An online survey of 225 IT professionals from large and medium-sized US businesses revealed that 78% of respondents are extremely or very concerned about DDoS attacks, and 67% expect the frequency and strength of DDoS attacks to increase or stay the same over the next two years.
A full 87% view DDoS protection as very important for maintaining availability of websites and services. Moreover, 71% of respondents who reported a lack of DDoS protection said they plan on implementing a solution in the next 12 months.
More than half (53%) of the respondents said they experienced downtime in the past year, with DDoS attacks accounting for 33% of all downtime incidents.
A full 63% of respondents said they had sustained at least one DDoS attack in the past year; 11% were hit six or more times.
The survey also found that 71% of respondents who did not have DDoS protection intended to implement a solution in the next 12 months: 40% plan to outsource DDoS protection, 31% plan to implement an in-house solution, and 29% are undecided about their approach to protection.
“For a long time, DDoS got wedged in the network engineering team, but it wasn’t a separate budget line item. ‘We’ll just get a firewall, and that will provide DDoS protection’, the team would say. But that’s not the case”, said Sean Leach, vice president of technology with VeriSign’s Network Intelligence and Availability Group. .
“People have a bad conception of what DDoS protection really is. You can’t go out and buy a firewall and say I’ve got DDoS protection. That doesn’t work”, Leach told Infosecurity. “You have to have a complete DDoS mitigation solution to truly be protected. That’s not just hardware in your data center. That’s not just big bandwidth. It is also the expertise to handle DDoS attacks”, he added.
More than two-thirds (67%) of respondents said their downtime impacted customers, and 51% reported they lost revenue. Considering 60% of the respondents rely on their websites for at least 25% of their annual revenue, downtime can have significant and lasting effects.
A separate study commissioned by VeriSign found that in the first quarter of 2011, DNS availability was a problem for even the highest-ranked e-commerce sites.
The study revealed that DNS availability on average dropped to 90.13% for sites that host their own DNS, while sites using third-party managed DNS services averaged a minimum DNS availability rate of more than 98%.
When examining minimum availability overall, the research showed that some sites with internally managed DNS had total outages, while the biggest drop in availability for sites with third-party DNS management never went below 50% availability. Similarly, average downtime for sites that host their own DNS is twice that of those that use a third party.
VeriSign said the difference is most likely attributed to the fact that most third-party managed DNS providers use an anycast resolution service, meaning there is always a server available to respond to DNS queries. This allows end users to experience less impact even if a few physical anycast servers fail or are unreachable.