The most famous distributed denial-of-service (DDoS) attacks usually involve political intrigue or huge corporations, as was the case with attacks on Hong Kong’s “Occupy Central” movement and six major U.S. banks respectively. That may come as no surprise, as the scale of such attacks are awe-inducing and the potential consequences for the many stakeholders involved can be dire.
That does not mean, however, that smaller organizations are safe from vicious DDoS attacks. Since it is a common assumption that hackers prefer to launch DDoS attacks against large corporations, owners of small and medium-sized businesses tend to leave their web services relatively vulnerable and therefore make easy targets for would-be attackers. In fact, small businesses are quickly becoming the favorite targets of such bad actors, as the Ponemon Institute’s “The 2017 State of SMB Cybersecurity” report demonstrates.
This article will explain why it is so essential for small businesses to have DDoS protection in place before an attack is in place. The consequences of being unprepared can be severe, especially for a small-sized business that lacks the capital to absorb increasingly costly attacks.
What is a DDoS attack?
First of all, here is a brief explanation of what a DDoS attack involves.
A DDoS attack occurs when hackers attempt to disrupt a web service by initiating a massive amount of superfluous requests originating from a multitude of invalid return IP addresses, thereby flooding the network and preventing legitimate users from accessing any associated services.
DDoS attack is exactly like a bunch of malicious monsters queueing to board a train while real passengers being blocked from it.
In other words, the mass of incoming traffic congests the network and prevents routine services from operating properly. Large-scale DDoS attacks may crash web servers entirely, putting an entire business offline for an extended period of time, damaging both the web infrastructure of the business as well as its trust with customers.
DDoS attacks on small businesses
Here’s a scenario that may be applicable to some readers.
A young entrepreneur decides to pursue his dream of being a self-employed small business owner and starts his own SaaS (Software as a Service) company, selling enterprise management software to medium and large-sized international corporations. While the barriers to entry are lower in the web services space, the budding entrepreneur finds a moderate small business loan is still necessary to pay for server space and the many expenses associated with launching a company and retaining employees.
Over the succeeding months, the company grows and attracts more and more customers. Things are going well until, one morning, the small business owner wakes up to a call from a panicked employee. The company website suffered a vicious DDoS attack during the night and now the customers are calling, emailing, and generally expressing their frustration at the interruption of service. Many threaten to cancel their subscriptions entirely unless the situation is resolved promptly.
Not expecting to be a target for such a DDoS attack, the site’s infrastructure was not capable of sustaining itself against the weight of the coordinated massive request. As a result, the company’s full array of hosted web services buckled under the stress. With no quick fix at hand, a week-long interruption of service causes many customers to follow through on their threats to unsubscribe and costs the company dearly. The damage could have been worse, but the hit to the company’s reputation cannot be quickly restored and the once-thriving entrepreneur now must scramble to even stay afloat.
This kind of situation occurs on a near-daily basis, with organizations estimated to face an average of 8 attacks per day. The monetary costs of a DDoS attack can be astronomical, recently reaching an average of roughly $2.5 million per attack for victimized businesses.
If even the largest companies are suffering under the strain of repeated DDoS attacks, it is reasonable to wonder what small and medium-sized businesses can do when facing such a catastrophe.
What small business can do to defend from DDoS attacks
There are many ways in which an owner of a small or medium-sized business can attempt to mitigate or outright protect against vicious DDoS attacks. We have listed below some that we think are particularly effective and are not unduly difficult to implement.
- Buy a quality router – This may sound too simple, but using a solid internet router can go a long way in providing the enhanced bandwidth buffering necessary during traffic spikes. The added bandwidth gives one time to both recognize an attack while it is occurring and offers a chance to react to it in real-time. A business-grade router is most likely to be able to do the job.
- Develop (and implement) an incident response strategy – It is vital to prepare a contingency plan in advance to be instituted in the event of a DDoS attack. Then, when a suspected attack is confirmed, pre-planned emergency measures can be implemented as smoothly as possible, reducing panic amongst employees and lessening the likelihood of severe and long-lasting damage. For example, prioritizing resources to ensure that high-value applications and services are kept alive during an attack instead of low-value traffic can be a valuable strategy.
Such emergency measures should specify a dedicated response team and outline a plan to contact the appropriate ISP provider, as they may be in a position to provide assistance during an attack. However, this option is likely to be a more expensive emergency option as compared to DDoS protection subscription options.
- Purchase DDoS protection services – Those looking for the best mitigation against DDoS attacks should consider subscribing to a DDoS protection service. This is especially essential for well-known businesses or for any business that relies upon digital channels for a critical portion of business operations. In particular, it is important to have layered protection against multi-vector attacks, as a DDoS attack may actually be a smokescreen to hide other kinds of malicious attacks.
Subscription to a content distribution network (CDN) can be invaluable in identifying and then stopping vicious DDoS attacks. Put simply, a CDN is a distributed network of proxy servers that can monitor traffic patterns and scrub attack traffic, in addition to providing a welcome boost in overall website performance.
It’s never too late
It may seem unfortunate to have to pay to be properly protected against DDoS attacks, but remaining unprotected puts companies at great risk in terms of potential damages, time lost, and diminished customer trust.
With that said, small business owners who are looking for simple and effective DDoS mitigation solutions that do not break the bank would do well to consider subscription services that offer always-on, multi-layered defense against attacks. At Mlytics, our leading DDoS protection service gives business owners the peace of mind necessary to focus on expanding their business.
