What are we supposed to do to stop it?

• Network Ingress and Egress Filtering (RFC 2267 and Egress Filtering v 0.2)
• Rate limiting and Unicast reverse path forwarding (e.g, Cisco Strategies to Protect Against Distributed Denial of Service (DDoS) Attacks)
• Improve Intrusion Detection capabilities (e.g., using Snort)
• Audit Hosts for DDoS tools (e.g., NIPC's find_ddos program)
• Audit Networks for DDoS tools (e.g., RID)
• Scan networks for DDoS agents
• Have an Incident Response Team (IRT)
• Have/enforce policies for securing hosts on your network
• Buy insurance to cover service disruption
• Building separate "netops" networks

Proposed future solutions include:

• The Council of Europe's Draft Convention on Cyber-Crime
• Various methods of attack packet traceback
• Host Identity Protocol (HIP)
• Taking control traffic (e.g., ICMP, IGMP) "out of band"

[Next] | [Prev] | [Top]