DDOS protection and DDOS attack mitigation.

A range of DDoS mitigation services to reduce the risk of losing the connection, avoiding inconvenience, loss of reputation or financial damage.

About DDOS attacks

Distributed denial of service (DDoS) attacks are increasing in scale and frequency. As a research and training organization, you need a cost-effective way to mitigate these attacks - reducing business risk, in a way that adapts to your needs and your budget.

To help you mitigate these risks, we provide a selection of DDoS mitigation services to Managed Server members, as enhanced optional services. At Managed Server, we have extensive experience in cybersecurity - so whichever option you choose, you can trust us. We are ideally placed to apply DDoS mitigation across our entire network.

DDOS Mitigation Service

As part of your Managed Server subscription or as an on-demand service even by non-customers hosted by us, you will receive our DDoS mitigation service. This gives you the peace of mind knowing that we will manually mitigate any attack on your network connection. With this service, we detect and filter DDoS traffic across the Arbor and CloudFlare network before it reaches you - mitigating the effects of the attacks on your connection and reducing outages and costs.

Operating mode, partners and technologies

The mitigation of a DDOS attack is activated by identifying the attack, the type of attack to then move on to the study of the countermeasure and the application of the firewalling rules and subsequently to the reporting to the various services of Abuse of the compromised servers involved in the attack and used as a bridgehead.

The practice adopted, graphically represented above, allows us to keep our business online, cut out malicious attacks and compromised systems and gradually "take away their weapons" from our own attackers who, thanks to the Abuse report, will lose access within 48 hours to compromised systems, effectively losing attack power.

Level 3, Level 4 Network Attacks.

For level 3 and level 4 attacks of the TCP / IP stack and of the ISO / OSI standard or at the TCP / IP level on IPv4 and IPv6, our mitigation solution adopts filtering upstream through Arbor Networks, a partner of global excellence in this regard. network security and DDOS mitigation services for enterprises such as Datacenter and hosting provider.

Arbor technology is deployed in 70% of Service Provider networks globally, including 90% of Tier 1 operators. Additionally, Arbor technology is widely used among the largest hosting and cloud ISPs.

Arbor sets itself apart from other security ISPs in that it leverages its ability to deliver services and turns it into a benefit for all customers. Arbor has created ATLAS, a project born from the collaboration with over 230 Service Providers who have agreed to share anonymous data on Internet traffic with the ASERT (Arbor Security Engineering & Response Team). This data, a total of 35 Tbps, is enhanced by Arbor's global “honeypot” network of more than 45 sensors in the dark and unused address space of customer networks. The information is aggregated and analyzed by the ASERT team and then sent back to customers in the form of attack signatures via the Arbor products in use. Arbor is therefore ideally placed to provide elaborate data on the DDoS attacks, malware, botnets, exploits and phishing that threaten Internet infrastructure and services today.

It is thanks to the use of Arbor Networks that we are able to filter volumetric attacks such as Syn flood, ICMP Fllod, DNS Reflection, TCP Flood, UDP Flood and the like with extreme satisfaction and success.

The ARBOR Networks Filtering system comes into play on our network and on our systems in total autonomy when an anomalous volume of incoming packets occurs, in less than 60 seconds, allowing to filter TCP volumetric attacks in the order of hundreds of Gbit / s without manually intervening.

Level 7, DDOS Layer 7 or application attacks.

Among the ever increasing attacks in recent times, we have application layer attacks or DDOS Layer 7 attacks that allow an attacker to completely bypass filtering and optimization measures such as an IP firewall and a static caching system such as Varnish for example. and get to impact in an important way on the WebServer, on the interpreter of the server side language (such as PHP) and on the database, inevitably leading to an increase in the CPU load and to the offline putting of the website with errors such as the classic 502 Bad Gateway or Timeout Error.

The mitigation of a Layer7 attack involves the use of a WAF (Web Application Firewall) that works in reverse proxy and allows you to block any threats and malicious traffic upstream.

Our strategic partner at the WAF level is CloudFlare.

Cloudflare's Enterprise Web Application Firewall (WAF) protects Internet property from common vulnerabilities such as SQL injection attacks, cross-site scripting (XSS) attacks, and false cross-site requests, without the need to make changes to existing infrastructure.

Using CloudFlare as an application security solution allows us to achieve the following very important benefits:

1. Browser-level filtering via Under Attack Mode 

Through theUnder Attack Mode of CloudFlare it is possible to challenge the visitors' browsers to verify whether they are real browsers or simply HTTP / S traffic of artfully packaged tools to bring DDOS to the application level and forge malicious GET or POST requests. In this phase we go to discern the browsers of real users to the tools of the attackers by blocking the latter.

2. Referral level filtering

In this mode used in some types of attack through the injection of content on very busy sites, we can decide to filter the attacker by determining the referral. In fact, if the real user comes from a referral used as an attack vector, blocking the referral with appropriate firewall rules will also block all users who come from that referral.

3. URL pattern filtering

If a botnet decides to call specific patterns in URLs in intense mode or use parametric ones to bypass any cache systems, we can identify the pattern and block its access.

4. Filtering at the geographical level.

We can enable a type of geographic filtering at the GeoIP level that allows us to block or challenge connections originating from suspicious countries via the Under Attack Mode. For example, if our business is Italian or perhaps European, we may decide to block or challenge Asian, African, American, Russian IPs and so on.

The accuracy of this solution is greater than 99% and allows you to implement very aggressive and restrictive filtering policies if you are faced with an extremely complex solution to be solved immediately.

5. Filtering on Autonomous System AS

Un autonomous system (In English Autonomous System), with reference to routing protocols, is a group of router e networks under the control of a single and well-defined administrative authority.

Should we be attacked by Dedicated Servers hacked and used as zombies to launch the attack on our customers, we may decide to filter out all those connections that do not belong to suppliers that offer consumer DSL services.

Why should a Digital Ocean or AWS or OVH server make requests to our webserver where we may be hosting a sporting goods e-commerce?

Since there are apparently no reasons for this and an attack is underway, another possibility is to block known Datacenter Autonomous Systems that can be hacked and used against.

6. A MIX of the above methods in combo

The use of logical inclusion and exclusion operators such as AND and OR allows us to use all the previous methods described by using very complex logical conditions that allow us to be surgical in the application of filtering rules, excluding false positives and traffic legitimate by the filtering and dropping policies that follow.

7. SEO Oriented

All filtering operations are SEO Oriented, i.e. adequate not to block the legitimate crawling activities of the main Search Engines such as Google and Bing.

Advanced tailored services

If you need faster or more personalized DDoS mitigation, or 24/7 response, you can choose to subscribe to our advanced services - helping you further reduce the risk of a DDoS attack causing damage to business-critical systems.

This service offers you:

Faster in mitigation DDoS

Mitigation DDoS advanced responds more quickly to an attack DDoS , reducing the possibility of damage occurring.

Within the service, one of the two reaction levels is selected: fast o instant . Express service starts mitigation within four minutes; while with the instant service, the traffic is permanently routed through the mitigation service, so there are no defense delays.

These automated services react 24 hours on 24 , 7 days on 7 , helping you prevent interruptions from overtime attacks.

Customization options to suit your needs

When choosing mitigation DDoS advanced, you can select preconfigured or custom mitigation, as appropriate.

The preconfigured service , you can choose from a selection of profiles designed to protect a selection of common services, such as web servers or DNS , using warning triggers and mitigation responses designed by Managed Server security analysts to fit most needs.

The tailor-made service , you can further customize the protection by adjusting the parameters with the help of a security analyst. For instance:

• You can add protection for outward-facing services that aren't normally included in preconfigured profiles, such as an internet-facing file transfer service or perhaps a unique service for your institution
• You can customize the protection to include or exclude specific domains or URLs

Together, the pre-configured and customized options enable more accurate attack detection and more effective mitigation.

Don't let a DDoS attack interrupt business operations for Prevention reputational and financial. Use DDOS protection for To avoid being hacked and taken offline.

Is your site under attack? Contact us.