At first glance, the common view is to wag a blaming finger for unmitigated distributed denial of service (DDoS) attacks at Internet service providers (ISPs). But maybe there’s more to the evolving story, particularly for MSSPs.
In a new research study, conducted by Corero Network Security, a provider of real-time DDoS defense solutions, 60 percent of IT security pros surprisingly said their own security teams were to blame for letting in the invasive and debilitating attacks. Only 25 percent of those surveyed tagged their ISP for insufficient defenses against DDoS attackers.
Still, it’s not like ISPs are getting off the hook easily. Some 73 percent of the respondents expect regulatory pressure to be exerted on ISPs for not protecting their customers against DDoS threats, according to the study’s data.
Those figures are but a few of a number of eye-opening results springing from Corero’s DDoS-focused survey, which spanned about 100 IT pros attending the recent Infosecurity Europe conference in London.
DDoS Attacks: Bigger, More Intense
The study’s results take on particular importance given the rising consensus that DDoS blitzes present the most imposing security threat we’ll face going forward. The expectation is that DDoS attacks will get larger and more significant throughout the year as security pros gird themselves for anticipated run-ins that could prompt major outages worldwide,
Most agree that last October’s attack on DNS provider Dyn denying access to a bevy of popular web sites including Twitter, PayPal, CNN, Reddit, Netflix, Github, Pinterest, Spotify, Wired and Yelp, is but the foreboding kick off of new era in security.
Of late, as the looming threat heightens some security providers are teaming to deliver mitigation services to organizations, an example of which is a recent deal between Radware and TierPoint. Others, such as Arbor Networks, a provider of DDoS protection services, are ramping up their technology with new releases.
“While most in the IT security industry wouldn’t expect their ISP to automatically protect them against DDoS attacks, there is a growing trend to blame upstream providers for not being more proactive when it comes to DDoS defence,” said Ashley Stephenson, Corero’s CEO.
“To help their cause, ISPs could do more to position themselves as leading the charge against DDoS attacks, both in terms of protecting their own networks, and by offering more comprehensive solutions to their customers as a paid-for, managed service,” he said.
DDoS Attacks: What Cybersecurity Pros Say
Here are more of the study’s high notes:
- Some 38 percent of respondents expect that criminal extortionists will be behind the next DDoS attack for financial gain.
- Only 11 percent believe that hostile nations will instigate a DDoS attack against their organization.
- About 46 percent expect to be targeted by a DDoS-related ransom demand over the next 12 months.
- 62 percent said it is likely or possible that their leadership team will pay the ransom.
“Considering the significant amount of revenue that can be lost when a business is taken offline, it’s understandable why some organizations may choose to pay a ransom. But this is a dangerous game and offers no guarantees,” Stephenson said.
More results:
- Even though high-bandwidth DDoS attacks attract the most notice, security pros also worry about smaller, low-volume DDoS attacks of less than 30 minutes in duration because most go unmitigated by legacy solutions.
- Only 30 percent of IT security teams have enough visibility into their networks to mitigate attacks of less than 30 minutes.
- Some 63 percent of security pros are concerned about data theft.
