Questions To Ask A DDoS Mitigation Service Provider

With DDoS attacks growing more powerful and sophisticated, in addition to simply happening more often, a lot of organizations have turned to DDoS mitigation service providers to try and defend themselves. 

Before an organization chooses DDoS protection solutions they need to make an assessment of the restrictions, aims, and needs of the applications, network, and organization itself. Those are the factors that will ultimately set the criteria that matter in regards to choosing the best solution for any specific organization. 

Mitigating DDoS attacks

A number of industries are not currently required to have DDoS mitigation requirements but it is almost certainly only a matter of time before every industry has to have them formally in place. 

One of the primary questions any organization should ask a DDoS mitigation service provider is how they are able to mitigate a DDoS attack. 

Delays in the start time of a DDoS mitigation service when an attack begins depends on the kind of solution that has been implemented as well as the nature of the specific attack. 

A DDoS solution that uses already implemented tech that is aligned with the network to scan for attacks will be delayed while it fingerprints the attack and then addresses it. The mitigation response to a known attack will be no more than five seconds, but it could take up to thirty seconds to begin mitigation if the attack is coming from an unknown source. 

The other type of DDoS solution is one that is not aligned with your network, known as mitigation on-demand. This sees the network re-routed away from the network and into a third-party scrubbing hub.

This kind of solution can take between fifteen minutes to an hour and a half for mitigation to begin whether the attack is from an unknown or a known source. This allows for the time needed for the traffic rerouting rules to be implemented with diversions to the BGP route in addition to transmission of the packet both to the scrubbing hub and from it, as well as any queues that may be in front of your traffic at the hub when it gets there. 

Both of these DDoS protection solutions have their own advantages, and both also come with a number of major implications in regards to cost and time. When choosing between the two services it is crucial to be aware of the expectations of your organization as well as how capable it is of supporting any necessary downtime. 

What kind of attacks will our network be protected from?

There are a number of different types of DDoS attacks that span many different levels of the technology pile. All of those attacks come with their own individual threats and methods of mitigation. 

A DDoS mitigation service provider should be capable of mitigating all attacks at the third and fourth layers, where a network switch can be overwhelmed with data packets by attackers. 

A service provider should also be capable of handling attacks at higher layers, which use a greater number of protocols like ICMP, UDP, and TCP. A number of high-level attacks make use of encryption and compression protocols like SSL in order to channel HTTPS attacks against the network’s own server. Attackers at the seventh layer level can even make use of POST and HTTP GET requests to try and choke your server traffic. It is therefore crucial that the DDoS mitigation service provider you choose is capable of efficiently coping with all such attacks. 

Do you offer mitigation against Secure Socket Layer attacks?

Many organizations do not need such attacks to be mitigated, so a provider may still be acceptable if they do not offer SSL mitigation. However, any organization that is reliant on SSL-based transactions and traffic will need to know if this capability is supported by a service provider, and how. 

The DDoS protection solutions offered by the provider for this problem needs to be supportive of in-line decryption as well as the re-encryption of traffic in order to ensure your network keeps the data with intact security policies. If the mitigation is delegated to a different network, the provider’s process of decryption and re-encryption should meet your organization’s goals in terms of service and security. 

Does the provider have an onsite support team?

Whether or not a DDoS mitigation service provider actually has an onsite support team is an easy question to ask, and should have an equally easy answer. Security experts Support staff who are available 24×7  is obviously beneficial as it means that a network engineering and security crew can get involved in any attack that happens to your network straight away and take instant context-based remedial action with expert support. The time that is saved by having a support team and ready to offer their immediate assistance can prevent a complete collapse of your network and applications, rendering the attack nothing more than a minor hiccup. 

Indusface protects more than 1000 customers all over the world with its unique award-winning security platform. Contact them for the best DDoS protection solutions for you today!