Largest DDoS attacks 50x bigger than a decade ago – report

A report has revealed the size of the largest DDoS (distributed denial-of-service) attacks has increased by 50 times in the last decade. The Worldwide Infrastructure Security Report (WISR) by Arbor Networks also showed the number of DDoS attacks targeting mobile users increased 11% in 2014 alone.

The annual report, now in its 10th year, included information on security threats and how they are being dealt with from both service providers and enterprises. It claimed DDoS attacks now form a very serious threat to businesses, with the largest such attack in 2014 400Gbps. According to the report the largest DDoS attack a decade ago was only 8Gbps.

The report also showed 90% of respondents admitted having experienced application-layer attacks last year, and 42% of those had attacks that combined volumetric, application-layer and state exhaustion techniques in one attack. 42% said they experienced more than 21 attacks a month, representing a 38% increase from 2013.

“In 2004, the corporate world was on watch for self-propagating worms like Slammer and Blaster that devastated networks the year before; and, data breaches were most likely carried out by employees who had direct access to data files,” Darren Anstee (pictured), Networks Director of Solutions Architects at Arbor told Telecoms.com.

“Today, organizations have a much wider and more sophisticated range of threats to worry about, and a much broader attack surface to defend. The business impact of a successful attack or breach can be devastating – the stakes are much higher now. “

Although Anstee said most of the survey respondents are quite vigorous in their attempts to mitigate security threats, service providers can see outbound attacks as less of a business risk. But Anstee said it is important to take both inbound and outbound network attacks seriously.

“A lot of organisations can be fairly focused on protecting their infrastructure and their customers because that’s what they see themselves being paid for. If you think there’s a DDoS attack coming into your network and it’s going to hit a service that you’re providing to your customers, your customers are going to complain and therefore you are going to protect that service. If the attack is targeting your customers and they are paying for you to protect them, they are going to complain [if they suffer an attack]. Therefore you’re going to protect them.

“If the attack is going out of your network, though, and it’s not having any material impact on your ability to deliver that service, in a lot of cases people do kind of prioritise that lower. But what you got to realise is that those attacks can still have an impact. They still consume bandwidth, they still cause network congestion. Ideally those threats would be dealt with by using the same solutions that are used to combat the inbound ones but operationally it’s not that common.”

Anstee said each year the WISR, which is freely available to download, highlights the biggest trends of the past and up-coming year. “The whole idea behind the report is to provide a kind of a prefatory of information from the operational security community. It gives the ability to share what they’re doing to address threats. It also gives other people confirmation of what they’re seeing on their network isn’t unique, that other people are seeing exactly the same thing.”

Looking ahead for this year, Anstee said the amount and size of DDoS attacks are not showing any signs of decreasing. “Part of the reason why I think this problem will continue is that the population of devices [that can be attacked] is not getting any smaller.”

Also, despite the fact that  over half of the report’s respondents saw an increase in security incidents on their corporate network last year, However, just under half said they are “at least reasonably” (as the report put it) prepared to deal with attacks. According to Arbor, one of the problems is that organisations are finding it difficult to employ and retain skilled security experts to deal with threats.