Lessons from Last Friday's DDOS Attack

Analysis of the DDOS attack that took down big chunks of the Internet last Friday provides a reminder and a warning. While the "who" behind the attack remains unclear, the "what" has been traced (largely) to a hack of a Chinese company's IOT (Internet of Things) devices that were shipped with weak passwords, and then not changed to strong, unique passwords by their owners.

That vulnerability led to hundreds of thousands of these devices being infected by Mirai malware and commandeered into a botnet that was used in the DDOS (distributed denial of service) attack on Dyn, an Internet infrastructure provider. (Think of Dyn as a "traffic cop" that gets Internet traffic to where it's supposed to go. As we saw last Friday, without the traffic cops, Internet traffic can grind to a halt.

Lesson #1: Always use strong passwords on anything that connects to the Internet. We recommend passwords that are at least 8 characters in length, combining letters, (upper and lower case), numbers, and special characters (like !#$%*).  Avoid commonly spelled words and numbers in sequence. And don't "reuse" them. Write them down and keep them in a secure place or use a reliable password management service. (I can send you links to detailed reviews of password management services on request.) Strong passwords will help insure your devices don't become part of the next attack.

Lesson #2: Although it's pretty sturdy, (with multiple redundancies), the Internet is vulnerable. Access to services can be lost. It makes sense to analyze how an outage will impact your business and have a contingency plan. Example: If you're relying on the cloud for data or document storage, do you also keep a local backup?  Likewise it's wise to evaluate any cloud services. Can that functionality be duplicated on a local computer or your local network?

One other thing... Has a protocol been developed (and training provided) so your people know what to do next time the Internet goes down? It's a case where the old adage applies: "An ounce of prevention is worth a pound of cure." (As attributed to Ben Franklin.)