Akamai's New Report Shows an Internet Under Siege

Akamai (News - Alert) recently released its third quarter 2015 report on the state of the Internet security, and the news isn't good.

Distributed denial of service (DDoS) attacks across the Akamai routed network are on an absolute tear, up 23 percent in the third quarter over the second quarter. Worse, the second quarter was already a record in its own right, and total attacks in the quarter hit 1,510. That also represents a huge jump over 2014's third quarter, with attacks up 180 percent since then.

Though there were more attacks, the Akamai report notes that these were smaller attacks. The attacks represented both shorter duration and lower average bandwidth and volume used. Attacks over 100 Gbps were down to just eight for the quarter, with 12 recorded in the second quarter and 17 recorded in last year's third quarter. Even the largest attack size was clearly down; the third quarter's largest attack turned to the XOR DDoS botnet and put out 149 Gbps. The largest from the second quarter was well over that at 250 Gbps.

The media and entertainment industries were regularly hit by such attacks, including one record-breaker of 222 million packets per second (Mpps). That beats the previous record from the second quarter at 214 Mpps. Online gaming accounted for one in every two attacks, followed by software and technology, which took one in every four.

Reflection-based DDoS largely took over for infection-based methods. Reflection accounted for 33.19 percent of all DDoS traffic in the third quarter, but only accounted for 5.9 percent a year prior. The retail industry, meanwhile, was hit hardest by Web application attacks, suffering 55 percent of all such attacks. The financial industry was a distant second, taking just 15 percent of attacks.

For businesses that depend on Web access — like retailers and online gaming — the study provides a clear imperative. Be ready for these attacks. Be ready with tools that help break up DDoS attacks, be ready with backup servers that can minimize customer frustration at not being able to reach a site to make purchases. That makes for a bad customer experience, and customers won't be in a mood to listen to tales of how a site was attacked. Those customers will go elsewhere, and likely won't be coming back.

In the end, it's all about being as ready as possible. No one knows when a DDoS attack will hit, much like any other crisis. All one can do is be ready, have backups on hand, and try to weather the storm as best as possible. The Akamai report shows that these attacks can hit any time, so being ready is the best response.