Please note that this is a page from a previous version of Continuity Central and is no longer being updated.

To see the latest business continuity news, jobs and information click here.

Business continuity information

Maintaining availability: the importance of DDoS defences in business continuity planning

By Rakesh Shah, Arbor Networks.

High-profile and often brazen DDoS attacks continue to make headlines – both in the UK and overseas as cyber-attackers are finding new and stealthy ways of launching attacks – and maintaining those attacks for lengthy periods of time without detection. These attacks are lethal today because they often target the availability of computing and network resources. If a DDoS attack against a Web server, DNS server, email server, application server or other online property is successful, the availability of the target is negatively impacted.

The motivation and primary drivers of attack continue to evolve as well – moving well behind the attention-seeking motivation of attackers in years’ past. Attackers today are motivated by hactivism and ideology, using a site takedown as an electronic means of making a statement or taking a stance. Yet, despite all of this change and evolution on the part of hackers all over the world, those that are under attack are not nearly as prepared for cyber-attacks as they could or should be. Our recently released eighth annual Worldwide Infrastructure Security Report highlights this very point pretty clearly: Just over half (51 percent) of network operators we surveyed don’t regularly perform preparedness drills for cyber-attacks.

This speaks to a much broader issue, actually – the idea of wrapping DDoS mitigation tactics and strategies into overall business continuity and risk management plans. The evolution we’re seeing in the threat landscape has become the driving force for more enterprises to formalize IT security, placing it firmly within the context of enterprise risk management and business continuity planning.

Current financial realities require that companies incorporate IT security into their operational and financial planning to control escalating costs. At the same time, they must provide adequate resources to address their financially, regulatory and reputation-driven security priorities and incorporate all pertinent risk factors into their organizational security model. The abstract nature of risk management and business continuity planning can often make these processes daunting to planners and IT security professionals alike. In most cases, business continuity plans include detailed policies and procedures for keeping operations running in the wake of natural disasters such as fire, floods and earthquakes. But rarely do they incorporate contingencies for IT security incidents.

This is a major oversight.

Security incidents often have a negative impact on business operations—resulting in significant operational expenditure (opex) costs, lost revenues, customer satisfaction challenges and erosion in brand reputation. As a result, IT security issues constitute significant business risks, which place them squarely within the realm of business continuity planning. The most important aspect of enterprise security —availability — is the most easily understood and quantifiable aspect of security today.

Actionable security practices are critical to business continuity planning, yet many business continuity plans do not include this element. Availability protection is the most important IT security practice to implement—and also the most quantifiable and actionable. It is relatively easy to calculate the cost of downtime for e-commerce sites, customer support applications, content delivery systems, brick-and-mortar online reference sites, etc. Much of this information may already be available from, often siloed, high-availability studies/efforts related to existing business continuity planning efforts.

Security threats, especially threats to availability, are external events that can have a negative impact in terms of financial, legal, regulatory, and/or brand reputation. As a result, organizations should incorporate security threats into enterprise risk management considerations, which form the basis for business continuity planning. In essence, DDoS attacks are ‘external events’ (as defined in Basel II); they can be thought of as man-made disasters.

The threat to availability represented by DDoS attacks cannot be overstated. No business continuity plan is complete without taking into account the need to maintain the availability of critical online properties, even in the face of a concerted attack. Companies can successfully detect, classify and mitigate DDoS attacks with appropriate operational best practices and dedicated anti-DDoS solutions. Given today’s threat landscape, network operators simply cannot afford to disregard DDoS attacks as part of their business continuity and risk management planning. The risk is too severe.

Author: Rakesh Shah, Senior Director of Strategy at Arbor Networks.

•Date: 21st June 2013 • UK/World •Type: Article • Topic: ISM

Business Continuity Newsletter Sign up for Continuity Briefing, our weekly roundup of business continuity news. For news as it happens, subscribe to Continuity Central on Twitter.

How to advertise How to advertise on Continuity Central.

To submit news stories to Continuity Central, e-mail the editor.

Want an RSS newsfeed for your website? Click here