Did you know SD-WANs can improve network connectivity? Check out this webinar to learn how an SD-WAN simplified, one-click tool can help you migrate and manage data in the cloud.
Course Of The Month
7 days, 21 hours left to enrollBecome a Premium Member and unlock a new, free course in leading technologies each month.
Solved
Is it industry practice for CDN/ISP to do DDoS & Cyber drills or exercises
Posted on 2016-10-12
Both of CDN providers (one of them is Akamai) that offers DDoS protection service told
me they don't offer DDoS drills where we simulate an attack situation & started calling
out relevant parties.
Unless the contact persons in the two CDNs / ISPs gave me the wrong info, I believe
they don't offer such a service.
However, our audit pointed out that if such a regular drills are not being practiced
(say yearly), in the event of such attacks, the escalation & callouts will go haywire,
just like DR (Disaster Recovery) drills. Audit told me this is regulatory requirement
My view is DR is a much more complex situation as during disasters, it's chaotic
& involves massive manpower redeployment. Besides both CDN/ISPs has a call
tree documented.
I'm inclined to believe it's not the industry practice to do such DDoS drills as both
CDN providers don't offer them or am I mistaken? Wud like to know how other
people out there practice it esp in financial/banking, healthcare & stock exchanges
me they don't offer DDoS drills where we simulate an attack situation & started calling
out relevant parties.
Unless the contact persons in the two CDNs / ISPs gave me the wrong info, I believe
they don't offer such a service.
However, our audit pointed out that if such a regular drills are not being practiced
(say yearly), in the event of such attacks, the escalation & callouts will go haywire,
just like DR (Disaster Recovery) drills. Audit told me this is regulatory requirement
My view is DR is a much more complex situation as during disasters, it's chaotic
& involves massive manpower redeployment. Besides both CDN/ISPs has a call
tree documented.
I'm inclined to believe it's not the industry practice to do such DDoS drills as both
CDN providers don't offer them or am I mistaken? Wud like to know how other
people out there practice it esp in financial/banking, healthcare & stock exchanges
[X]
Welcome to Experts Exchange
Add your voice to the tech community where 5M+ people just like you are talking about what matters.
- Help others & share knowledge
- Earn cash & points
- Learn & ask questions
3 Comments
Active 1 day ago
One of the 2 ISP uses Arbor Peakflow so I'm not sure if this product could
help facilitate drills/exercises.
http://www.bankinfosecurity.com/interviews/simulated-attacks-will-test-responses-i-2063
https://www.corero.com/blog/categories/Banking-DDoS-Protection.html
Above links appear to indicate such drills are crucial but why then the 2 ISPs/CDN do
not offer it?
help facilitate drills/exercises.
http://www.bankinfosecurity.com/interviews/simulated-attacks-will-test-responses-i-2063
https://www.corero.com/blog/categories/Banking-DDoS-Protection.html
Above links appear to indicate such drills are crucial but why then the 2 ISPs/CDN do
not offer it?
Active today
These provider need to let customer know the contact and how the severity of the event or attack can be escalated with a stipulated period based on the severity. The drill aspects is not a contractual default unless you asked for it and a formal exercise run through e.g. tabletop or execution based need to be deliberated early before awarding them. By default, these are not in the offering. Ask yourself that if the drill can be realised easily as the high Gbps is not easily generated.
Indeed exercise is required and there s value of it but you need to know the objective for the exercise - is it to exercise the incident handling protocol (exercise the CERT team),
- is it to verify the high Gbps handling capability (exercise the tiering to scale up as attack get worse),
- is it to validate the parties and information sharing timeliness (media and crisis comms involved) or
- is it to have all these mentioned run through for a maturity aspects (level up assessment wrt e.g. basic-standard, measured-up or well-adapted benchmarks).
It can be table top or actual simulation in a contained environment (snapshot) or an actual attack (which is unlikely because you be impacting the internet and other users causing false alarm to ISP and public). The exercise should not be only CDN but it need to be more holistic that can impact your online asset to cover L7 and L3/4 DDoS attack at minimal; and better still have use cases to drill further pertaining to supply chain compromised, malware infested CDN infrastructure, insider threat due to CDN provider/sub-contractor, unauthorised access and data leakage due to lapse of customer or provider oversight etc ...
Do check out the ENISA cyber exercise to get a better understanding what a "drills" should be
https://www.enisa.europa.eu/publications/exercise-survey2012/at_download/fullReport
Indeed exercise is required and there s value of it but you need to know the objective for the exercise - is it to exercise the incident handling protocol (exercise the CERT team),
- is it to verify the high Gbps handling capability (exercise the tiering to scale up as attack get worse),
- is it to validate the parties and information sharing timeliness (media and crisis comms involved) or
- is it to have all these mentioned run through for a maturity aspects (level up assessment wrt e.g. basic-standard, measured-up or well-adapted benchmarks).
It can be table top or actual simulation in a contained environment (snapshot) or an actual attack (which is unlikely because you be impacting the internet and other users causing false alarm to ISP and public). The exercise should not be only CDN but it need to be more holistic that can impact your online asset to cover L7 and L3/4 DDoS attack at minimal; and better still have use cases to drill further pertaining to supply chain compromised, malware infested CDN infrastructure, insider threat due to CDN provider/sub-contractor, unauthorised access and data leakage due to lapse of customer or provider oversight etc ...
Do check out the ENISA cyber exercise to get a better understanding what a "drills" should be
https://www.enisa.europa.eu/publications/exercise-survey2012/at_download/fullReport
Active today
I'm inclined to believe it's not the industry practice to do such DDoS drills as both
CDN providers don't offer them or am I mistaken?
That is correct for the majority of ISPs. My feeling is that there are two reasons:
- The cost. Management views this as an unnecessary cost.
- The embarassment. The first few times this is done, the results will be abysmal, showing every shortcoming and security hole. Everyone in the industry will know about it within 24 hours and trumpet ISP x's failings to their own customers.
Featured Post
Question has a verified solution.
If you are experiencing a similar issue, please ask a related question
A hard and fast method for reducing Active Directory Administrators members.
Liquid Web and Plesk discuss how to simplify server management with a single tool in their webinar.
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…
In this brief tutorial Pawel from AdRem Software explains how you can quickly find out which services are running on your network, or what are the IP addresses of servers responsible for each service. Software used is freeware NetCrunch Tools (https…
Suggested Courses
Course of the Month7 days, 21 hours left to enroll
728 members asked questions and received personalized solutions in the past 7 days.
Join the community of 500,000 technology professionals and ask your questions.