Category Archives: DDoS Criminals

Bitter feud between partners as IBM deflects eCensus blame

NextGen, Vocus refute claims of error. A bitter feud has broken out between IBM and its internet service provider partners for the 2016 eCensus as the main contractor tried to deflect blame for the site’s meltdown on August 9 In its first detailed response to the failure, IBM said it had plans in place for the risk of DDoS attacks, but its efforts were to no avail thanks to a failure at an upstream provider. The ABS at the time said it had been forced to take the site offline on Census night following a series of DDoS attacks combined with the failure of the network geoblocking function and the collapse of a router. The statistics body has publicly criticised IBM for failing to properly implement a geoblocking service, which would have halted the international DDoS attack targeted at the Census site. But IBM is now laying blame squarely at the feet of its internet service provider partner NextGen and NextGen’s upstream supplier Vocus for the geoblocking bungle. It claimed NextGen had provided “repeated” assurances – including after the day’s third DDoS attack – that a geoblocking strategy that IBM codenamed ‘Island Australia’ had been correctly put in place. However, when the fourth and biggest DDoS attack of the day hit at around 7:30pm, IBM said it became clear that a Singapore link operated by Vocus had not been closed off, allowing the attack traffic to pass through to the Census site. “Vocus admitted the error in a teleconference with IBM, NextGen and Telstra around 11.00 pm on 9 August 2016,” IBM said. “Had NextGen (and through it Vocus) properly implemented Island Australia, it would have been effective to prevent this DDoS attack and the effects it had on the eCensus site. As a result, the eCensus site would not have become unavailable to the public during the peak period on 9 August 2016.” IBM said while it accepted its responsibility as the head contractor for the eCensus, it could not have avoided using ISPs to provide links for the website. “It is not possible for an IT services company such as IBM to implement the 2016 eCensus without engaging ISPs. It was necessary for IBM to involve the ISPs in the implementation of the geoblocking solution as they have control over their respective data networks and are in a position to block internet traffic originating from particular domains or IP addresses.” IBM did, however, admit what many security experts speculated had occured – that following the fourth DDoS a system monitoring dashboard showed an apparent spike in outbound traffic, causing its staff to wrongly assume data was being exfiltrated from the website, prompting IBM to shut down the website. The contractor also revealed that a configuration error meant a manual reboot of one of its routers – which was needed after the eCensus firewall became overloaded with traffic – took much longer to rectify than it should have, keeping the site offline for a further hour and a half. NextGen, Vocus fight back But Vocus said NextGen was well aware that Vocus would not provide geoblocking services, and had instead recommended its own DDoS protection. IBM declined the offer, Vocus said. NextGen and Vocus instead agreed on remote triggered black hole (RTBH) route advertisements with international carriers. “If Vocus DDoS protection product was left in place the eCensus website would have been appropriately shielded from DDoS attacks,” Vocus said in its submission to the inquiry. Vocus refuted IBM’s claim that it had failed to implement geoblocking, revealing that it had not been made aware of IBM’s DDoS mitigation strategy – including ‘Island Australia’ – until after the fourth attack on August 9. “As a result, any assumption that Vocus was required to, or had implemented Island Australia or geo-blocking including, without limitation … are inaccurate,” Vocus said. “Once Vocus was made aware of the fourth DDoS attack, it implemented a static null route to block additional DDoS traffic at its international border routers within 15 minutes.” Vocus also argued that the fourth DDoS was not as large as IBM claimed, comprising of attack traffic that peaked at 563Mbps and lasting only 14 minutes – which it said was “not considered significant in the industry”. “Such attacks would not usually bring down the Census website which should have had relevant preparations in place to enable it to cater for the expected traffic from users as well as high likelihood of DDoS attacks.” NextGen, in its own submission, claimed it had “strongly recommended” to IBM that it take up a DDoS protection product like that on offer by Vocus, but the contractor declined. The ISP said it was not made aware of details of IBM’s ‘Island Australia’ strategy until six days before the eCensus went live in late July. At that point it told IBM that an IP address range it had provided was part of a larger aggregate network and therefore would not respond to “specific international routing restrictions” if ‘Island Australia’ was implemented. “Nextgen recommended using an alternative IP address range, which would give IBM better control, but this was rejected by IBM,” the ISP said. IBM instead chose to request NextGen’s upstream suppliers apply IP address blocking filters and international remote black holes for 20 host routes. “Nextgen believes that the individual host routes picked by IBM may not be exhaustive, and DDoS attacks could come from other routes in the IP address range (which they did in the third DDoS attack on Census day),” NextGen said. “There were a number of routes without geoblocking during the fourth DDoS attack, and which were not identified during testing, along with the [Vocus] Singapore link.” NextGen said it again offered to implement DDoS protection, this time at its own cost, which IBM agreed to four days after the events of August 9. Source: http://www.itnews.com.au/news/bitter-feud-between-partners-as-ibm-deflects-ecensus-blame-439752

Continue reading here:
Bitter feud between partners as IBM deflects eCensus blame

Leaked Mirai source code already being tested in wild, analysis suggests

Since the source code to the Mirai Internet of Things botnet was publicly leaked on Sept. 30, researchers at Imperva have uncovered evidence of several low-level distributed denial of serviceattacks likely perpetrated by new users testing out this suddenly accessible DDoS tool. With its unusual ability to bombard targets with traffic in the form of generic routing encapsulation (GRE) data packets, Mirai was leveraged last month to launch a massive DDoS attack against Internet security researcher Brian Krebs’ blog site KrebsonSecurity. Soon after, a Hackforums user with the nickname Anna-senpai publicly posted the botnet’s source code – quite possibly a move by the malware’s original author to impede investigators from closing in on him. In a blog post this week, Imperva reported several low-level DDoS attacks taking place in the days following the leak. Consisting of low-volume application layer HTTP floods leveraging small numbers of source IPs, these attacks “looked like the experimental first steps of new Mirai users who were testing the water after the malware became widely available,” the blog post read. But Imperva also found evidence of much stronger Mirai attacks on its network prior to the leak. On Aug. 17, Imperva mitigated numerous GRE traffic surges that peaked at 280 Gbps and 130 million packets per second. Traffic from this attack originated from nearly 50,000 unique IPs in 164 countries, many of which were linked to Internet-enabled CCTV cameras, DVRs and routers – all infected by Mirai, which continuously scans the web for vulnerable devices that use default or hard-coded usernames and passwords. An Imperva analysis of the source code revealed several unique traits, including a hardcoded blacklist of IPs that the adversary did not want to attack, perhaps in order to keep a low profile. Some of these IPs belonged to the Department of Defense, the U.S. Postal Service and General Electric. Ben Herzberg, security group research manager with Imperva Incapsula, told SCMagazine.com in a phone interview that the Marai’s author may have truncated the complete blacklist before publishing it – possibly because such information could offer a clue as to the attacker’s identity. Imperva also found Mirai to be territorial in nature, using killer scripts to eliminate other worms, trojans and botnet programs that may have infiltrated the same IoT devices. Moreover, the company noted traces of Russian-language strings, which could offer a clue to the malware’s origin. Herzberg said it’s only a matter of time before Mirai’s newest users make their own modifications. “People will start playing with the code and say, ‘Hey, let’s modify this, change this,” said Herzberg. “They have a nice base to start with.” Web performance and security company Cloudflare also strongly suspects it has encountered multiple Mirai DDoS attacks, including one HTTP-based attack that peaked at 1.75 million requests per second. According to a company blog post, the assault leveraged a botnet composed of over 52,000 unique IP addresses, which bombarded the Cloudflare network – primarily its Hong Kong and Prague data centers – with a flurry of short HTTP requests designed to use up server resources and take down web applications. A second HTTP-based attack launched from close to 129,000 unique IP addresses generated fewer requests per second, but consumed up to 360Gbps of inbound HTTP traffic – an unusually high number for this brand of attack. In this instance, much of the malicious traffic was concentrated in Frankfurt. Cloudflare concluded that the attacks were launched from compromised IoT devices, including a high concentration of connected CCTV cameras running on Vietnamese networks and multiple unidentified devices operating in Ukraine. “Although the most recent attacks have mostly involved Internet-connected cameras, there’s no reason to think that they are likely the only source of future DDoS attacks,” the Imperva report warns. “As more and more devices (fridges, fitness trackers, sleep monitors…) are added to the Internet they’ll likely be unwilling participants in future attacks.” Of course, compromised IoT devices can be used for more than just DDoS attacks. Today, Akamai Technologies released a white paper warning of a new in-the-wild exploit called SSHowDowN that capitalizes on a 12-year-old IoT vulnerability. According to Akamai, cybercriminals are remotely converting millions of IoT devices into proxies that route malicious traffic to targeted websites in order to check stolen log-in credentials against them and determine where they can be used. Bad actors can also use the same exploit to check websites for SQL injection vulnerabilities, and can even launch attacks against the internal network hosting the Internet-connected device. The vulnerability, officially designated as CVE-2004-1653, affects poorly configured devices that use default passwords, including video surveillance equipment, satellite antenna equipment, networking devices and Network Attached Storage devices. It allows a remote user to create an authorized Socket Shell (SSH) tunnel and use it as a SOCKS proxy, even if the device is supposedly hardened against SSH connections. “What we’re trying to do is raise awareness,” especially among IoT vendors said Ryan Barnett, principal security research at Akamai, in an interview with SCMagazine.com. Barnett noted that when the CVE first came out, an exploit on it was “more theoretical,” but now “we want to show it is actively being used in a massive attack campaign.” Source: http://www.scmagazine.com/leaked-mirai-source-code-already-being-tested-in-wild-analysis-suggests/article/547313/

More:
Leaked Mirai source code already being tested in wild, analysis suggests

A Decade of DDoS Education: What’s Changed and What’s Stayed the Same

While Distributed Denial of Service (DDoS) attacks have been around for over 20 years, they have only become well-known to the majority of enterprises over the past ten years or so. Ten years ago, many enterprise IT teams only had a vague idea of what a DDoS attack was because they noticed the common symptoms “our website is down,” “the firewall crashed,” “nothing works” etc. The average IT team in 2006 would not have been aware of the techniques DDoS attacks typically used like spoofed addresses or POST floods. In order to provide a true understanding of what DDoS attacks were and how enterprises could defend against them, some basic education had to happen. In 2006 that meant putting it in terms that everyone understood, “what would happen to our meeting if we tried fitting 100 people in this room?” Eventually as education continued and attacks grew in notoriety, the basics of DDoS became common knowledge in the industry. But DDoS in its nature is an evolving threat and as application-layer attacks became predominant more education was needed. Application-layer attacks are not about blocking access to the door of the meeting room anymore, now we had to explain the stealthy nature of low-volume, targeted attacks. “So you’ve let two of us in this meeting room because we appear to be legitimate salespeople, but now we’re going to unplug the projector so you can’t run your meeting properly.” Now ten years later, the majority of enterprise IT teams have a solid understanding of the threat DDoS poses and the basics of defense but even today we still come across people who believe they can protect themselves against DDoS attacks by simply increasing their bandwidth or relying on their firewalls or unified threat management appliances. With the volume of attacks today that is definitely not enough to ensure service and network availability in the face of sustained DDoS attacks. The majority of DDoS education today has shifted from learning about the attack methods themselves to the correct defense techniques and processes. Even with the significant improvements in DDoS education and awareness, a lot of people still have unrealistic expectations that once they install a DDoS mitigation solution their job is done. There is no silver bullet against DDoS attacks. There is no magic box, there is no “set it and forget it” solution. You still have to educate the user. Part of this comes from the misconception that DDoS attacks are launched by untalented kids. While that is true in some cases, many enterprise IT teams are surprised to find themselves often fighting against talented opponents who are often smarter than them, have more time than them and whose effort to start attacks is minuscule compared to their effort in blocking them. Often times, when faced with these advanced adversaries, IT teams are quickly overwhelmed. Even though they have some mitigation tools in place, they may not have the  right  tools. They may not know who to call or recognize the type of attack targeting their systems. In short, they don’t have a technology problem, they have a people and process problem. Think of DDoS defense like a NASCAR race, you have a super-powerful car (your DDoS mitigation solution or service), but if you don’t know how to drive over 70 mph, you’re going to crash and hurt yourself very quickly. And let’s not even mention what happens if you decided to install that cheap transmission because it was half-off. Enterprise IT teams need to focus on building the best car they can, hiring a skilled team that can keep the car in its best possible condition and then hiring the best driver they can afford to drive the car when the time comes. Even if you have the best car in the world, an unskilled maintenance team or driver will lead to a third or fourth place finish at the end of the season. But if you want to win the championship, you need the best car, mechanics and driver you can afford. Moving on from the NASCAR analogy, this means: Understanding the technology that best fits your needs: on-premise, always-on, protection or an on-demand service? Customizing that technology to fit your assets. Is it just your website or the services you provide from it? What about defending your corporate network? Identifying and training a team that is capable of understanding all of the procedures in all possible scenarios that surround a DDoS attack. Continue evolving your mitigation strategy. Keep your technology state-of-the-art and provide continuous training for your team. If you follow these steps you’ll end up in the winner’s circle after mitigating another DDoS attack and not in pit row trying to figure out what went wrong. Source: http://wwpi.com/2016/10/12/a-decade-of-ddos-education-whats-changed-and-whats-stayed-the-same/

Visit link:
A Decade of DDoS Education: What’s Changed and What’s Stayed the Same

130,000 Avtech IP cameras, DVRs can be easily roped into IoT botnets

Security researcher Gergely Eberhardt has unearthed over dozen of vulnerabilities in most IP cameras, NVRs and DVRs by Taiwanese manufacturer Avtech, including things like plaintext storage of administrative password and authentication bypass flaws. Eberhardt, who works for Hungarian security testing outfit Search Lab, says a final tally would likely be even higher, as these vulnerabilities were found within a short period of time and the research was done without a systematic approach. According to the … More ?

View article:
130,000 Avtech IP cameras, DVRs can be easily roped into IoT botnets

How the ‘Internet of unpatchable things’ leads to DDoS attacks

For at least the past year there have been repeated warning to makers of Internet-connected devices about the insecurity of their platforms. Another came today in a report from Akamai Technologies’ threat research team, which has delved into a recent burst of distributed attacks leveraging IoT devices. In this case they are SSHowDowN Proxy attacks using a 12-year old vulnerability in OpenSSH. “We’re entering a very interesting time when it comes to DDoS and other web attacks — ‘The Internet of Unpatchable Things’ so to speak,” Eric Kobrin, Akamai’s director of information security, said in a statement. “New devices are being shipped from the factory not only with this vulnerability exposed, but also without any effective way to fix it. We’ve been hearing for years that it was theoretically possible for IoT devices to attack. That, unfortunately, has now become the reality.” Akamai emphasizes this isn’t a new vulnerability or attack technique. But it does show a continued weakness in many default configurations of Internet-connected devices. These particular attacks have leveraged video surveillance cameras and digital recorders, satellite antenna equipment, networking devices (including routers, switches, Wi-Fi hotspots and modems) and Internet-connected network attached storage. They are being used to mount attacks on any Internet targets as well as internal networks that host connected devices. Unauthorized SSH tunnels were created and used, despite the fact that the IoT devices were supposedly hardened and do not allow the default web interface user to SSH into the device and execute commands, Akamai said. Then attackers used to conduct a mass-scale HTTP-based credential stuffing campaigns against Akamai customers. It offers this mitigation advice to infosec pros: –if possible configure the SSH passwords or keys on devices and change those to passwords or keys that are different from the vendor defaults; –configure the device’s SSH service on your device and either add “AllowTcpForwarding No” and “no-port-forwarding” and “no-X11-forwarding” to the ~/ssh/authorized_ keys file for all users, or disable SSH entirely via the device’s administration console; –if the device is behind a firewall, consider disabling inbound connections from outside the network to port 22 of any deployed IoT devices, or disabling outbound connections from IoT devices except to the minimal set of ports and IP addresses required for their operation. Source: http://www.itworldcanada.com/article/how-the-internet-of-unpatchable-things-leads-to-ddos-attacks/387275

Originally posted here:
How the ‘Internet of unpatchable things’ leads to DDoS attacks

Hungarian bug-hunters spot 130,000 vulnerable Avtech vid systems on Shodan

SOHOpeless CCTVs and video recorders It shouldn’t surprise anyone that closed circuit television (CCTV) rigs are becoming the world’s favourite botnet hosts: pretty much any time a security researcher looks at a camera, it turns out to be a buggy mess.…

Taken from:
Hungarian bug-hunters spot 130,000 vulnerable Avtech vid systems on Shodan

Singapore rolls out high-level cyber security strategy

The Government is taking decisive steps to tackle cyber threats – including almost doubling the proportion of its technology budget dedicated to plugging security gaps in critical infrastructure. The matter, said Prime Minister Lee Hsien Loong yesterday, is one of “national importance” as the country becomes more connected in its mission to become a smart nation. At the opening of the inaugural Singapore International Cyber Week, he announced a high-level national strategy that includes strengthening international partnerships. One key prong will be to direct more funds into defence against attacks. These have ranged from malware infection to the defacing of government websites. About 8 per cent of the infocomm technology (ICT) budget will now be set aside for cyber security spending, up from about 5 per cent before. In fiscal 2014, Singapore spent $408.6 million on cyber security. The new proportion is similar to what other countries spend; Israel stipulates that 8 per cent of its total government IT budget must go to cyber security, while South Korea channels as much as 10 per cent. “We are investing more to strengthen government systems and networks, especially those that handle sensitive data, and protect them from cyber attacks,” said Mr Lee. “Singapore aspires to be a smart nation. But to be one, we must also be a safe nation,” he told more than 3,000 public servants and technology professionals from 30 countries who were also attending the 25th GovernmentWare Conference. Singapore’s cyber security strategy is developed by the Cyber Security Agency (CSA). Central to the strategy is the introduction of a new Cybersecurity Act in the middle of next year after public consultations, expected to be held after the draft legislation is tabled in Parliament next year. There is currently no over-arching cyber security legislation in Singapore. The current system of working with various sector regulators is “patchy”, said CSA chief executive David Koh, as the requirement to tighten gaps in critical infrastructure has not been worked into licensing conditions in some sectors. Mr Lee said that, while ICT creates business opportunities and boosts productivity, it also makes its users vulnerable. Globally, cyber threats and attacks are becoming more frequent and sophisticated, with more severe consequences, he added. Last December, a successful attack on the power grid in Ukraine left many Ukrainians without electricity for hours. This year, thieves siphoned US$81 million (S$111.3 million) from the Bangladesh Bank, the central bank of Bangladesh, in a sophisticated cyber heist. Singapore has not been spared. “Our government networks are regularly probed and attacked,” said Mr Lee, adding that attacks included “phishing” attempts and malware infection. “From time to time, government systems have been compromised; websites have been defaced. We also suffered concerted DDOS (distributed denial of service) attacks that sought to bring our systems down,” he said. The financial sector, for instance, has suffered DDOS attacks and leaks of data. Individuals, too, have become victims of scams. Fake websites of the Singapore Police Force, Manpower Ministry, Central Provident Fund Board, and the Immigration and Checkpoints Authority have been set up overseas to “phish” for personal information or trick people into sending money. Mr Lee said the country must get cyber security right. “Only then can IT deliver innovation, growth and prosperity for our businesses and citizens.” Source: http://www.straitstimes.com/singapore/spore-rolls-out-high-level-cyber-security-strategy

Visit site:
Singapore rolls out high-level cyber security strategy

73% of organisations across the globe have suffered a DDoS attack

A new report from analytics firm Neustar has brought to light the amount of companies around the world who have suffered a DDoS attack, and how they are working to mitigate them. Nearly three-quarters (73 percent) of organisations worldwide have suffered a DDoS attack and 76 percent are investing more in response to the threat of such attacks.  For its new global report, Neustar studied 1,002 directors, managers, CISOs, CSOs, CTOs and other C-suite executives to discover how DDoS attacks are affecting them and what they’re doing to mitigate the threat. Respondents represent diverse industries such as technology (18 percent), finance (14 percent), retail (12 percent) and government (seven percent) in North America, EMEA, and Asia Pacific. In EMEA, 75 percent of organisations were attacked. Nearly half (48 percent) were attacked six or more time and 32 percent encountered malware after a DDoS attack. Almost a quarter (21 percent) of attacked organisations reported customer data theft and 70 percent of those specific respondents said they learned of the attack from outside sources, such as social media. Globally, 30 percent of organisations took less than an hour to detect a DDoS attacks. In  EMEA, 37 percent of organisations took three or more hours to detect attacks. Despite only two percent of reported attacks exceeding 100+ GBPS, recent DDoS attacks have reached over 620 Gbps and up to almost 1 Tbps in attack size. Organisations are seeking to stay one step ahead of the game and protect against DDoS attacks. To prevent and protect against future attacks, organisations are using: Traditional firewall ISP based prevention (53 percent) Cloud service provider (47 percent) On-premise DDoS appliance and a DDoS mitigation service (36 percent) DDoS mitigation service (29 percent) DDoS mitigation appliance (27 percent) CDN (14 percent) WAF (13 percent) No DDoS protection is used in four percent of organisations. Nearly two-thirds (61 percent) have adopted and actively use IoT devices. In all, 82 percent of IoT adopters experienced an attack compared to just 58 percent of those who have not yet done so. Moreover, 43 percent of IoT adopters that were attacked are investing more than they did a year ago. In emailed commentary to  SCMagazineUK .com, Paul McEvatt, senior cyber-threat intelligence manager, UK & Ireland at Fujitsu said, “This latest report revealing the different levels of DDoS attacks has really highlighted the issues with the security of Internet of Things devices, with 82 percent of IoT adopters having experienced an attack compared with just 58 percent of those who have not yet done so. When internet-connected devices are hacked, it again brings to the surface the security risks we face as technology touches every aspect of daily life.  McEvatt added, “The issue is that businesses are failing to understand what is needed for a robust application of security from the outset, whether that’s for routers, smart devices or connected cars. Various attackers use online services to look for vulnerable IoT devices, making organisations an easy target for low-level cyber-criminals. The worrying reality is that security is often an afterthought and security fundamentals are still not being followed such as changing default passwords. Many of the cameras used in the recent DDoS attacks were shipped and left connected to the internet with weak credentials such as root/pass, root/admin or root/1111111, so it is little wonder these devices continue to be compromised.” Source: http://www.scmagazineuk.com/73-of-organisations-across-the-globe-have-suffered-a-ddos-attack/article/527211/

More:
73% of organisations across the globe have suffered a DDoS attack

Worry more about small app layer DDoS attacks than huge network blasts, says Canadian vendor

Massive distributed denial of service (DDoS) attacks have been grabbing headlines recently, with cyber security reporter Brian Krebbs being forced to temporarily take his site down after his service provider couldn’t handle a 620 Gbps attack, followed a few days later by a 1 Tbps attack on French hosting provider OVH. The incidents have some worried that DDoS attacks can now scale so high that current mitigation technology renders targeted organizations defenceless. Not so, says a Toronto security firm. In a report issued Tuesday DDoS Strike concludes CISOs worry too much about high volume network layer attacks and not enough about application layer attacks, which can take down a site with as little as 4.3 Gpbs of traffic. “Most organizations are only part way to understanding DDoS attacks and therefore having the capacity to defend against them with full effectiveness,” the report concludes. The report is based on an analysis of data gathered by DDoS Strike, which offers a service for testing enterprise infrastructures on their layer 3-7 denial of service mitigation techniques. DDoS Strike is a division of Security Compass, which makes application development security tools. What the company found after looking at its data from test attacks on 21 systems of Canadian and U.S.-based customers (some companies had more than one system) was that 95 per cent of targets tested suffered service degradation close to knocking a site offline — suggesting their DDoS mitigation efforts were useless. Of attacks at the application layer 75 per cent would have been successful. But, Sahba Kazerooni, vice-president DDoS Strike, said in an interview, network scrubbing techniques are largely effective. with service generally being denied only for a few hours until mitigation can either be tuned or turned on. More importantly, he added, is that application layer attacks are harder to defend, needing multiple tiers of defence, more expertise among IT staff trying to block them and fine controls. The result is more downtime for a successful app layer attack. “Our customers have a skewed way of looking at DdoS as a threat,” he said, “because they were being warned by the industry to worry about major ( network) attacks “and they’re forgetting about high level attacks on the app layer.” “We have this tendency to over-focus on technology when it comes to DDoS. We’re very quick to deploy on-site mitigation devices or to buy a scrubbing service. The piece that’s missing is to focus on the process and the training of staff to handle DDoS attacks.” Some of the customers tested brought their systems back from the brink in an average of 25 minutes, he said. (DDoS Strikes thinks that’s too long.) But of the successful test attacks his company carried out, over 70 per cent had some kind of process or people gap that resulted in longer than necessary downtime, he said. “A lot of companies can benefit not only from buying services and product but also training their employees,” Kazerooni concludes focusing more on their own processes with the goal of ultimately reducing downtime.” The report concludes that • businesses should stop thinking of DDoS attacks as crude acts of brute force, and start thinking of them as sophisticated, incisive attacks as complex as any other major hacking threat; • DDoS mitigation is incomplete out of the box, and can only be effective with proper DDoS simulation testing at all levels; • and DDoS mitigation should be viewed as a multifaceted strategy, involving people, process, and technology, rather than solely a technical fix. Source: http://www.itworldcanada.com/article/worry-more-about-small-app-layer-ddos-attacks-than-huge-network-blasts-says-canadian-vendor/386956

Link:
Worry more about small app layer DDoS attacks than huge network blasts, says Canadian vendor