
At Securitymetrics.org's Metricon 5 event today, R.H. Powell, senior service line manager for the Cambridge, Mass.-based company, revealed new research and suggested companies do better at planning for these increasingly vicious attacks.
Powell has been watching the DDoS trend from a pretty tall vantage point. Most people use Akamai services without even realizing it. The company runs a global platform with thousands of servers customers rely on to do business online. The company currently handles tens of billions of daily Web interactions for such companies as Audi, NBC, and Fujitsu, and organizations like the U.S. Department of Defense and NASDAQ. There's rarely a moment -- if at all -- when an Akamai customer IS NOT under the DDoS gun.
Gleaning data from 200 agent servers whose sole purpose is to listen in on port activity, as well as customer traffic logs and public reports and data from firms such as Forrester Research, Akamai has found, among other things, that:
Powell's assessment mirrors that of his colleague, Akamai CSO Andy Ellis, who told CSO in January that botnets launching many of today's DDoS attacks are so vast that those controlling them probably lost track of how many hijacked machines they control a long time ago. [Listen to the full interview with Ellis in The Long, Strange Evolution of DDoS Attacks]
"We see a lot less of the fire-and-forget malware-based attacks designed to bog down the machines that were infected," Ellis said, referring to old-school worm attacks like Blaster, Mydoom and Code Red. "Now the malware is used to hijack machines for botnets and the botnets themselves are used as the weapon."
In the last year, Akamai has seen some of the largest DDoS attacks in recent memory, which Ellis described as "huge attacks of more than 120 gigabytes per second." If you are on the receiving end of that much punch, Ellis said, "It's not a pleasant place to be."