Australia is now one of the top 10 countries where businesses are targeted by DDoS (Distributed Denial of Service) attacks, according to recent  research published by Netscout Arbor.  In 2017, 22% of all cybercrime activities targeting victims in Australia were DDOS attacks. So should business owners be concerned?
In this article, we break down the technical aspects of DDOS attacks in lay-mans terms. Also, we go over a few actionable steps to mitigate risks for your business. 

What is a DDoS Attack?

A DDOS attack refers to a type of network attack aimed at crippling the delivery of any web-based service. Rather than extracting data from a system in a traditional ‘hack’, these attacks aim to bring down a server or website. Moreover, the goal of the latter is to hinder end-users’ access to applications, networks, services, transactions and the like.
In a DDoS attack, attackers hijack hundreds of malware-infected systems (sometimes termed zombies). The attacker then uses these systems to send rubbish data and communication requests to a targeted web server. This essentially ‘drowns’ the system; if successful, a DDoS attack causes servers and databases to crash as it overwhelms all available resources such as memory, CPU and bandwidth.

What can a DDoS attack do to your business?

So what could happen if DDOS attackers target your website? To better understand how a DDoS attack can impact your business, let’s consider a recent and notable case study that we’re all familiar with – the attacks that targeted the Census conducted by the Australian Bureau of Statistics on August 9, 2016. As you may recall, the website was entirely inaccessible for the majority of Census night.

The next day ABS confirmed the attack through a Twitter update. They explained that the disruption was due to 4 DDOS attacks of varying nature and severity.  According to Australian Statistician David Kalisch, the first three attacks were relatively minor. Also, the attacks did not hinder the submission and storage of over 2 million census forms. In the fourth attack, ABS decided to shut down the entire system to prevent the database from crashing.

Beyond the integrity of the data and backend systems, the ABS drew flak from users who were (understandably) frustrated. Moreover, many people simply believe that the ABS was incompetent.

What does this mean for your business?

While the ABS is a non-profit government agency, it is easy to translate how a similar situation could have a devastating effect on a business. Simply put, a DDoS attack can potentially take your business website offline for hours (if not days). More importantly, such attacks can result in massive losses in revenue.
Businesses can spend years fostering trust and building a good reputation among customers. A DDOS attack can ruin everything in just a few hours. More importantly, users who are unable to access the products or services they paid for may never return. Moreover, people can lose confidence in a business’ ability to protect sensitive information.

But really – how likely is it that I’ll be targeted?

Small businesses with a minimal online presence have no reason to worry about DDOS attacks

However, for larger businesses – or those who are dependent on their website for the majority of their revenue, such as online stores – they are a growing threat. For example, recent studies like the 13th Annual Worldwide Infrastructure Security Report (Netscout Arbor) and the 2017 Global Threat Intelligence Report Key Findings (NTT Security) demonstrate that attacks are becoming more prevalent, more frequent and more serious.

In 2017, Australia ranked 10th for top 10 targeted countries for DDoS attacks by percentage (1.9%). 9th for the top 10 targeted countries for DDoS attacks greater than 10 Gbps by percentage (2.8%). On face value, these statistics seem inconsequential. Moreover, the Center for Applied Internet Data Analysis’ study puts this into perspective. In 2017 there were 28,000+ attacks worldwide each day on the internet. That means 500+ target Australian organisations. 

Emerging trends in DDOS Attacks

Perpetrators of DDOS are becoming bolder and better at what they do. An example of this is the recent DDoS attack that targeted Github – a cloud-based software development platform – on February 28, 2018. The attack was one of the largest recorded to date, reaching a massive 1.35 Terabytes per second of malicious data.

 

The interconnectedness of our daily lives helps facilitate large-scale DDOS attacks. Manufacturers produce more Internet-capable devices every day. This includes common appliances like fridges and washing machines now have internet-enabled functions. Cybersecurity is not a focus for most people. For example, attackers can easily compromise unpatched devices on home networks to launch attacks remotely.
What is more troubling is that DDOS attackers have started to commercialise their illicit activities. You or I could order a DDoS attack with a quick Google search and a PayPal account. It is very illegal in most jurisdictions – so don’t try it – but attacks are nevertheless a click away for a disgruntled customer, or even a competitor looking for an unfair advantage.

What can you do to protect your business?

The good news is that there are resources and solutions that businesses can implement to protect themselves from the threat of DDOS attacks today and well into the future. One answer is to shift your website, business applications and data off any local servers in your office or data centre to a cloud service provider that specialises in mitigating DDoS attacks. For example, at Intergrid, we include DDoS protection in all of our services; our network can absorb large attacks and we have invested heavily in specialist mitigation technology that detects and drops malicious attack traffic, keeping your business up and running.