Understand and mitigate denial of service (DoS) attacks
The NCSC is advising all organisations review their defences, and to improve resilience against attacks from Russian-aligned groups. In particular, we’re encouraging all organisations review their DoS protections, which includes:
Understanding your service
There are probably many points in your service where an attacker can attempt to overload or exhaust available resources, thereby preventing you from serving legitimate users. You should understand where these points are, and in each case, determine whether you, or a supplier, are responsible.
Upstream defences
Ensure your service providers are ready to deal with resource exhaustion in places where they are uniquely placed to help. We recommend you:
- understand the denial of service mitigations that your ISP has in place on your account
- look into third-party DDoS mitigation services that can be used to protect against network traffic based attacks
- consider deploying a content delivery network, for web-based services
- understand when and how your service provider might limit your network access in order to protect their other customers
- consider using multiple service providers for some functionality
Building to allow scaling
To deal with attacks which can’t be handled upstream (or only once detected and blocked), make sure your service can rapidly scale. Ideally, you should be able to scale all aspects of your application and infrastructure. Cloud-native applications can be automatically scaled using the cloud providers’ APIs. In private data centres, automated scaling is possible using modern virtualisation, but this will require spare hardware capacity to deal with the additional load.
Defining your response plan
Design your service and plan your response to an attack so that it can continue to operate (albeit in a degraded fashion). We recommend your plan includes:
- graceful degradation
- dealing with changing tactics
- retaining administrative access during an attack
- having a scalable fall-back plan for essential services
Testing and monitoring your service
Gain confidence in your defences by testing them, and ensure you can spot when attacks start by having the right tools in place. Test your defences so you know the types (and volume) of attacks you are able to defend. System monitoring will help you spot attacks when they begin, and analyse your response while it’s underway.
