DDoS

Attack on the availability of websites or other internet services. These services are overloaded by a large number of requests. 

A DDoS (distributed denial of service) is a type of attack on computer systems with the aim of making them unavailable. The volume of data often reaches several hundred Gbit/s. Generally, a single organisation cannot cope with volumes of this size without external assistance. Firewalls and IPS (intrusion prevention systems) that have been configured accordingly offer only limited assistance. 

Specific measures

• Contact your internet service provider. This has the best means of intervening.
• Analyse the attack and establish a defence strategy: when facing a DDoS attack, the main aim is to show the attackers that they have not achieved their objective. If you withstand the attempt long enough, the attackers will typically turn their attention to someone else.
• Check whether any extortion messages are sent to your publicly known email addresses. Do not under any circumstances pay the ransom. Check the possibility of partially isolating your network from the internet in order to maintain minimal operation.
• Record the attack (netflows, server logs, email correspondence with the blackmailers, etc.). These are important for subsequent analysis and for filing any criminal charges.
• File a criminal complaint with the cantonal police responsible for your company's/your authority's place of domicile.

Preventive measures

• Clarify in advance with your internet service provider what DDoS defence options you have.
• Define processes that can be activated in the event of an attack. This applies in particular for companies/organisations that are absolutely dependent on your website. These should be written down in a manual so that all those responsible have access to them at all times.
• Identify business-critical IT applications that generate a large proportion of turnover (e.g. webshops). Protect these IT applications from possible DDoS attacks.
• Ask your internet service provider whether and what kind of assistance they offer in the event of a DDoS attack. Internet service providers usually offer additional measures to counter DDoS attacks. You can have these activated in the event of an attack being announced.
  

Effects and risks

• Failure of the website or all services that communicate with the internet
• Loss of reputation
• Financial loss, especially if a company/organisation is dependent on an internet platform
  

Further Information

• You will find further information on our website:
  Company: DDoS attack - what next?
  Authority: DDoS attack - what next?

Last modification 23.02.2021