Business Continuity Can Address Denial Attacks

April 9, 2003 -- (WEB HOST INDUSTRY REVIEW) -- The adversity inherent in war should lead mission-critical news and government Web sites to reinforce their online resources with business continuity services.

Business continuity services provide large organizations with the infrastructure necessary for physical and IT architecture recovery in times of adversity. Comprehensive continuity services protect the assets, reputation and even the existence of a large enterprise if an emergency severely effects its online operations. Emergencies can assume the form of natural disasters, catastrophic network and equipment failures or hacker attacks.

With the advent of the second Gulf War, many organizations are potentially subject to the strain of increased network traffic and denial of service attacks. To prevent the ill effects associated with increased requests or attacks, organizations need to quickly implement services that provide redundant capacity for their Web sites during times of adversity.

Business continuity services allow organizations to quickly implement strategies that ensure that their Internet-based data is protected and is made available to all key authorized users rapidly after a security incident. Such services are useful to ensure excellent quality-of-service during times of financial and geopolitical uncertainty. The services act as an insurance mechanism to restore data and public Web servers in the case of attack, or to replicate data and services in the event of poor backbone performance.

Mainly during the first weeks of conflict in Iraq, Internet backbone performance has been excellent. According to Keynote (keynote.com), there did not appear to have been any attacks directed against the Internet backbones itself, whether through physical problems or through flooding with traffic (e.g., the "slammer" or "sql-hell" worm of January 2003).

Problems were experienced however by the controversial Middle Eastern news service, Al-Jazeera. Both its Arabic site and its new English-language site experienced massive problems and were inaccessible from browsers in the U.S. for a long period of time last month. The problems were attributed to a hacker attack against Al-Jazeera's domain name records. Technically known as a "redirect," the hack caused Web browsers that attempted to go to (aljazeera.net), as well as the English-language site, to be surreptitiously redirected to content hosted elsewhere.

Visitors to both versions of the site were greeted with a pro-American message during this redirect attack. While that problem was corrected by eliminating the redirect and reinstating the correct addresses for Al-Jazeera's sites, the sites also concurrently experienced a denial of service attack which made them unreachable. As a result, the Al-Jazeera online presence was totally incapacitated for one day, causing the FBI to open an investigation into the attack.

Attacks with these same characteristics have been seen over the past few years at other Web sites, according to Keynote. An effective method to combat such incursions is by (i) ensuring the security of the domain name and (ii) by implementing business continuity services. Network administrators can endeavour to protect their domain names through the use of secure domain registration practices. The implementation of comprehensive continuity services can also provide robust capabilities in the form of added server capacity, during the event of a tremendous spike in network traffic.

The structured replication of data in different geographical locations allows data to come "on tap" in the event of any network or server outage. Such a strategy, used in conjunction with a secure domain name record, can ensure that Web sites experience minimal downtime in the event of attack. The most important consideration is to co-ordinate such business continuity services properly. Incorrect or ad-hoc co-ordination of data replication architectures can lead to service instability and frequent service provider turn over.