Tag Archives: defend against ddos

Two Arrested in DDoS Attacks Linked to Online Gambling Site Extortion

Last month’s arrest in Bosnia and Herzegovena of two individuals connected to the cyber-crime group DD4BC have been definitely linked to a series of DDoS extortion attacks over the past 18 months, many of which were targeted at online-gambling firms. PokerStars and Betfair are among the various companies to have been targeted by the extortionists, who typically sought modest and largely-anonymous payments made in Bitcoins in exchange for ceasing the attacks. The DD4BC group, an acronym for DDoS (Distributed Denial of Service attack) For BitCoins, is a loosely organized group of online hackers and thieves who have congregated in some of the Internet’s darker, more anonymous holes. The group’s widespread members share information and online weaponry in their attempts to extract payments from their targets. Failure to provide payoffs by the group’s targeted victims typically results in intermittent and ongoing DDoS attacks, designed to flood the victim’s servers with meaningless online traffic, making normal business impossible. The arrests of the two unidentified individuals was announced by Europol earlier this month, with one of the two individuals described as being a leader of the informal DD4BC group. These initial arrests were part of an international operation dubbed Operation Pleaides. According to the Netherlands-based Europol, which is the official intelligence agency of the European Union, “The action was initiated as part of a global law enforcement response against the criminal organisation. Key members of the organised network were identified in Bosnia and Herzegovina by the UK Metropolitan Police Cyber Crime Unit (MPCCU) which provided vital information to the investigation. Police authorities from Australia, France, Japan, Romania, the USA, Switzerland and INTERPOL supported the coordinated activities. “Operation Pleiades resulted in the arrest of a main target and one more suspect detained,” the Europol statement added. “Multiple property searches were carried out and an extensive amount of evidence was seized,” indicating that more arrests of DD4BC members are likely in the coming weeks and months. The actual “Operation Pleiades” action was initiated in Austria and included Europol’s European Cybercrime Centre (EC3) and the Joint Cybercrime Action Taskforce. The operation slowly unwound the ghostly online tracks of the extortionists by examining “blockchain” entries for Bitcoin transactions related to the DDoS threats, plus other data linked to the group’s activities. Bitcoin-based transactions are anonymous but not perfectly transparent, and can often be traced back to their originators using secondary means. The DD4BC attacks, which appear to have started in early 2014, have targeted several different business and government sectors. Victims range from online gambling firms to Bitcoin exchanges and mining groups, to online banking and payment processors. Even some government institutions have been targeted. Online-poker market leader PokerStars was confirmed as one the DD4BC extortion attempts in April 2015, amid information on the DD4BC attacks assembled by Arbor Networks, the security division of NetScout Systems, Inc. Massachusetts-based NetScout appears to have assisted international authorities in identifying the perpetrators behind the hundreds of DD4BC attacks. In addition to PokerStars, Betfair is almost certainly another of the DD4BC group’s victims. Betfair was also targeted last April in a DDoS attack strong enough to knock both its betting exchange and fixed-odds sportsbook offline. The attack on the “unnamed online casino” (likely Betfair) began in earnest on April 10th, following an initial probing attack launched the day before, along with a demand for payment. The information amassed by Arbor Networks also includes many of the threats e-mailed by DD4BC members to their intended victims. Here’s the e-mail that was sent to the “unnamed” casino company (likely Betfair), immediately following attacks against Stars and online payment processor NETeller: From: DD4BC Team [mailto:dd4bct@gmail.com] Sent: 10 April 2015 02:07 PM To Subject: Re: DDOS ATTACK! Hitting pokerstars.com at the moment. Good luck if you think you can stop what they can’t. But you still have time. On Thu, Apr 9, 2015 at 3:46 PM, DD4BC Team wrote: Hello, To introduce ourselves first: https://blogs.akamai.com/2014/12/dd4bc-anatomy-of-a-bitcoin-extortion-campaign.html http://bitcoinbountyhunter.com/bitalo.html http://cointelegraph.com/news/113499/notorious-hacker-group-involved-in-excoin-theft-owner-accusesccedk-of-withholding-info Or just google “DD4BC” and you will find more info. Recently, we were DDoS-ing Neteller. You probably know it already. So, it’s your turn! is going under attack unless you pay 20 Bitcoin. Pay to 18NeYaX6GCnibNkwyuGhGLuU2tYzbxvW7z Please note that it will not be easy to mitigate our attack, because our current UDP flood power is 400-500 Gbps, so don’t even bother. Right now we are running small demonstrative attack on your server. Don’t worry, it will stop in 1 hour. It’s just to prove that we are serious. We are aware that you probably don’t have 20 BTC at the moment, so we are giving you 48 hours to get it and pay us. We do not know your exact location, so it’s hard to recommend any Bitcoin exchanger, so use Google. Current price of 1 BTC is about 250 USD. IMPORTANT: You don’t even have to reply. Just pay 20 BTC to 18NeYaX6GCnibNkwyuGhGLuU2tYzbxvW7z – we will know it’s you and you will never hear from us again. We say it because for big companies it’s usually the problem as they don’t want that there is proof that they cooperated. If you need to contact us, feel free to use some free email service. But if you ignore us, and don’t pay within 48 hours, long term attack will start, price to stop will go to 50 BTC and will keep increasing for every hour of attack. ONE MORE TIME: It’s a one-time payment. Pay and you will not hear from us ever again! Variations on the same extortion letter were sent to several other victims; this sample was distinct with the specific mentions of PokerStars and NETeller. In addition to those two firms and the likely inclusion of Betfair, several other online-gambling companies are known to be targets of the group. Those companies include Nitrogen Sports, Malta-based NRR Entertainment Ltd. (including slottyvegas.com and betatcasino.com), Betbtc.com, Redbet.com and others. It is also likely that last July’s DDoS attacks against several New Jersey (U.S.) online sites were the work of DD4BC extortionists. Though those attacks are not referenced in the ASERT compilation, the July attacks are also outside the date range of most of the earlier attacks included in that report. When the New Jersey attacks occurred, NJ Division of Gaming Enforcement director David Rebuck stated this about the perpetrator: “He’s a known actor. He’s done this before.” While DD4BC seems likely to be peeled open by international invetigators, DDoS-based extortion attempts aren’t going to go away. The reason is that the tools needed to launch such attacks are too cheaply and commonly available to would-be cyber-attackers. As a result, the best defense remain vigilance, rapid response… and robust Internet connectivity. According to Wil van Gemert, Europol’s Deputy Director of Operations, “Law enforcement and its partners have to act now to ensure that the cyberspace affecting nearly every part of our daily life is secure against new threats posed by malicious groups. These groups employ aggressive measures to silence the victims with the threat of public exposure and reputation damage. Without enhanced reporting mechanisms law enforcement is missing vital means to protect companies and users from recurring cyber-attacks. Police actions such as Operation Pleiades highlight the importance of incident reporting and information sharing between law enforcement agencies and the targets of DDoS and extortion attacks.” Source: http://www.flushdraw.net/news/misc/two-arrested-in-ddos-attacks-linked-to-online-gambling-site-extortion/

Excerpt from:
Two Arrested in DDoS Attacks Linked to Online Gambling Site Extortion

World’s Largest DDoS Attack Breaks Records, Clocks At Massive 500 Gbps

In its latest Worldwide Infrastructure Security Report, Arbor Networks reports on the biggest distributed denial of service attack, which had a whopping load of 500 Gbps. The previous largest DDoS attack was of “only” 300 Gbps. It involved young aspiring hacker Seth Nolan-Mcdonagh, who temporarily took down SpamHaus’ webpage. In some cases, the attacks are carried out by state-funded organizations instead of individuals. Last year, GitHub went down after it suffered a DDoS attack, and the main suspect was China, which has a tumultuous history with the software repository. The programming website was even blocked by the Chinese authorities for a short amount of time. The yearly Arbor survey uses data from hosts, mobile service providers and service providers. The survey, which ran until November 2015, got the results based on the 354 global participants who answered questions on network safety specifically about protocols used for reflection/amplification. “The largest attack reported by a respondent this year was 500Gbps, with other respondents reporting attacks of 450Gbps, 425Gbps, and 337Gbps,” the report states. This marks a worrying trend among top-end size DDoS attacks, which get more ambitious every year. The security firm has the numbers to back this statement up. In the previous report, Arbor discovered that one-fifth of respondents got slammed with attacks that topped 50 Gbps. This year’s survey shows a hefty increase, as a quarter of respondents talk of attacks that go more than 100 Gbps. While only five respondents found evidence of DDoS attacks topping 200 Gbps, there were many reports of attacks between 100 and 200 Gbps. Arbor Networks points out that cloud-based services are increasingly becoming tempting targets, as they now make up 33 percent of attacks. Another staple of last year’s hacking attempts is the exploitation of weaknesses in the network time protocol. Reflection and amplification attacks can easily make use of the soft spots in the security infrastructure, leading to significant damages. As a countermeasure, servers keep receiving updates and security patches that should (in theory) keep them safe from attackers who gain a large response to a small query and use it towards a target of their choosing. “[S]ecurity is a human endeavor and there are skilled adversaries on both sides,” Darren Anstee, chief security technologist at Arbor Networks, says. An interesting shift exists in the DDoS attackers’ motivation: the perpetrators no longer seem to find joy in hacktivism or vandalism. Unlike in previous years, extorting the victims and banking on the vulnerabilities of network systems now seem to be the prevalent reasons. In order to accomplish this, they use multi-vector simultaneous attacks which plow through applications, services and infrastructure. A vast majority of respondents identified application-layer DDoS attacks, which targeted DNS services instead of Web servers. Looking at the larger picture, multi-vector attacks counted for 56 percent of customer outages, up from 42 percent in the previous year. More than 50 percent of the respondents told Arbor that DDoS attacks go after the inline firewalls and bring down the internet connectivity. Arbor explains that these devices are the first to fall in case of a DDoS attack and underlines that being inline can greatly add to network latency. Source: http://www.techtimes.com/articles/128260/20160127/worlds-largest-ddos-attack-breaks-records-clocks-at-massive-500-gbps-worldwide-infrastructure-security-report.htm

View article:
World’s Largest DDoS Attack Breaks Records, Clocks At Massive 500 Gbps

Telephonic DoS tied to Ukraine power grid takedown

More information is being revealed regarding the late December attack on the Ukrainian power grid with reports indicating the attack on the utility was supported by a simultaneous telephonic denial of service (DoS)incident. The Ukrainian DoS attack took out the company’s call center so its customers could not call and let workers know that service was being disrupted, according to a published report. A telephonic DoS attack works in the same manner as one hitting a computer system, but in this case a call center is overwhelmed with calls to shut it down. In addition, with the telephone system down the utility company staffers could not communicate effectively to fix the problem. Telephonic DoS attacks can be used to obfuscate any type of attack to attract an IT department’s attention while the real assault takes place against another segment of the network. Source: http://www.scmagazine.com/telephonic-dos-tied-to-ukraine-power-grid-takedown/article/467076/

More:
Telephonic DoS tied to Ukraine power grid takedown

Irish lottery site and ticket machines hit by DDoS attack

Ireland’s National Lottery website and ticket machines were knocked offline after a distributed denial of service (DDoS) attack on Wednesday. Customers trying to buy tickets for the €12m (£9m) draw found themselves unable to do so for nearly two hours. The jackpot was the largest in 18 months. Premier Lotteries Ireland (PLI), the operator, has said the incident is under investigation. During a DDoS attack, a website or online service’s capacity to handle internet traffic is overloaded – usually by automated programs set to flood the site with requests. The attack began at 11:21 GMT on Wednesday and lasted for about two hours. Retail systems were brought back online by 12:45 GMT and the website by 13:25 GMT. “They said you couldn’t buy tickets from the ticket machines, which is really interesting, it’s not just the website – it would be quite interesting to understand why that happened,” said John Graham-Cumming at DDoS-protection company Cloudflare. ‘Under investigation’ “This incident is still under investigation,” a spokeswoman said. “However, we can confirm that at no point was the National Lottery gaming system or player data affected.” Given the large jackpot involved, the lottery was experiencing high demand for tickets on Wednesday lunchtime. The impact of the attack may well have been heightened by this, according to Igal Zeifman, senior digital strategist at cybersecurity company Imperva. “As a rule, record-setting prizes and jackpots result in traffic spikes on lottery sites, and it is very common for DDoS attackers to strike during such predictable peak traffic times, especially when going after big targets,” he said. Source: http://www.bbc.com/news/technology-35373890

See the original post:
Irish lottery site and ticket machines hit by DDoS attack

Data center outages increasingly caused by DDoS

While overall unplanned data center outages have decreased, those that were the result of targeted DDoS attacks have skyrocketed. Think housing your servers in a data center rather than squeezing them under your desk is a bulletproof solution? Well, they might be safer in a data center, but believe it or not, some of the same pitfalls that can create trouble in the office can affect those secure data centers too. Namely UPS failure, human error, and cybercrime. ‘Unplanned’ UPS system failure is still the principal cause of “unplanned data center outages,” according to a new report. A quarter of all such events were related to UPS systems and batteries, according to Emerson Network Power in association with Ponemon Institute. The two organizations have been studying the cost of unplanned data center outages. Cybercrime But cybercrime-caused outages, specifically Distributed Denial of Service (DDoS) attacks, constituted a whopping 22% of the unplanned disruptions last year. That’s up from just 2% in 2010 and 18% in 2013, the last times the two organizations performed the survey. The survey collected responses from 63 data center operations who had observed an outage in the prior about year about what exactly happened. The report was published this month. Root causes Accidental causes or human error were the third biggest cause of unplanned outages, according to the report. Those mishaps caused 22% of the failures. That’s the same percentage as in 2013, but lower than in 2010, when 24% of outages were accidental or human-caused. Interestingly, many other causes of outages are lower now than they were in 2010 and 2013. They’ve been usurped by cybercrime’s huge gain. UPS failure is down slightly on 2010, when it accounted for 29% of the outages. And the aforementioned human error is down a bit. And utility failure, such as water, heat, and Computer Room Air Conditioning, which today makes up just 11% of the outages, was at 15% in 2010. Generators Likewise, generators appear to have become more reliable. Those systems contributed to 10% of the failures in 2010, whereas today they only make up 6%. The researchers don’t provide numbers relating to changing data center design over the period. Fewer generators in use—replaced by solar and alternative energy—could conceivably have caused that statistical decline. The report doesn’t specify. Weather Overall, most unplanned outage causes—including those caused by weather, which accounted for 10% of outages this year, compared to 12% in 2010 and 2013—have declined in favor of cybercrime. Even IT failure, a measly 4% of failures today, dropped from 5% in 2010. About $9K per minute And the cost? The report was released to expound on the cost of the outages, rather than to apportion blame. Well, the “average total cost per minute of an unplanned outage increased from $5,617 in 2010 to $7,908 in 2013 to $8,851 now,” according to the report. Downtime at data centers now costs an average of $740,357. That’s a 38% increase on 2010, the study calculates. And maximum costs are even higher. “Maximum downtime costs are rising faster than average, increasing 81% since 2010 to a current high of $2,409,991,” the report says. Source: http://www.networkworld.com/article/3024773/data-center/data-center-outages-increasingly-caused-by-ddos.html

Lotto ticket machines, website working after DDoS attack

The National Lottery website and ticket machines were targeted by a cyber-attack to disrupt its operations. A DDoS (Distributed Denial of Service) attack floods the communications system with traffic affecting all communications connectivity. “Indications are that this morning’s technical issues were as a result of a DDoS attack affecting our communications networks,” a statement from the Lottery said. “The issues were resolved by the National Lottery’s DDoS protection systems, limiting disruption and restoring all operations within two hours. “This incident is still under investigation. However, we can confirm that at no point was the National Lottery gaming system or player data affected,” the statement added. Tonight’s jackpot is heading for €12 million. RGDATA, the representative association for the independent retail grocery sector, said the National Lottery made it aware of the problem this morning. Last February, the National Lottery was forced to postpone its draw for 24 hours after a technical problem stopped ticket machines working. Source: http://www.rte.ie/news/2016/0120/761563-national-lottery/

DDoS Attack Hits Kickass Torrents, DNS Servers Crippled

Site goes down for most of the day on January 16 Kickass Torrents, the Internet’s biggest torrent portal has suffered downtime yesterday after an unknown attacker has pummeled the site with a DDoS attack. According to a statement given by the site’s administrators to TorrentFreak, a blog dedicated to piracy news, the attack was aimed at the website’s DNS servers. Because of this, both the main domain and the plethora of official site proxies were down as well. The brunt of the attack was registered yesterday, January 16, and had the site taken offline for almost all day. Previously, during the week, the site was also hit by smaller DDoS attacks. Everything seems to be up and running now, but expect future attacks as well. The attack fits the pattern of a DDoS extortion campaign, when small attacks are launched at first, and then a bigger one to force victims into paying the DDoS ransom. Earlier this week, Europol announced the capture of the famed DD4BC DDoS extortion group in Bosnia and Herzegovina. DD4BC is the first group known to launch DDoS attacks and then ask for payments in Bitcoin. The group’s actions have been copied by many other DDoSing outfits, and most DDoS attacks nowadays are launched for this reason. Kickass Torrents is one of Alexa’s top 100 sites on the Internet, meaning it’s an attractive target for DDoSing groups, thanks to its huge advertising revenue. Source: http://news.softpedia.com/news/ddos-attack-hits-kickass-torrents-dns-servers-crippled-499019.shtml

DDoS Defense: Better Traction in Tandem?

DDoS attacks are nothing new, but they remain the nemesis of many IT departments in organizations big and small. Why? Because attacks can come from any source, use multiple protocols, leverage massive botnets and often aren’t detected until it’s too late. According to SecurityWeek, the U.S. Department of Homeland Security (DHS) is now developing a new kind of DDoS defense, one based on collaboration rather than isolation. But can companies really get better security traction in tandem rather than acting alone? Big Numbers, Big Problems As noted by Dark Reading, DDoS attacks “are growing in frequency, size, severity, sophistication and even persistence each year.” Since there’s no single vector for these attacks — coupled with the fact that many look like server or network failures at first glance — it’s no wonder both small companies and large enterprises are getting hit, and hit often. Consider Rutgers University: In 2015, the institution faced six separate DDoS events. Financial institutions and government organizations faced many more, both attempted and successful, because the mechanism for attacks remains simple: Malicious actors need only reliable botnets and solid connections to launch a full-scale effort. The speed and simplicity of DDoS attacks is also encouraging malicious actors to ramp up their efforts. According to BetaNews, for example, the BBC was hit with a massive attack on New Year’s Eve that — if the attackers themselves are telling the truth — reached a maximum of 602 Gbps. That’s almost double the size of the current DDoS record holder at 334 Gbps. The group responsible, called New World Hacking, also targeted Donald Trump’s website and said it had plans to go after ISIS-related sites, although it claimed the BBC attack was merely a test and not intended to bring the site down for hours. Some security pros said the group may be targeting high-profile sites in an effort to promote its in-house DDoS tool, BangStresser. Stopping Traffic With DDoS Defense With DDoS tools and hacking-as-a-service now available for purchase at virtually any Dark Web marketplace and effectively being advertised through public attacks, companies are understandably concerned. Even when caught midstream, it’s difficult to respond before servers start failing and other, more sophisticated attacks take aim at critical corporate data. As a result, dealing with DDoS has become a top priority for organizations like the DHS, which just awarded a $1.7 million contract to tech company Galois in hopes of strengthening DDoS defense. The biggest news from the announcement is the development of a new project called DDoS Defense for a Community of Peers (3DCoP), which uses a peer-to-peer mechanism that allows organizations to work together and collectively defeat DDoS attacks. The thinking here is that since many companies and institutions are often targeted by similar attacks, a coordinated response increases the chance of early detection and swift response, in turn lowering overall damage. Historically, businesses have been reluctant to share attack data or collaborate on defense for fear of giving away trade security secrets or seeming weak in comparison to other companies. The high-volume, high-impact nature of DDoS attacks, however, make this an untenable position; users don’t care about protecting company pride if the result is reduced compute performance or total server failure. If the DHS effort works as intended, however, organizations should be able to collectively tap the power of the combined whole and get better traction on DDoS defense. In other words, a steady security climb instead of spinning wheels. Source: https://securityintelligence.com/news/ddos-defense-better-traction-in-tandem/

Original post:
DDoS Defense: Better Traction in Tandem?

Nissan Takes Down Website on Its Own After Anonymous DDoS Attacks

Nissan has taken down two of its websites after members of the Anonymous hacker collective launched DDoS attacks against the company to protest against Japan’s whale-hunting operations. Anonymous had previously hacked many targets as part of its #OpWhales and #OpKillingBay campaigns, including the government websites in Japan and Iceland, the personal website of Japan’s PM Shinzo Abe, and many other more . While most of the times the group pointed its DDoS cannons towards Japanese officials that had direct involvement in whale and dolphin killing operations, the attack on the Nissan website is a change from the group’s modus operandi. Anonymous takes new approach in #OpWhales Recently, Anonymous hackers started targeting Japanese businesses in order to have them lobby and put pressure on Japanese officials to stop whale hunting. Until now, these have been only smaller companies. Japanese television station NHK said that, during the last few months of 2015, over 100 Japanese firms were hit by DDoS attacks. All changed yesterday, when Anonymous decided to go after Japan’s second largest car manufacturer. The attacks were brutal and scared Nissan’s security staff enough to shut down the nissan.co.jp and nissan-global.com domains to prevent more dangerous intrusions. Nissan admins took down the websites after the DDoS attacks started to amp up “Because of a potential distributed denial of service attack, we are temporarily suspending service on our websites to prevent further risks,” said Nissan representatives in a statement for Agence France-Presse. The hacker that carried out the attack later commented that he didn’t breach the company’s databases and was only interested in sending a message. This message is that, despite signing international conventions to stop whale hunting, Japan is using loopholes to justify its actions as “scientific research.” At the moment of writing this article, both of Nissan’s targeted websites are still offline. Source: http://news.softpedia.com/news/nissan-takes-down-website-on-its-own-after-anonymous-ddos-attack-498862.shtml

See original article:
Nissan Takes Down Website on Its Own After Anonymous DDoS Attacks

A DDoS Learning Curve for Universities, Government & Enterprises

Distributed Denial of Service attacks are easy, cheap and too often, effective. But they’re not unstoppable. There’s no getting around it — DDoS attacks are growing in frequency, size, severity, sophistication, and even persistence each year. These tenacious, effective attacks can last anywhere from hours to months. They can be launched from botnets, use multiple protocols, and even disguise themselves with SSL encryption. Protecting yourself against DDoS isn’t a matter of stopping one attack but a multitude, sometimes all at once. Even worse, IT departments may not realize an attack is underway, thinking a failing server or application is responsible. Rutgers University, for example, recently fell prey to its sixth known DDoS attack in a single year — and Rutgers is not an outlier. Thousands of DDoS attacks hit universities, enterprises, government organizations, and banks every day—some successful, some not. One thing is for sure: no one is safe, and attacks will continue because DDoS attacks are easy, cheap and, too often, effective. But they’re not unstoppable. Universities and other organizations can take steps to prepare for and minimize the effect of even the most sophisticated assaults: Step 1. Have a good monitoring system in place Security teams have many ways to get insight into their network, including flow sampling, in-path detection and mirrored data packets. Here’s a brief breakdown of the pluses and minuses: Flow sampling: The router samples packets and exports datagrams on them. While scalable, this method leaves out large quantities of information because it only samples one packet out of thousands. This allows some “slow and low” attacks to fly under the detection radar, or take a long time to trigger an alert. In-path detection: A high-performance DDoS mitigation device continuously processes all incoming traffic and possibly outgoing traffic. The device can take immediate action with sub-second mitigation times. One concern is ensuring the mitigation solution can scale with the uplink capacity during multi-vector attacks. Mirrored data packets: Full detail for analysis is provided, while not necessarily in the path of traffic. This method can be a challenge to set up, but allows for fast detection of anomalies in traffic and is a centralized place for analysis and mitigation. Step 2. Keep an eye on performance metrics and scalability When it comes to DDoS, everything happens on a large scale: the number of attacking computers, the bandwidth they consume and the connections they generate. To fight back, organizations need a combination of high-performance, purpose-built hardware that can mitigate common, yet large-scale attacks effectively, and intelligent software that can inspect traffic at the highest packet rates. For instance, an effective combination might include leveraging dedicated network traffic processors (e.g. FPGAs) to handle the common network-layer attack in combination with powerful, multi-core CPUs to mitigate more complex application-layer attacks. What’s key here is to ensure there is enough processing headroom to prepare networks for future generations of DDoS attacks. Step 3. Invest in a security awareness program Mitigation of next-generation DDoS attacks starts with training — especially to recognize normal network behavior and spot anomalies. For instance, companies that have started their migration to IPv6 must have security specialists in place that know IPv6 well enough to recognize attacks when they happen, and then to know how to use available tools to properly fight them off. Proper training allows organizations to be proactive versus reactive. Security policies take time to devise, so universities and other organizations shouldn’t wait for the IT support staff to raise a red flag before they decide to take action. Source: http://www.darkreading.com/attacks-breaches/a-ddos-learning-curve-for-universities-government-and-enterprises-/a/d-id/1323879

Continue Reading:
A DDoS Learning Curve for Universities, Government & Enterprises