Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Solutions Overview- Three-Phased DDoS Mitigation

129 views

Published on

  • Be the first to comment

  • Be the first to like this

Solutions Overview- Three-Phased DDoS Mitigation

  1. 1. 2 of 3 Dyn’s Three-Phased DDoS Mitigation Strategy INTERNET PERFORMANCE. DELIVERED. SOLUTIONS OVERVIEW Dyn’s Three-Phased DDoS Mitigation Strategy There are distinct benefits to including Dyn as part of your DDoS mitigation strategy. Dyn takes a three- phased approach to deliver a comprehensive DDoS mitigation strategy that incorporates planning, mitigation, and a full postmortem. Planning Dyn’s routing method and operational architecture are the first line of defense in mitigating DDoS attacks against our clients. The Anycast network allows multiple, identical, globally deployed DNS servers to advertise the same IP address. Dyn connects from 18 locations to four Anycast nameservers. Dyn monitors DDoS hotspots to ensure appropriate coverage for those regions. Dyn’s routing strategy also tempers the nature of the attack itself. When DDoS activity is discovered, traffic can be shifted to a better provisioned site. Dyn’s next layer of defense is reducing the risk to your assets in a multitenant environment. Dyn employs a nameserver pooling strategy which reduces the number of accounts on each nameserver announcement. Mitigation Before you can mitigate an attack, you need to know when an attack is happening. Dyn provides a fully staffed global Network Operations Center (NOC), which monitors network activity and automatically sends notifications when a threat threshold is met. If this occurs, Dyn can trigger automatic packet capture and alert emails which aid in determining the size and scope of an attack and can yield information regarding what is actually being attacked. Other alerts include bandwidth and various plugin timeouts, which again can serve as an early warning for an attack. We hold transparency as a core pillar of our business philosophy at Dyn. As soon as an attack is determined, Dyn creates an Incident Report for internal stakeholders, and posts a report on dynstatus.com. Utilization of tools that display DNS query sources and that can be run from various instances to ascertain the usage of adjacent DNS servers helps Dyn examine the size and scope of an attack. This strategy can provide information about what is being queried and how many requests are being made and helps Dyn determine if the attacks are occurring in or out of protocols like UDP or TCP, versus IP Fragments. Another method of DNS DDoS mitigation that Dyn employs is developing and deploying firewall rules to block incoming traffic based on specified criteria such as, source IP, source TTL, and so on. Upstream from the network, Dyn and its transit providers can perform filtering with both hardware and software utilities on criteria matching the attack vector to scrub the traffic inbound to our network. Utilizing these devices enables Dyn to perform deep packet inspection to analyze incoming packets, and only allow certain requests through to our network. This will usually eliminate the attack threat altogether.
  2. 2. dyn.com/contact Regional HQ: London, UK / Sydney, AUS / San Francisco, CAGlobal HQ: Manchester, NH USA3 of 3 @dyn INTERNET PERFORMANCE. DELIVERED. SOLUTIONS OVERVIEW The final step of BGP “black-holing” can also be utilized to remove a resource from the network either from a local attack hotspot, or on a wider range. Post Mortem Any time a DNS DDoS mitigation takes place, it is very important that your business continuity and network incident response plans are employed and held to a detailed retrospective. Attacks will often help Dyn and your team uncover information like specific protocols and tactics employed by the attackers and can be added to your team’s playbooks and forensics strategies to forestall the impact of future attacks. Dyn creates an Incident Report at the first identification of an attack in order to provide the best post mortem coverage. Should an incident increase in business impact and visibility, all parties have full insight into what has happened and what is occurring. Keeping detailed records is necessary for a successful post mortem; packet captures can engender new filtering rules, playbooks can be reviewed and altered as needed, and new processes can be put into place as needed. Conclusion Dyn can help you quickly identify and defend against DDoS attacks and provides mitigation and postmortem strategies to ensure your online infrastructure is under control and available. About Dyn Dyn is a cloud-based Internet Performance company. Dyn helps companies monitor, control, and optimize online infrastructure for an exceptional end-user experience. Through a world-class network and unrivaled, objective intelligence into Internet conditions, Dyn ensures traffic gets delivered faster, safer, and more reliably than ever.

×