The Black Hand

An entity can be the victim of a volumetric DDOS attack exploiting a protocol even though it does not expose a service based on that same protocol. If redirection via DNS is used, it must be ensured that there is no trivial way of discovering the IP address to be protected. The use of this protection solution requires the implementation of an interconnection between the entity and the protection service provider. This interconnection may consist of the establishment of a wire tunnel, or, where possible, be direct and physically established. It is imperative to have appropriate contacts in-house at transit operators as well as at protection service providers to respond effectively in the event of an attack. Wherever possible, it is important to ensure that the service providers on which an entity depends are prepared for DDOS attacks. Monitoring and alerting facilities are needed to detect an incident. Unused services should be disabled at the server level.