CDN DDoS Mitigation

The ever-increasing needs for DDoS mitigation service

Through our daily communication with our customers and retailers, we have realized that the Japanese market continues to show a greater need for security services. We not only receive inquiries from security-conscious companies but also organizations from unexpected fields.

We often hear “Everything will be fine with CDN DDoS mitigation, right?”. However, this is not entirely correct.

In this guide, we will explore the relationship between content delivery networks and DDoS attacks to correct this misunderstanding. We will also explore what level of protection is required for businesses looking to fend off distributed denial of service attacks.

What are DDoS attacks?

Firstly, let us explain what DDoS attacks are and how they work.

DDoS attacks are cyber attacks against network layers (layer3/4) or application layers (layer7). There are many methods for each attack, but they all bring about losses by interfering with what the website shows.

Bandwidth compression attacks (Layer3/4)

These attacks overload the target servers with more traffic than they can ordinarily serve, leading to a service blackout for the targeted website. Typical examples of these attacks are the “Reflection attack” and the “UDP flood attack.”

Session hijacking (Layer3/4)

In this variation, the attacker sends a large amount of data packets, then ignores the response from the servers to exhaust their resources. The typical examples of these attacks are the “TCP flooding attack” and the “SYN flood attack.”

Application attack (Layer 7)

This is an attack that degrades the performance of a server by sending numerous HTTP requests. Typical examples are the “HTTP GET flood attack” and the “HTTP POST flood attack.”

Is CDN helpful as a DDoS mitigation?

Now we have introduced the types of DDoS attacks, let’s consider whether CDN is effective in defending against them by looking at each type of attack.

Bandwidth compression attack (Layer3/4)

CDN is a service designed for handling large amounts of legitimate traffic, maintaining stable data transmission. Although having many broad lines will support service, to get straight to the point, it won’t be enough to provide complete defense against DDoS attacks.

We must remember that CDN is only a sharing service.

Of course, it is no problem if it is within the scope of the line’s capacity and doesn’t interfere with other customers’ usage. However, if it starts to affect other customers, as a CDN provider, it is necessary to deal with the problem. In some cases, CDN vendors need to exclude an attacked website from their CDN service, as blocking individual IP addresses won’t be sufficient.

Session hijacking (Layer3/4)

As mentioned above, CDN is a service designed for handling large amounts of traffic while maintaining stable data transmission. Here, we utilize many decentralized high-spec HTTP servers, but it is also not enough.

As previously mentioned, we need to remember that this is a sharing service.

If it is within the CDN server’s limits, there is no problem. On the other hand, if it begins affecting other customers, action is needed to address the situation.

Application attack (Layer 7)

To get straight to the conclusion, it’s least effective against application attacks.

There is no problem if you cached in CDN, even with a large amount of HTTP GET flood attacks. However, as the attack might be mistaken as transactional traffic, unexpected traffic burst fees may occur.

Regarding contents that are not or should not be cached, requests will be sent to the customer’s web server, as they are not processed by CDN.

CDN security service has DDoS protection features

And so, it is not enough to use only a CDN for DDoS mitigation.

Each CDN vendor has released CDNs with DDoS protection features. Recently, there are several methods and charging systems, such as on-demand real-time type, always block, and those which can cope with protocols other than TCP. With these products, users can choose services based on their environment and budget. On top of the usage of CDNs, if you use DDoS mitigation by a CDN vendor, you can create an effective security system.

CDNetworks offers the cloud-type DDoS mitigation service, called “Flood Shield”. Whether you are thinking about introducing security measures or adding them to the existing CDN service, our sales team will offer the best plan for you. Please do not hesitate to drop us a line.

Read More: CDN Benefits

CDNetworks – “Cloud security DDoS.”

“Cloud security DDoS” is the cloud-type mitigation service against DDoS attacks achieved with a large distribution capacity and a worldwide network of data centers. We responded to, and succeeded in protecting from almost all DDoS attacks that happened last year, with mitigation against attacks on network layer 3/4 and application layer 7.

When huge attacks happen, our users do not suffer from service stoppage or downtime, often because our CDN platform absorbs attack traffic, working alongside our web application firewall (WAF) meaning service as usual. Thus, you can keep the availability, speed, and stability of your web sites.

If you are thinking about using our CDN DDoS mitigation service, please do not hesitate to ask us.