Components of a DDoS response strategy

  • Article

A DDoS attack that targets Azure resources usually requires minimal intervention from a user standpoint. Still, incorporating DDoS mitigation as part of an incident response strategy helps minimize the impact to business continuity.

Azure threat intelligence

Azure has an extensive threat intelligence network. This network uses the collective knowledge of an extended security community that supports Azure online services, Azure partners, and relationships within the internet security community.

As a critical infrastructure provider, Azure receives early warnings about threats. Azure gathers threat intelligence from its online services and from its global customer base. Azure incorporates all of this threat intelligence back into the Azure DDoS Protection products.

Also, the Azure Digital Crimes Unit (DCU) performs offensive strategies against botnets. Botnets are a common source of command and control for DDoS attacks.

Risk evaluation of your Azure resources

It's imperative to understand the scope of your risk from a DDoS attack on an ongoing basis. Periodically ask yourself:

  • What new publicly available Azure resources need protection?

  • Is there a single point of failure in the service?

  • How can services be isolated to limit the impact of an attack while still making services available to valid customers?

  • Are there virtual networks where DDoS Protection should be enabled but isn't?

  • Are my services active/active with failover across multiple regions?

It's essential that you understand the normal behavior of an application and prepare to act if the application isn't behaving as expected during a DDoS attack. Have monitors configured for your business-critical applications that mimic client behavior, and notify you when relevant anomalies are detected. Refer to monitoring and diagnostics best practices to gain insights on the health of your application.

Azure Application Insights is an extensible application performance management (APM) service for web developers on multiple platforms. Use Application Insights to monitor your live web application. It automatically detects performance anomalies. It includes analytics tools to help you diagnose issues and to understand what users do with your app. It's designed to help you continuously improve performance and usability.

Customer DDoS response team

Creating a DDoS response team is a key step in responding to an attack quickly and effectively. Identify contacts in your organization who will oversee both planning and execution. This DDoS response team should thoroughly understand the Azure DDoS Protection service. Make sure that the team can identify and mitigate an attack by coordinating with internal and external customers, including the Azure support team.

We recommend that you use simulation exercises as a normal part of your service availability and continuity planning, and these exercises should include scale testing. See test through simulations to learn how to simulate DDoS test traffic against your Azure public endpoints.

Alerts during an attack

Azure DDoS Protection identifies and mitigates DDoS attacks without any user intervention. To get notified when there's an active mitigation for a protected public IP, you can configure alerts.

When to contact Azure support

Azure DDoS Network Protection customers have access to the DDoS Rapid Response (DRR) team, who can help with attack investigation during an attack and post-attack analysis. For more information, including when you should engage the DRR team, see DDoS Rapid Response. Azure DDoS IP Protection customers should create a request to connect with Azure support. To learn more, see Create a support request.

Post-attack steps

It's always a good strategy to do a postmortem after an attack and adjust the DDoS response strategy as needed. Things to consider:

  • Was there any disruption to the service or user experience due to lack of scalable architecture?

  • Which applications or services suffered the most?

  • How effective was the DDoS response strategy, and how can it be improved?

If you suspect you're under a DDoS attack, escalate through your normal Azure Support channels.

Next steps