IT in Manufacturing

Protect against DDoS attacks

February 2020 IT in Manufacturing

The recent slew of distributed denial of service (DDoS) attacks against South African banks and ISPs have highlighted the fact that even the largest organisations with the latest security tools and solutions need to revisit their technology governance strategies.

“These attacks should be a wake-up call to organisations across the board,” says Rezelde Botha, business unit manager for Citrix at Axiz.

A DDoS attack happens when threat actors attempt to make it impossible for a company to deliver its services, usually achieved by preventing access to networks, applications, servers, devices and suchlike. Essentially, these attacks work by flooding a system with requests for data, such that it inevitably crashes under the onslaught. Also, DDoS attacks are not just on the rise, they are changing in nature. It would seem that new DDoS attack methods are taking over from those that have been successfully combatted by the security community and law enforcement. Unfortunately, they are becoming increasingly complex and this is showing no signs of slowing down, therefore, businesses must find ways to protect themselves effectively.

Botha says the impact of a DDoS attack can range from a minor irritation to seeing websites, applications, or even the whole business taken offline. There are several symptoms that indicate a DDoS attack, although initially, it can appear as if there are normal availability issues, such as a server or system being down. Sometimes, it can seem as if there are simply too many legitimate requests from real users taking place. However, traffic analysis will quickly separate the wheat from the chaff.

DDoS attacks are becoming more aggressive

Over the years, DDoS attacks have got bigger in size. “If we think back to the ‘90s,” Botha explains, “attacks might have seen 150 server requests happening each second, and that number would have been sufficient to bring down systems at that time. Today, they can exceed 1000 Gbps, thanks to the massive botnets we see today.”

Three years ago, the notorious Mirai botnet reared its head, attacking Internet performance management company, Dyn DNS. Mirai employed a hundred thousand hijacked IoT devices to achieve its ends, sending a barrage of DNS queries from an enormous number of different IP addresses. “This led to services from giants such as Netflix, Amazon, Spotify, Tumbler and Twitter being disrupted, explains Botha. “The Mirai botnet was notable in that, unlike the majority of DDoS attacks, it leveraged vulnerable IoT devices instead of PCs and servers. This is particularly concerning considering the number of IoT devices already in play, and growing exponentially.”

Early last year, another DDoS technique appeared on the scene. “Software development platform GitHub was hit by an enormous DDoS attack. The platform managed to fight it off in under half an hour, only going down intermittently, but the sheer scale of the attack raised the alarm within the security community.

Botha explains that this attack did not make use of massive botnets, such as those used in the Dyn DNS attack, it employed a far simpler method. This attack stemmed from memcached servers. “Essentially, these database caching systems work to

quicken networks and websites,” she adds, “but they aren’t meant to be exposed on the public Internet. Approximately 100 000 such memcached servers, most of which are owned by businesses and other organisations, sit exposed online with zero authentication protection. Anyone can query them, and similarly, they will respond to anyone.”

In this way, threat actors can access them and send them a special command packet that the server will respond to with a much larger reply. Unlike the usual botnet attacks, memcached DDoS attacks do not need the power of a malware-driven botnet to achieve their ends. Bad actors merely spoof the IP address of their target and send small queries to multiple memcached servers, at around 10 per second to each server, which are tailored to draw a far larger response. These memcached systems then return fifty times the data of the requests back to the victim.

“One thing is clear,” concludes Botha. “Businesses need to find better ways to protect themselves against this sort of attack.” Enter Citrix NetScaler, which checks the client’s connection and request parameters to prevent flood attacks until a valid application request has been submitted. Using NetScaler, businesses can defend against attacks through security products that use the latest standards to protect today’s segmented, layered and virtualised corporate networks.”

For more information contact Evette Wessels, Axiz, +27 11 237 7000,,

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

A journey into the automation unknown
April 2020 , IT in Manufacturing
Jendamark’s reinvention as an Industry 4.0 technology leader in the automotive industry.

Implementing artificial intelligence in industrial manufacturing
April 2020, Omron Electronics , IT in Manufacturing
The introduction of AI solutions at the edge inside the machine now provides tools that enable you to look at that data and recognise patterns within it.

More efficient engineering with automatically generated dashboard
April 2020, Beckhoff Automation , IT in Manufacturing
Engineering 4.0: One-Click Dashboard eliminates an entire work step.

Engineering framework ready for continuous software development
April 2020, Siemens Digital Industries , IT in Manufacturing
With the new Totally Integrated Automation (TIA) Portal V16, Siemens has expanded its engineering framework with practical new functions for various phases from planning to engineering to commissioning. ...

How the IoT is affecting people
April 2020 , IT in Manufacturing
While the Internet of Things (IoT) may still be an emerging technology, it has become deeply entrenched in people’s lives and its proliferation is likely to accelerate further in the next few years. The ...

Schneider Electric introduces Asset Advisor for critical assets
Technews Industry Guide: Maintenance, Reliability & Asset Optimisation 2020, Schneider Electric South Africa , IT in Manufacturing
Schneider Electric has announced the availability of EcoStruxure Asset Advisor for electrical distribution and critical data centre assets, as part of the company’s EcoStruxure IoT-enabled system architecture ...

Digitisation and automation for mining: the only way forward
March 2020, SICK Automation Southern Africa , IT in Manufacturing
A global specialist for factory automation, logistics and process automation applications, SICK Automation has over 44 000 products for the most challenging industry applications that require high precision proximity detection systems.

2020 IT trends by Rittal South Africa
March 2020, Rittal , IT in Manufacturing
Rapid upgrades to data centres and rising energy consumption are key factors to consider.

Allianz Risk Barometer 2020
March 2020 , IT in Manufacturing
Cyber top peril for companies in South Africa.

Finding the common thread in process industries
March 2020, Absolute Perspectives , IT in Manufacturing
Initially focused on financial management and MRP (materials resource planning), ERP has evolved to embrace the whole value chain, from vendor management, manufacturing, supply chain/logistics, customer relationship management and more.