‘Under the radar’ DDoS attacks increase by 158 percent in Q2 2019

Published: Thursday, 15 August 2019 07:29

Small-scale Distributed Denial of Service (DDoS) attacks are becoming more frequent and sophisticated, according to new research from Neustar’s Security Operations Centre (SOC). The Q2 2019 ‘Cyber Threats and Trends’ report reveals that between April and June of this year, over 75 percent of all attacks mitigated by Neustar were 5 Gigabits per second (Gbps) or less, while large attacks – those of 100 Gbps and over – decreased by 64 percent.

At first glance, the evolution of DDoS attacks on enterprises seems to follow a pattern. The overall number of attacks during Q2 2019 compared with the previous year grew by 133 percent, which, though down from last quarter’s 200 percent growth, is still high. Stepping outside an analysis of the numbers of attacks to their composition, however, shows some interesting changes, according to Neustar.

Small and secretive more likely to suceed?

DDoS attacks have long been considered overwhelming threats and are traditionally associated with high rates of traffic. Such attacks do continue to take place, but smaller and more carefully targeted incursions are growing in quantity, intensity and duration. Such attacks do not seek to saturate the network link – and draw unwanted attention in the process – but to degrade or disable specific infrastructure within the target. Such lower volume incursions may enable the perpetrator to get in and get out unnoticed, or allow the attack to continue for quite a long time undetected. In fact, the longest duration for a single attack in Q2 was nearly two days.

These small attacks pose a significant threat, as they fall below the typical threshold that enterprises with a ‘detect and alert’ DDoS mitigation strategy might employ. An attacker could therefore affect targets ranging from infrastructure to individual servers with relative impunity.

The situation becomes more alarming when considering an enterprise’s ability to recognise such threats when they were underway. When asked how likely they would be to notice today’s most prevalent smaller attacks, 72 percent of CTOs, CISOs and directors of security from the Neustar International Security Council (NISC) answered very unlikely, somewhat unlikely or somewhat likely. The remaining 28 percent of respondents felt it was very likely that they would notice a small-scale DDoS attack.

More details.