DDoS attack

The requests usually come from a botnet, a collection of hijacked devices controlled from a distance. What gets hit is whatever is reachable from the internet: the website, the online shop, the mail server, the booking portal. If the load is aimed at your own internet connection, everything else that runs over that line stops as well, including cloud software, internet telephony and email. The data itself remains untouched. The damage comes from the standstill and from the extortion that can accompany it, usually with the threat of a repeat performance.

At first an outage looks like any other outage. Clarity comes from a call to your hosting company or internet provider, because the incoming traffic is visible to them. So that this call happens quickly, the list of contacts, contract numbers and emergency numbers belongs somewhere reachable without internet access, on paper and also on a mobile phone. Establish in advance what response times your contract promises and who handles attacks at your provider.

A good deal can be prepared. Hosting companies offer protection services that filter traffic upstream and absorb the load, often as an add-on to an existing package. Running your website and your email with separate providers keeps one outage from taking the whole business with it. A mobile data connection as a fallback keeps the most important applications alive. For orders and enquiries, an agreed alternative route such as the telephone keeps revenue moving.

If you receive an extortion letter threatening an attack, inform your provider and report the matter to the police. Paying buys no security, because it confirms the attackers and makes further demands likely. Prepare your communication: a short notice for customers, a pointer to the alternative route and a named person who decides in an emergency. These considerations belong in your emergency plan.

Reviewing availability and emergency preparedness in the IT Check