Corero recently partnered with John Pescatore, Director of Emerging Security Trends with the SANS Institute in developing a survey program designed to shed more light on organizations’ experiences with DDoS attacks.
What we uncovered does not come as a surprise to those well entrenched in the DDoS defense space. The results continue reinforce the need for businesses to build and execute on comprehensive DDoS defense strategies. There were a few key data points that warrant some deeper discussion:
According to the survey; More than 40 percent of the survey respondents use a combination of on-premises DDoS mitigation solutions and off-site ISP or service provider capabilities to combat DDoS attacks. This is an interesting point to consider, as respondents seem to be more aware of the level of sophistication, and potential damage caused by a DDoS attack, and in turn, deploy a multi-pronged defense strategy.
Combination attacks shouldn't be a surprise – discussions with security managers indicate that the attacks experienced, typically begin with a single technique, and escalate by combining additional attack methods when they find that initial mitigation efforts appear to be working. DDoS attack types experienced were evenly distributed across targeted (or application – specific) with 42 percent, volumetric or brute force/flood events, 41 percent and attacks that combined both techniques at 39 percent. This finding reinforces the point identified later on in the report, that simply relying on existing infrastructure elements, (such as servers, gateways, routers, switches, firewalls and so on) cannot properly mitigate blended attacks.
According to the survey results, businesses saw an average of 4.5 attacks per year, resulting in service outages of 2.3 hours per attack. The survey also found that almost 40 percent of organizations are either completely or mostly unprepared for a DDoS attack with 23 percent of respondents saying they do not have a DDoS mitigation plan in place. While a slight improvement from the findings of a survey conducted in October 2013, which found that 44 percent of respondents did not have a DDoS response plan established, it is clear that more work needs to be done. For the organizations that do have response plans ready, nearly 50 percent do not test those solutions – another slight improvement from almost 60 percent in the previous survey. While we have seen improvements in organizations’ approach to preparing for DDoS attacks over the past few months, it is clear that many companies still are not prepared to respond to these attacks. Companies cannot assume that their industry or size of business is immune to these attacks and cannot afford to risk their reputation and revenue streams when they fall victim to DDoS attacks and cyber threats.
- About Corero
- Investor Relations
- News Room
- Executive Management Team
- Corero Offices
- Contact Us