{"id":1993,"date":"2018-11-13T00:00:00","date_gmt":"2018-11-13T00:00:00","guid":{"rendered":"https:\/\/azure.microsoft.com\/blog\/holiday-season-is-ddos-season"},"modified":"2023-05-11T15:36:03","modified_gmt":"2023-05-11T22:36:03","slug":"holiday-season-is-ddos-season","status":"publish","type":"post","link":"https:\/\/azure.microsoft.com\/en-us\/blog\/holiday-season-is-ddos-season\/","title":{"rendered":"Holiday season is DDoS season"},"content":{"rendered":"

Is your business ready for the holiday season?<\/em><\/p>\n

As we approach the holiday season and bring in thoughts of good cheers, many companies are faced with an elevated risk of cyber-attacks. What makes the holidays such an enticing time for hackers is the combination of an increase in traffic volume due to an uptick in eCommerce that helps disguise hackers from detection, and reduced staff. All of which makes this time of year too attractive for cyber-criminals to pass up.<\/p>\n

In fact, security firms report a 150 percent increase in DDoS attacks in the months between summer and the end of the year. DDoS is becoming an unfortunate and inevitable addition to the holidays.<\/p>\n

DDoS is an ever-growing problem, and the types of attacks are getting increasingly sophisticated. More importantly, DDoS attacks are often used as a \u201csmokescreen,\u201d masking more malicious and harmful infiltration of your resources. The technology to create DDoS attacks continues to increase in sophistication while the cost and ability to instigate these attacks get more and more accessible. Therefore, driving up the frequency and ease at which criminals can wreak havoc on businesses and users.<\/p>\n

Readily available DDoS toolkits, botnet-for-hire services and an explosion of inadequately secured IoT devices, make every organization a potential target. No online network, application, service, or website is immune to the DDoS threat.<\/p>\n

Azure offers solutions to protect your valuable digital assets from these cyber-attacks during the holidays and throughout the year. Azure DDoS Protection<\/a> provides countermeasures against the most sophisticated DDoS threats. The service provides enhanced DDoS mitigation capabilities for your application and resources deployed in your virtual networks. Additionally, customers using Azure DDoS Protection has access to DDoS Rapid Response support to engage DDoS experts during an active attack. You can easily enable DDoS Protection for your resources to proactively protect against DDoS attacks!<\/p>\n

Protect your applications against DDoS attacks in three steps:<\/h2>\n

1. Evaluate risks<\/strong> for your Azure applications. This is the time to understand the scope of your risk from a DDoS attack if you haven\u2019t done so already.<\/p>\n

a.<\/strong> If there are virtual networks with applications exposed over the public Internet,<\/strong> we strongly recommend<\/strong> enabling DDoS Protection<\/a> on those virtual networks. Resources in a virtual network that requires protection against DDoS attacks are Application Gateway\/WAF, Load Balancer, virtual machines, and Azure Firewall. Review \u201cDDos Protection reference architectures<\/a>\u201d to get more details on reference architectures to protect resources in virtual networks against DDoS attacks.<\/p>\n

i.<\/strong> This PowerShell script<\/a> will iterate all VNets overall subscriptions to which a user has access, and will output two tables, VNets with DDoS Protection enabled and VNets with DDoS Protection disabled.<\/p>\n

\"DDOSDemoVNET\"<\/p>\n

b.<\/strong> You must ensure your applications don\u2019t have a single point of failure<\/strong> and can auto-scale<\/strong> as the traffic volume increases during the peak period. Refer to the fundamental best practices<\/a> for building DDoS-resilient services in Azure for more details.<\/p>\n

c.<\/strong> Use network security groups<\/a> (NSGs) to block unwanted ports minimizing attack footprint of your applications.<\/p>\n

2. Validate your assumptions.<\/strong> Planning and preparation are crucial to understanding how a system will perform during a DDoS attack. You should be proactive to defend against DDoS attacks and not wait for an attack to happen and then act.<\/p>\n

a.<\/strong> It is essential that you understand the normal behavior of an application<\/strong> and prepare to act if the application is not behaving as expected during a DDoS attack. Have monitors configured for your business-critical applications that mimic client behavior, and notify you when relevant anomalies are detected. Refer to monitoring and diagnostics best practices<\/a> to gain insights on the health of your application.<\/p>\n

b.<\/strong> Azure Application Insights<\/a> is an extensible application performance management (APM) service for web developers on multiple platforms. Use Application Insights to monitor your live web application. It automatically detects performance anomalies. It includes analytics tools to help you diagnose issues and to understand what users do with your app. It’s designed to help you continuously improve performance and usability.<\/p>\n

c.<\/strong> Finally, test your assumptions<\/strong> about how your services will respond to an attack by generating traffic against your applications to simulate DDoS attack<\/strong>. Don\u2019t wait for an actual attack to happen!<\/strong> We have partnered with Ixia, a Keysight company, to provide a self-service traffic generator (BreakingPoint Cloud)<\/a> that allows Azure DDoS Protection customers to simulate DDoS test traffic against their Azure public endpoints.<\/p>\n

\"DDoS<\/p>\n

3. Configure Alerts and Attack Analytics.<\/strong> Azure DDoS Protection identifies and mitigates DDoS attacks without any user intervention.<\/p>\n

a.<\/strong> To get notified when there\u2019s an active mitigation for a protected public IP, we recommend configuring an alert<\/a> on the metric Under DDoS attack or not.<\/p>\n

b.<\/strong> You can additionally choose to create alerts for the other DDoS metrics and configure attack analytics<\/a> to understand the scale of the attack, traffic being dropped, and other details.<\/p>\n

\"Attack<\/p>\n

When to contact Microsoft support<\/h2>\n