How we measure your readiness during DDoS Testing?
One of the benefits offered by our DDoS testing is objective and accurate measurement of your readiness for an attack.
Upon completion of DDoS testing, you get a detailed report that includes a DDoS Resiliency Score (DRS) – a numeric value clearly indicating the type of attacks your system can currently withstand and more severe attacks that it cannot.
The DRS introduces a common language for communicating the status of DDoS among all stakeholders: managers, technical teams, and external consults. Management need not understand, for example, the ins and outs of SYN floods and pipe saturation to realize that a DRS score of 4.7 is an improvement over a previous score of 3.5.
The Seven Levels of the DRS Score
Like the Richter scale for earthquakes, the DDoS Resiliency Score (DRS) is structured around a hierarchy of attack severity, which grows exponentially.
It has seven primary levels, representing progressively more serious DDoS attacks. Each level introduces additional types of attacks, greater sophistication, more attack vectors, and larger volumes of traffic.
- Level 1 (“poking”) – A very basic probing attack, intended to check for any DDoS resiliency whatsoever, with only two vectors and a low traffic rate.
- Level 2 (“script kiddy”) – A primitive DDoS attack that adds a UDP Flood and slightly increases the traffic rate.
- Level 3 (“basic”) – This DDoS attack uses multiple attack vectors and consumes more bandwidth.
- Level 4 (“sophisticated”) – This level is the first to include sophisticated attack vectors, such as you see with UDP Amplified Reflected attacks.
- Level 5 (“persistent”) – Persistent attacks are multi-vector, with greater sophistication and increasing volume while simultaneously looking for weakness in the target system (such as an Advanced Persistent Attack or APT).
- Level 6 (“extreme”) – Sophistication and volume increase, and unusual or exotic attacks are introduced as well.
- Level 7 (“state-sponsored”) – This level uses all known techniques to penetrate DDoS defenses and paralyze the targeted system.
Case Study
At Red Button, we use DRS in virtually all of our services –testing, 360, hardening, and incident response.
For example, read this case study of a large bank, whose initial resiliency score was 3.0. After hardening their system based on our recommendations, their DRS jumped to 4.7 in follow-up testing. If the bank takes the next step and integrates the additional technologies and architectural optimizations we suggested, then they will most likely increase their score to about 6.5.
Click here to delve even deeper into the DDoS Resiliency Score standard, with complete documentation.