Myth (noun). 1. an ancient story or set of stories, especially explaining the early history of a group of people or about natural events and facts; 2. a commonly believed but false idea.
Myths in their purest form have been around since ancient times. Stories to help people understand and navigate the world around them. More recently, they’ve become less folklore and more fallacy as people buy into ideas that suit their narrative without any basis in fact. And, perhaps this is never more true than when it comes to cybersecurity.
Whether it’s willful ignorance or the mistaken belief that a cyber event won’t happen to them, too many companies are operating under a set of misguided beliefs that they are safe, when nothing could be further from the truth. After many years in cybersecurity, most recently in distributed denial of service (DDoS) mitigation solutions, I can assure you no one is safe, especially when it comes to DDoS attacks. I’m sharing a few of the most common myths surrounding DDoS attacks and mitigation in hopes that by arming companies with the facts, they don’t fall victim to the fiction.
1.Nothing to see here. Whereas in 2008, the assertion that certain financial institutions were too big to fail saved them from certain ruin, a similar but opposite belief by some companies that they are too small to be noticed by cyberattackers could inadvertently lead them to certain ruin. Despite near-weekly evidence to the contrary, these organizations believe they aren’t significant enough to merit a blip on a threat actor’s radar. And while it may be true that they are an unlikely target of a nation state-based attack, there are plenty of ne’er do wells who are looking for an easy score, courtesy of an unprotected or underprotected company. If a company has an online presence, they are a potential victim, no matter their size or industry.
2.The total package. Simply implementing a DDoS protection solution is not enough to keep the wolves at bay. In fact, no solution can completely shield a company from potential attacks and those who claim they can should be avoided at all costs. That’s not to say that DDoS prevention solutions aren’t a worthwhile investment. They are and are an essential part of a company’s security posture. While they can mitigate various types of attacks, they cannot guarantee absolute protection. Threat actors are constantly working to outsmart the next, best security solution and are tailoring their tactics to leverage new vulnerabilities to their advantage. Companies need to make sure they are employing a comprehensive approach to security that includes a DDoS solution that limits downtime to seconds and not minutes.
3.One-size-fits-all (or does it?). There’s a misconception that one DDoS protection solution is the same as the next, with price being the main differentiator. Nothing could be further from the truth, however. Different solutions specialize in mitigating different types of attacks and offer varying levels of protection. Before shopping for a DDoS protection solution, organizations must have a solid understanding of their specific needs and choose a service provider accordingly. Ideally, a solution provider should provide options that will allow for protection at scale and that can be tailored to suit an organization’s needs now and in the future.
4.Faulty math. Some believe that implementing robust DDoS protection is cost-prohibitive and only necessary for large enterprises. However, DDoS attacks don’t discriminate and target businesses of all sizes. All too often, the cost of mitigation is often far lower than the potential losses incurred during an attack in terms of downtime, reputation damage, and lost revenue. In fact, research has found that the average loss to a business under DDoS attack is anywhere from thousands to hundreds of thousands of dollars per hour. Compare that to eliminating the cost of a DDoS protection solution from your budget, and the math doesn’t add up.
5.Firewall insufficiency, bandwidth buster. Firewalls are essential components of network security, but they are not the end-all, be-all when it comes to mitigating DDoS attacks. While firewalls play the important role of gate-keeper, stopping unwanted traffic, many DDoS attacks operate by overwhelming network resources, making them inaccessible to legitimate users. It might follow then that the key to success comes with adding bandwidth; unfortunately, a significant portion of DDoS attacks are non-volumetric in nature, meaning the bandwidth you added to alleviate the problem might just make things worse. Look for specialized DDoS protection services that employ advanced techniques such as traffic filtering, rate limiting, and behavioral analysis to mitigate these attacks effectively.
6.Set it and forget it: While it’s tempting to think that once you have DDoS protection measures in place you can go about your business and forget about them, you’d be wrong. Strong DDo protection demands continued monitoring, maintenance and updates to keep abreast of evolving threats. Therefore, it’s essential that companies regularly review and update their DDoS mitigation strategy. Attackers constantly develop new methods, and your defenses must evolve accordingly.
7.The call came from inside the house: All too often, organizations focus on protecting themselves from external DDoS attacks while overlooking the importance of protecting their internal networks from attacks that originate from inside the company. Insider threats or compromised devices can launch DDoS attacks that disrupt internal services and operations so make sure that any DDoS protection solution you consider accounts for both firms of attack
Whereas the idea that ignorance is bliss might be a balm meant to soothe a wrongdoer’s conscience, the stark reality is that what you don’t know can, in fact, be your undoing. Know the facts, and be prepared.
