The risks of DDoS attacks for the public sector

Distributed denial of service cyberattacks have been around for decades, but they have become an even more acute problem in the last few years, especially to public institutions. Recent statistics suggest these types of attacks continue to increase in volume, as well as sophistication and severity. The number of DDoS attacks in 2020 is estimated by researchers at SecurityIntelligence to be 24% higher than in 2019.

A DDoS attack involves generating malformed, problem network traffic that literally denies a particular “service” normally provided by a company. Services can include a specific website, an email server, an e-commerce system or any critical service essential for a government or nation, such as air traffic control. Attacks can even affect entire cloud service providers.

Years ago, DDoS attacks were perpetrated by individuals who had a particular grudge, or who wished to create mischief. Motives today are far more deep-seated and can include an interest in obtaining financial reward, making an ideological statement, creating a geopolitical advantage or exacting revenge for a particular government action, corporate campaign or policy stance.

Types of DDoS attacks can include:

• Volumetric: An attack that involves enormous volumes of “garbage” network traffic. These include using floods of ICMP traffic. They can also include sending out massive amounts of TCP-based traffic, such as SYN floods.
• Protocol-based: Sometimes these are called application-layer attacks and involve relatively -- or even very -- small amounts of traffic designed to crash a particular service. Years ago, certain Linux and Windows systems had software flaws in their networking software that could not properly process a single malformed ping packet called “the ping of death.” More recently, certain web servers fell victim to the Slowloris attack, which involves low volumes of lethal HTTP packets.

The consequences of DDoS attacks on public institutions

Public institutions were warned of dozens of threat alerts in 2020. Any attack poses a serious information security problem, and consequences can be severe. For example, a DDoS attack on financial services institutions in 2016 alone resulted in 46 major corporations that could no longer provide services to U.S. government institutions as well as to individuals. The same thing has happened in 2020 to non-traditional financial services, such as cryptocurrency exchanges. During the COVID-19 crisis, health care institutions also fell prey to DDoS attacks.

How are DDoS attacks conducted?

Cybercriminals often create sophisticated botnets to create volumetric and protocol-based attacks. They are often composed of thousands -- if not millions -- of compromised hosts from around the world.

Attackers also unleash malware- and ransomware-based attacks on individuals to attack U.S. government agencies and create outages at institutions around the world.

The following DDoS mitigation steps can help improve network security.

• Use multiple-redundant systems. Government agencies have learned they should have “hot sites” and “warm sites” ready in case a primary resource becomes unavailable. Such sites can then be brought into production in case of an attacks.
• Use multiple ISP organizations. If one internet service provider becomes overwhelmed, agencies can switch to a completely different provider.
• Create backups. Sometimes a DDoS attack can involve ransomware; the most effective solution is usually to restore from backup.
• Update the patch level of all systems. Agencies should create an update regimen for all systems, including network edge devices (e.g., firewalls), as well as endpoints such as mobile phones, PCs and internet-of-things devices.
• Create incident response and business continuity plans. Incident response and business continuity plans must be written, approved and relevant. Testing them is essential.
• Use third-party scrubbing services. Companies such as Cloudflare have the ability to filter, or scrub, DDoS traffic from legitimate traffic, thus mitigating an attack.
• Leverage automation. It is possible to automatically modify cloud implementations, intrusion detection systems, network devices, firewalls and other systems to mitigate attacks.

Organize a defense and set up a response plan

Organizing a defense involves placing adequate security controls and using the multiple, redundant systems discussed above. The key, though, to organizing a completely adequate defense is creating -- and practicing -- a response plan.

Creating a response plan involves:

• Updating security policies with specific incident response steps.
• Gaining approval from all agency leaders.
• Disseminating the plan to employees and providing training.
• Practicing with all elements of the agency so the response becomes institutional muscle memory.

Regardless of the best practices agencies follow, it’s vital they practice their response plan as much as possible, using methods such as:

• Tabletop exercises: Activities where agency leaders meet and go through each step of the plan in a given scenario. Because this type of activity is designed to begin the process of putting an incident response plan into practice, these exercises can be conducted in a meeting or series of meetings.
• Walkthroughs: A more detailed practice session involving more individuals and departments that can include taking actual steps designed to mitigate an attack.
• Simulations: A full-blown, organizationwide practice session designed to teach the steps of an incident response plan as well as discover potential shortcomings in the plan.

Next steps

For the public sector, adopting relevant policies and training are often the best one-two punch against DDoS attacks. Many agencies have derived the most benefit by orchestrating their technical and personnel resources. Cybersecurity is everyone’s job, so it’s important to get the entire organization up to speed on how to identify, prevent and respond to threats they may encounter.