Its time to rethink DDoS protection When you think of distributed denial of service (DDoS) attacks, chances are you conjure up an image of an overwhelming flood of traffic that incapacitates a network. This kind of cyber attack is all about overt, brute force used to take a target down. Some hackers are a little smarter, using DDoS as a distraction while they simultaneously attempt a more targeted strike, as was the case with a Carphone Warehouse hack in 2015. 1  But in general, DDoS isnu0027t subtle.  Retailers are having to rethink how they approach distributed denial of service (DDoS) protection following the rise of a stealthier incarnation of the threat.  There has been a significant increase in smallscale DDoS attacks and a corresponding reduction in conventional largescale events. The hackerxe2x80x99s aim is to remain below the conventional xe2x80x98detect and alertxe2x80x99 threshold that could trigger a DDoS mitigation strategy. Roy Reynolds of Vodat International explains the nature of the threat and the steps organisations can take to protect themselves.

Measuring the impact of a successful DDoS attack on the customer behaviour of managed DNS service providers Distributed DenialofService (DDoS) attacks continue to pose a serious threat to the availability of Internet services. The Domain Name System (DNS) is part of the core of the Internet and a crucial factor in the successful delivery of Internet services. Because of the importance of DNS, specialist service providers have sprung up in the market, that provide managed DNS services. One of their key selling points is that they protect DNS for a domain against DDoS attacks. But what if such a service becomes the target of a DDoS attack, and that attack succeeds? In this paper we analyse two such events, an attack on NS1 in May2016, and an attack on Dyn in October2016. We do this by analysing the change in the behaviour of the serviceu0027s customers. For our analysis we leverage data from the OpenINTEL active DNS measurement system, which covers large parts of the global DNS over time. Our results show an almost immediate and statistically significant change in the behaviour of domains that use NS1 or Dyn as a DNS service provider. We observe a decline in the number of domains that exclusively use NS1 or Dyn as a managed DNS service provider, and see a shift toward risk spreading by using multiple providers. While a large managed DNS provider may be better equipped to protect against attacks, these two case studies show they are not impervious to them. This calls into question the wisdom of using a single provider for managed DNS. Our results show that spreading risk by using multiple providers is an effective countermeasure, albeit probably at a higher cost.