Welcome!

Related Topics: Government Cloud, Agile Computing, @CloudExpo, Cloud Security

Government Cloud: Article

Does a CDN Protect Against DDoS Attacks? | @CloudExpo #Cloud #Security

A CDN by its very nature will absorb DDoS attacks for the content that it serves and this could be considered protection

Does a Content Delivery Network (CDN) protect against Distributed Denial of Service (DDoS) attacks? It's a good question. A CDN by its very nature will absorb DDoS attacks for the content that it serves and this could be considered protection but, as is often the case, this is only the beginning of the story.

If we consider what is actually going on here, the CDN isn't actually ‘blocking' the DDoS attack - it is simply reducing its impact by throwing more resources at the problem. This means that the size of the DDoS attack a CDN can deal with is inherently dependent on the size of the CDNs infrastructure, which for some of the market-leading players means that pretty much any current attack targeting CDN served content can be ‘absorbed.'

This sounds great - DDoS Problem Solved - but there a couple of big caveats here.

First, many CDN providers charge based on the amount of traffic they process and content they serve. If the CDN solution to DDoS is simply to ‘absorb' it then that traffic can be chargeable - so the ‘cost' of an attack for a CDN customer isn't predictable and unexpected (large) bills can be the result.

The second and perhaps most significant problem is the risk that the attacker can bypass the CDN, or proxy through it, to target the customer's origin server.

If the attacker can find out the IP address of the origin server used to provide dynamic content, account information, etc., then he can bypass the CDN. There are techniques that effectively use the CDN as the proxy for a DDoS attack towards a customer's origin servers. Unfortunately, both of these techniques are used in the wild, and many commercial ‘DDoS for Hire' services advertise their ability to circumvent CDNs.

The answer is layered DDoS protection. This involves the use of a cloud-based DDoS protection service to deal with high magnitude attacks, plus an on premise component to deal proactively with all attacks, including the stealthier, more sophisticated application layer attack vectors. Both of these layers are designed to ‘block' attack traffic, so that only good traffic is processed - this differs from the way most CDNs ‘absorb' DDoS attacks.

If attack traffic is blocked then it can longer consume resources on application / service infrastructure, and most good DDoS mitigation services charge based on the amount of clean traffic delivered to the end-customer (not the ‘unknown' amount of attack traffic) - this makes the cost model far more predictable and palatable to the CFO.

Conclusion
A content delivery/distribution network is not a solution to DDoS attacks. CDNs can reduce the impact of a DDoS attack targeting CDN served content, but they do not represent a comprehensive defensive strategy. CDNs may prevent some attacks from succeeding - but not all.

Relying on a CDN to protect your organization from a DDoS attack is very risky, in the same way as being reliant on an umbrella to keep you 100% dry in heavy rain. The umbrella will provide protection from rain as it falls, but not from being splashed by a passing bus. Organizations should consider the best-practice of layered DDoS defense, possibly alongside a CDN if required, to effectively protect against DDoS threats.

More Stories By Darren Anstee

Darren Anstee, Chief Security Technologist at Arbor Networks, has 20 years of experience in pre-sales, consultancy and support for telecom and security solutions. In his position, he works across the research, strategy and pre-sales aspects of Arbor’s traffic monitoring, threat detection and mitigation solutions for service providers and enterprises around the world. Prior to joining Arbor, he spent over eight years working in both pre- and post-sales for core routing and switching product vendors. Follow Darren Anstee on Twitter [email protected]

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


Latest Stories
Creating replica copies to tolerate a certain number of failures is easy, but very expensive at cloud-scale. Conventional RAID has lower overhead, but it is limited in the number of failures it can tolerate. And the management is like herding cats (overseeing capacity, rebuilds, migrations, and degraded performance). Download Slide Deck: ▸ Here In his general session at 18th Cloud Expo, Scott Cleland, Senior Director of Product Marketing for the HGST Cloud Infrastructure Business Unit, discusse...
Whether they’re located in a public, private, or hybrid cloud environment, cloud technologies are constantly evolving. While the innovation is exciting, the end mission of delivering business value and rapidly producing incremental product features is paramount. In his session at @DevOpsSummit at 19th Cloud Expo, Kiran Chitturi, CTO Architect at Sungard AS, will discuss DevOps culture, its evolution of frameworks and technologies, and how it is achieving maturity. He will also cover various st...
SYS-CON Events announced today that eCube Systems, a leading provider of middleware modernization, integration, and management solutions, will exhibit at @DevOpsSummit at 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. eCube Systems offers a family of middleware evolution products and services that maximize return on technology investment by leveraging existing technical equity to meet evolving business needs. ...
All clouds are not equal. To succeed in a DevOps context, organizations should plan to develop/deploy apps across a choice of on-premise and public clouds simultaneously depending on the business needs. This is where the concept of the Lean Cloud comes in - resting on the idea that you often need to relocate your app modules over their life cycles for both innovation and operational efficiency in the cloud. In his session at @DevOpsSummit at19th Cloud Expo, Valentin (Val) Bercovici, CTO of So...
Digital innovation is the next big wave of business transformation based on digital technologies of which IoT and Big Data are key components, For example: Business boundary innovation is a challenge to excavate third-party business value using IoT and BigData, like Nest Business structure innovation may propose re-building business structure from scratch, as Uber does in the taxicab industry The social model innovation is also a big challenge to the new social architecture with the design fr...
Cloud computing is being adopted in one form or another by 94% of enterprises today. Tens of billions of new devices are being connected to The Internet of Things. And Big Data is driving this bus. An exponential increase is expected in the amount of information being processed, managed, analyzed, and acted upon by enterprise IT. This amazing is not part of some distant future - it is happening today. One report shows a 650% increase in enterprise data by 2020. Other estimates are even higher....
What are the new priorities for the connected business? First: businesses need to think differently about the types of connections they will need to make – these span well beyond the traditional app to app into more modern forms of integration including SaaS integrations, mobile integrations, APIs, device integration and Big Data integration. It’s important these are unified together vs. doing them all piecemeal. Second, these types of connections need to be simple to design, adapt and configure...
A strange thing is happening along the way to the Internet of Things, namely far too many devices to work with and manage. It has become clear that we'll need much higher efficiency user experiences that can allow us to more easily and scalably work with the thousands of devices that will soon be in each of our lives. Enter the conversational interface revolution, combining bots we can literally talk with, gesture to, and even direct with our thoughts, with embedded artificial intelligence, wh...
Data is an unusual currency; it is not restricted by the same transactional limitations as money or people. In fact, the more that you leverage your data across multiple business use cases, the more valuable it becomes to the organization. And the same can be said about the organization’s analytics. In his session at 19th Cloud Expo, Bill Schmarzo, CTO for the Big Data Practice at EMC, will introduce a methodology for capturing, enriching and sharing data (and analytics) across the organizati...
SYS-CON Events has announced today that Roger Strukhoff has been named conference chair of Cloud Expo and @ThingsExpo 2016 Silicon Valley. The 19th Cloud Expo and 6th @ThingsExpo will take place on November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. "The Internet of Things brings trillions of dollars of opportunity to developers and enterprise IT, no matter how you measure it," stated Roger Strukhoff. "More importantly, it leverages the power of devices and the Interne...
SYS-CON Events announced today that Bsquare has been named “Silver Sponsor” of SYS-CON's @ThingsExpo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. For more than two decades, Bsquare has helped its customers extract business value from a broad array of physical assets by making them intelligent, connecting them, and using the data they generate to optimize business processes.
19th Cloud Expo, taking place November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy. Meanwhile, 94% of enterpri...
We’ve been doing it for years, decades for some. How many websites have you created accounts on? Your bank, your credit card companies, social media sites, hotels and travel sites, online shopping sites, and that’s just the start. We do it often without even thinking about it, quickly entering our personal information, our data, in a plethora of systems. Sometimes we’re not even aware of the information we are providing. It could be very personal information (think of the security questions you ...
In this strange new world where more and more power is drawn from business technology, companies are effectively straddling two paths on the road to innovation and transformation into digital enterprises. The first path is the heritage trail – with “legacy” technology forming the background. Here, extant technologies are transformed by core IT teams to provide more API-driven approaches. Legacy systems can restrict companies that are transitioning into digital enterprises. To truly become a lea...
According to Forrester Research, every business will become either a digital predator or digital prey by 2020. To avoid demise, organizations must rapidly create new sources of value in their end-to-end customer experiences. True digital predators also must break down information and process silos and extend digital transformation initiatives to empower employees with the digital resources needed to win, serve, and retain customers.