Majority of Enterprise Customers Want Better DDoS Protection from ISPs

Last week FierceMarkets and Corero jointly published a new research report, “DDoS Impact and Opportunity in the Service Provider Environment,” showing that a whopping 85% of enterprises expect their Internet Service Providers (ISPs) to offer better protection from DDoS attacks. The research was based on a survey of 100 ISPs and 75 enterprise customers regarding their DDoS mitigation strategies. This report discusses not only the traditional methods of DDoS mitigation, but also the rationale of some ISPs who have not yet adopted more effective anti-DDoS technology.

ISPs do, in fact, recognize the importance of DDoS protection; more than half of them (51%) rated DDoS defenses as more important than other types of security defenses for their customers. Unfortunately, an alarming proportion of ISPs are still relying on outdated technologies to protect their customers from DDoS attacks. For example, 46% divert DDoS traffic through a scrubbing center – an expensive and notoriously slow technique which typically takes around an hour from detection to mitigation. In addition, almost half of those surveyed (49%) ‘blackhole’ a victim’s traffic when they suffer a DDoS attack – which essentially does a hacker’s job for them, by denying service to a particular website.

Corero COO Dave Larson notes:

“Given this situation, it’s no wonder that enterprise customers are demanding better DDoS protection. Using yesterday’s tools to mitigate today’s attacks may save ISPs costs in the short-term, but it also puts their customers at greater risk of suffering a DDoS attack. According to a recent Kaspersky Lab report, DDoS attacks cost large enterprises an average of $444,000 USD in lost revenues and IT spending. To any organization relying on the Internet to conduct business, the fiscal fallout from a DDoS attack can be exponential.”

Some providers have been reluctant to begin offering DDoS protection services (for a fee) for their customers. In our survey, the most common (at 27 percent) “top reason” for not providing this protection is the belief that customers simply expect DDoS protection to be part of their overall investment and would balk at paying a fee. However, in our recent survey at the RSA Conference 2016 51% responded that they would be willing to pay their ISP(s) for a premium service that removes DDoS attack traffic before it is delivered to them, and 35% indicated they would allocate 5-10% of their current ISP spend to subscribe to this type of service.

Larson adds:

“Telecoms providers are missing a trick here, by selling on cost, not quality. They have a golden opportunity to create valuable new revenue streams by providing a cleaner, more reliable pipe for their customers by adopting an always-on, in-line DDoS mitigation system. The industry is placing an ever-higher premium on keeping data secure and their networks free from malicious actors. ISPs can either use this as an opportunity to modernize their services and generate new channels for revenue – or risk a slow shrinking of their customer base.”

Access the full executive summary of the FierceMarkets & Corero report!