DDoS is a malicious attempt to disrupt digital service availability by overwhelming origin infrastructure with modular floods of internet traffic. The primary implementation requirement involves provisioning cloud-based scrubbing services and rate limiting under Annex A 8.20, providing the business benefit of 99.9% service uptime and 60% faster incident recovery.
What is DDoS?
A DDoS (Distributed Denial of Service) attack is like a massive traffic jam on the internet. Instead of one car blocking the road, DDoS uses many computers to flood a website or online service with so much traffic that it crashes or becomes super slow. The goal isn’t to steal data, but to make the service unusable for everyone else.
Examples
- Online Store: Imagine a hacker directs a million fake customers to an online store at the same time. The store’s servers can’t handle all the requests and shut down. No real customers can get in to buy anything.
- Gaming Server: A rival gamer might use a DDoS attack to knock an opponent’s game server offline during a big tournament. All the players get kicked off and can’t continue the game.
Context
DDoS attacks are a common cyber threat that can affect anyone, from a small blog to a huge company. They often use a “botnet,” which is a network of hijacked computers (without the owners knowing) to launch the attack. Preventing and stopping these attacks is a key part of cybersecurity.
How to implement DDoS
1. Provision an Information Asset Register for Critical Services
- Provision a comprehensive inventory of all public-facing IP addresses, DNS records, and web services: Identify 100 per cent of your digital attack surface, resulting in a defined technical boundary for DDoS protection deployment.
2. Formalise a DDoS Risk Assessment
- Formalise a specific risk assessment targeting volumetric, protocol, and application-layer threats: Evaluate the business impact of service downtime, resulting in a prioritised list of assets requiring advanced mitigation scrubbing.
3. Provision Cloud-Based Mitigation and Scrubbing Services
- Provision an “Always-On” or “On-Demand” cloud mitigation service: Redirect traffic through global scrubbing centres during an attack, resulting in the technical absorption of malicious traffic before it reaches your origin infrastructure.
4. Enforce Rate Limiting and Traffic Shaping Rules
- Enforce granular rate limiting on web servers and edge routers: Limit the number of requests from single sources, resulting in a primary technical barrier against low-and-slow application-layer floods.
5. Formalise Technical Rules of Engagement (ROE) for Incident Response
- Document the Rules of Engagement for the Network Security team: Define exactly when to trigger BGP rerouting or DNS changes, resulting in authorised technical conduct that reduces mean time to recovery (MTTR).
6. Provision Content Delivery Network (CDN) Integration
- Provision a geo-distributed CDN to cache static content: Distribute the traffic load across multiple global edge locations, resulting in a resilient architecture that prevents any single point of failure from crashing the service.
7. Enforce Multi-Factor Authentication (MFA) for Infrastructure Access
- Enforce MFA for 100 per cent of administrative access to routers, firewalls, and DDoS portals: Mandate strong authentication at the system boundary, resulting in the prevention of “secondary” attacks where hackers disable defences during a DDoS event.
8. Audit Network Redundancy and Failover Capacities
- Audit the failover capacity of secondary ISP links and redundant hardware: Execute technical stress tests to verify throughput, resulting in citable evidence that your ISMS satisfies the redundancy requirements of Annex A 8.14.
9. Revoke Legacy Protocols and Sunset Unused Ports
- Revoke access to non-essential ports and sunset legacy protocols like NTP or SNMP that are prone to amplification: Execute a port-hardening script, resulting in a reduced attack surface for reflective DDoS vectors.
10. Audit Mitigation Effectiveness via Simulation Testing
- Audit the entire DDoS defence framework through formal red-team simulations: Execute multi-vector attack scenarios, resulting in a documented corrective action plan that ensures continuous improvement of your technical resilience.
DDoS FAQ
What is a Distributed Denial of Service (DDoS) attack?
A DDoS attack is a malicious attempt to disrupt the normal traffic of a targeted server, service, or network by overwhelming the target or its surrounding infrastructure with a flood of Internet traffic. In the context of ISO 27001, it is a primary threat to the Availability pillar of the CIA Triad, aiming to render 100% of digital services inaccessible to legitimate users.
What are the primary types of DDoS attacks?
Most DDoS attacks fall into three modular categories based on the network layer they target:
- Volumetric Attacks: Flooding the network bandwidth with massive amounts of data (e.g., UDP/ICMP floods).
- Protocol Attacks: Consuming actual server resources or intermediate communication equipment (e.g., SYN floods).
- Application Layer Attacks: Targeting specific web server functions to crash the service (e.g., HTTP GET/POST floods).
What is the business impact and cost of a DDoS attack?
DDoS attacks result in significant financial loss, with the average cost of downtime exceeding £4,500 per minute for enterprise organisations. Statistics show that 1 in 4 DDoS attacks are used as a smokescreen for data breaches, potentially leading to the global average breach cost of £3.4 million if sensitive information is compromised during the disruption.
How does ISO 27001 help in preventing and mitigating DDoS attacks?
ISO 27001 provides a technical framework for DDoS resilience through Annex A 8.20 (Network Security) and Annex A 8.14 (Redundancy). By implementing 100% cloud-based mitigation scrubbing services and automated traffic monitoring, organisations can absorb 99.9% of malicious traffic, ensuring service continuity and satisfying mandatory availability requirements during a surveillance audit.
How does a Lead Auditor verify technical DDoS resilience?
Auditors verify DDoS resilience by sampling 100% of your network security configurations and incident response plans. They seek technical evidence of traffic-shaping rules, CDN integration, and proof that the organisation has performed multi-vector stress testing. Data shows that organisations with formalised DDoS playbooks recover 60% faster than those relying on reactive measures.
Relevant ISO 27001 Controls
| Related ISO 27001 Control | Relationship Description |
|---|---|
| ISO 27001 Annex A 8.20: Network Security | Prevention & Detection: The primary control for implementing network defenses (like firewalls and traffic filtering) to manage access and mitigate the impact of flooding attacks. |
| ISO 27001 Annex A 8.21: Security of Network Services | Provider Management: Focuses on the security levels and service agreements with network providers to ensure they have the capacity and tools to handle DDoS traffic. |
| ISO 27001 Annex A 5.30: ICT Readiness for Business Continuity | Recovery: Ensures that the organization has a plan to restore services quickly if a DDoS attack successfully crashes or slows down the technology infrastructure. |
| ISO 27001 Annex A 5.26: Response to Incidents | Operational Action: A DDoS attack is a high-impact security incident; this control provides the framework for reacting to, containing, and managing the event as it happens. |
| Glossary: Availability | Primary Target: DDoS attacks are specifically designed to destroy “Availability,” making it the most relevant pillar of the CIA Triad for this type of threat. |
| Glossary: Breach | Incident Type: HighTable defines a DDoS attack as an “Availability Breach”—a disruption that makes information or systems unavailable to authorized users. |
| Glossary: Business Continuity Plan (BCP) | Mitigation Strategy: The BCP includes the proactive strategies and procedures required to maintain or resume business functions during a sustained DDoS attack. |
| ISO 27001 Glossary of Terms (Main Index) | Parent Directory: The central index where DDoS is categorized among other major cyber threats and security terminology. |
The Tools We Use.
100% Audit Success. Zero AI Guesswork.
About the author
