Don't laugh at Estonia -- it could happen to you

In April of this year, Estonia suffered under a huge denial-of-service attack. Lest you think that Estonia is some little, underprepared country that doesn't follow basic computer security practices, you need to know that the same thing could happen to your country.

[ RogerGrimes's column is now a blog! Get the latest IT security news from the Security Adviser blog. ]

Today's Internet is so screwed up, security-wise, that there is absolutely nothing any country has that would stop a massive distributed DDoS (denial of service) attack. Think SQL Slammer worm, but using millions of bots designed to cause traffic floods. Bot nets under the control of one malicious hacker (or group) are often measured into the hundreds of thousands of nodes and, some analysts say, millions of compromised machines. If a very large bot net was used to attack a single country's Internet backbone, it would take that country -- even the most technology-savvy nation -- a few days to get legitimate traffic going again at previous levels.

Worrying about country-sized attacks isn't in most of our job descriptions, but mitigating smaller DDoS attacks against our organization are. To find out what most administrators could do to mitigate DDoS attacks against their company, I spoke to an administrator who has been there and done that: Paul Laudanski, founder and leader of CastleCops.

The effects of DDoS

Paul and his wife, Robin, lead the CastleCops site, which is the headquarters of a volunteer organization dedicated to fighting malware, spam, and phishing. They are very successful in getting malicious Web sites and compromised computers shut down. They also provide advice in Internet crime investigation and help others preserve evidence useful to law enforcement. CastleCops has been in business since 2002 and, by independent conservative calculations, prevented more than $150 million in losses. This fact is not lost on the criminals who rule the Internet today. CastleCops has been the target of more than a dozen DDoS attacks. This year, it was subjected to two large gigabit-per-second DDoS attacks that caused connection problems for many days. CastleCops followed its own advice and Greg King has been charged in one of the attacks. You should read more details of the attack to understand how something similar could affect you.