The changing face of DDoS attacks: Degraded performance instead of total takedown

The number of DDoS attacks might be getting higher, but they are not all massive nor do they always trigger DDoS defenses. In fact, small-scale DDoS attacks are becoming more frequent and sophisticated, according to new research from Neustar’s SOC.

According to the company’s Q2 2019 Cyber Threats and Trends report, between April and June of this year, over 75 percent of all attacks mitigated by Neustar were 5 Gbps or less, while large attacks – those of 100 Gbps and over – decreased by 64 percent.

At first glance, the evolution of DDoS attacks on enterprises seems to follow a pattern. The overall number of attacks during Q2 2019 compared with the previous year grew by 133 percent, which, though down from last quarter’s 200% growth, is still high. Stepping outside an analysis of the numbers of attacks to their composition, however, shows some interesting changes.

Small and secretive

DDoS attacks have long been considered overwhelming threats and are traditionally associated with high rates of traffic. Such attacks do continue to take place, but smaller and more carefully targeted incursions are growing in quantity, intensity and duration.

Such attacks do not seek to saturate the network link – and draw unwanted attention in the process – but to degrade or disable specific infrastructure within the target. Such lower volume incursions may enable the perpetrator to get in and get out unnoticed or allow the attack to continue for quite a long time undetected. In fact, the longest duration for a single attack in Q2 was nearly two days.

These small attacks pose a significant threat, as they fall below the typical threshold that enterprises with a “detect and alert” DDoS mitigation strategy might employ. An attacker could therefore affect targets ranging from infrastructure to individual servers with relative impunity.

The situation becomes more alarming when considering an enterprise’s ability to recognize such threats when they were underway. When asked how likely they would be to notice today’s most prevalent smaller attacks, a staggering 72 percent of CTOs, CISOs and Directors of Security from the Neustar International Security Council (NISC) answered very unlikely, somewhat unlikely or somewhat likely. The remaining 28 percent of respondents felt it was very likely that they would notice a small-scale DDoS attack.

“With the rise of smaller DDoS attacks going under the radar, now is the time for organizations to deploy an ‘always on’ DDoS mitigation service that is constantly monitoring traffic to ensure threats of all sizes are detected, managed and diffused,” said Rodney Joffe, Senior Vice President, Senior Technologist and Fellow at Neustar.

“Now, with most of today’s attacks directed at specific services, gateways and applications – therefore requiring less traffic to bring it down – a greater level of understanding from businesses to determine the protection they need is essential. The first stage of this is to determine what is valuable, not what is vulnerable. One of the best ways to separate vulnerability from value is to create a ‘risk register’ that starts from the inside and focuses on your most critical business assets,” Joffe added.