E-Business
The Case of Simultaneous, Short Duration DDoS Attacks
Over the last decade, DDoS attacks have proliferated, possibly becoming the primary threat for every website or web application.
The ultimate goal is to bring down sites by flooding them with fake requests, usually from multiple locations. The outcome of such attacks ranges from slow page loads to blocking legitimate traffic.
Among the thousands of DDoS attacks that happen every day, you’ll find attacks that last a number of days, as opposed to short-duration attacks that only take a few minutes for attackers to coordinate and launch at a time.
These attacks are becoming much more commonplace, whether the goal is to take a site down or if they’re used as a smokescreen to divert site owners’ attention.
In this article, I would like to share our real life experience with short-duration DDoS attacks, addressing what happens when this type of attack targets multiple sites simultaneously.
5 Short Attacks in 3 Days
We recently witnessed a three day, continuous attack that targeted two domains of a well-known bank.
On the first day, the bank suffered a significant volumetric attack that lasted five to six minutes, but consumed bandwidth at a rate of dozens of gigabytes per second.
Another attack, that lasted fifteen minutes, took place on the second day, targeting the second domain of the bank. On the third day, the same domain that was targeted the previous day was hit with a long duration attack.
We could see that the first and second attacks were reconnaissance attacks, executed to evaluate which of the two domains was more vulnerable. It is clear that the second domain was more susceptible since it was hit much harder in the third attack.
In parallel, we detected that there was another short-duration spike attack that targeted one of our Telco customers.
Just two hours later, there was another attack against a large utility organization. Because of this pattern, we were able to identify that all three attacks were performed by the same attacker and could warn and better protect our customers against further attacks.
Comparing the volume of bandwidth we’ve encountered on the first day of the attacks, to a DDoS attack’s average peak size of 7.39 Gbps, as reported by SCMagazine, we can see that short-duration attacks use large volumes of traffic in short, shotgun-like bursts.
Attackers leverage these short-duration attacks to evaluate which companies and organizations are easiest to infiltrate.
We assume that this also has to do with the availability of resources. These types of attacks are more likely to come from smaller, private groups that are shorter on resources, as opposed to criminal groups or countries which have access to unlimited resources and can therefore launch long-duration attacks from day-one.
Here’s what we’ve seen over time:
Mitigation
When it comes to short-burst attacks, time is of the essence. Attacks are likely to go under the radar and leave no time to respond.
Organizations managing multiple web domains must have the ability to centralize incoming data, preferably by working with the same security vendor across all their domains.
This enables them to predict attacks by analyzing trends and patterns across their sites. Organizations should demand this capability from their security vendors, who should also be willing to use data from various customers in order to predict potential attacks on other customers, as described in the above case study.
We see a growing number of short duration attacks across our customer base. Awareness to this new pattern is key: customers typically assume that the attack is over, while this may actually be a sign for a much larger attack coming through.
In light of this new pattern using services and tools that can aggregate attack information across customers and websites is an ideal way to predict and avoid the massive DDoS attacks about to come.
Yariv Hazony is VP Product at Sentrix, which provides protection against DDOS and other attacks against web applications, www.sentrix.com
E-Business
NITDA DG Harps on the Role of Innovation in Nigeria’s Sustainable Development
Kashifu Inuwa CCIE, the Director General, National Information Technology Development Agency (NITDA), has reiterated the critical role of innovation in driving Nigeria’s sustainable development, economic diversification, and global competitiveness.
Inuwa made this remark while delivering a keynote address at the 8th Annual Research Fair and Exhibition of Nasarawa State University, Keffi (NSUK), where he called on academia, industry leaders, and policymakers to embrace disruptive transformational innovation as a tool for addressing the nation’s challenges and unlocking its immense potential.
Speaking on the theme, “Disruptive Transformational Innovation; Shaping the Future,” Inuwa commended NSUK for organising an event that aligns with Nigeria’s pursuit of growth through knowledge-driven solutions.
Inuwa who was represented by the Deputy Director, eGovernment and Digital Economy Development Department, Engr Ya’u Garba, applauded the university’s increasing focus on transformation, noting that such initiatives reflect an understanding of the need for impactful innovations to address real-world issues.
Inuwa emphasised that while inventions remain a cornerstone of academic inquiry, their significance lies in their ability to move beyond theoretical exploration to become practical innovations. These innovations, he explained, have the power to reshape industries, tackle societal challenges, and accelerate national progress.
He urged institutions to prioritise creativity and bold thinking, ensuring that research outputs translate into tangible benefits for society.
Explaining the concept of disruptive transformational innovation, Inuwa described it as a profound force capable of altering established systems, processes, and products in ways that redefine societal functions. Unlike incremental innovations, which focus on improving existing frameworks, disruptive innovations introduce entirely new paradigms, addressing challenges in groundbreaking and previously unimaginable ways.
He cited historical examples such as the Printing Press, the Steam Engine, and Electricity, which have significantly transformed human existence and set the foundation for modern development.
Inuwa pointed out that Nigeria’s abundant human and natural resources present a unique opportunity to harness innovation for sustainable development. He called for a collaborative approach involving academia, industries, and government to build an environment that nurtures creativity, supports bold investments, and encourages inclusive growth. Such an ecosystem, he said, is vital for fostering homegrown innovations that can propel Nigeria to the forefront of global technological and economic advancements.
He further highlighted NITDA’s dedication to fostering innovation through various initiatives, including the National Adopted Village for Smart Agriculture (NAVSA) to digitally transform the agricultural sector, the National Blockchain Adoption Strategy to enhance digital trust and transparency, and the National Artificial Intelligence Strategy aimed at building a robust AI ecosystem in the country, among other impactful projects, which are part of the Federal Government broader strategy to position Nigeria as a leader in the global knowledge economy.
Inuwa also urged NSUK to deepen its commitment to innovation by establishing hubs that support facility-led startups, fostering collaborations with industry stakeholders, and equipping students with essential technological skills. He noted that such efforts would not only empower the university community but also contribute significantly to national development.
Inuwa expressed confidence in Nigeria’s ability to not only adopt global innovations but also create groundbreaking solutions that could influence the trajectory of Africa and the world.
He called on all stakeholders in the country to embrace the transformative power of innovation in order to drive sustainable development, economic diversification, and global relevance.
E-Business
Data Commission, NAICOM Partner to Safeguard Data in Insurance Industry
Nigerian Data Protection Commission (NDPC) and National Insurance Commission (NAICOM) have signed a Memorandum of Understanding (MoU) to protect data pilfering in the insurance industry.
The agreement was finalised on Friday and aims to address critical concerns around data privacy and ensure that the insurance sector complies with global best practices in data management.
Some of the objectives of a MoU include training and capacity building to enhance awareness and skills in data protection, setting up specialized clinics to address data protection concerns and provide guidance; conducting compliance activities by regularly, monitoring and enforcing compliance with data protection regulations and educating insurance companies on the importance of data protection and the benefits of adhering to best practices.
Mr Olusegun Ayo Omosehin, commissioner for Insurance/ chief executive officer, NAICOM, said, “The collaboration marks a significant milestone in safeguarding the personal data of insurance policyholders and promoting trust in the insurance sector”.
To ensure the effective implementation of the Memorandum of Understanding (MoU), an Implementation Committee will be established.
This committee will comprise representatives from the 2 agencies, as well as other key industry associations, including the Nigerian Insurers Association (NIA) and the Nigerian Council of Registered Insurance Brokers (NCRIB).
The committee’s primary responsibility will be to monitor progress, provide guidance, and facilitate collaboration among stakeholders to guarantee the successful execution of the MoU.
Officials from both NAICOM and NDPC have expressed confidence in the partnership’s potential to strengthen data privacy frameworks within the insurance sector.
They noted that the initiative would boost public confidence, enhance compliance, and position the sector for greater innovation and credibility.
This collaboration is expected to pave the way for a more secure and trustworthy insurance landscape in Nigeria, ensuring the protection of personal data while fostering the industry’s growth.
E-Business
NDPC to Begin Prosecution of Data Privacy Offenders from 2025
Nigeria Data Protection Commission (NDPC) will start prosecuting data privacy offenders from the beginning of 2025, according to Babatunde Bamigboye, head of the Legal Enforcement and Regulation Department of the commission.
This move is part of its efforts to enforce regulations and promote responsible data handling in Nigeria.
Bamigboye, disclosed this during a one-day cybersecurity awareness campaign with the theme “Utilising AI-Powered Services for Proactive Cybersecurity” in Abuja.
The event was organised by SOPHOS UK in collaboration with SPOKES Network and Net-Trix Solutions to foster networking with industry experts on how AI is shaping the future of cybersecurity.
Bamigboye explained that, due to the significant implications of data privacy breaches in Nigeria, the commission has embarked on awareness programmes to educate individuals on their data protection rights and inform data processors and controllers of their obligations.
To this end, he announced that beginning next year, the commission would prosecute any data controllers or processors found in breach of the law.
“At this moment, we have investigated quite a number of cases, and in terms of prosecution—as you know, as a lawyer, this means going to court—but we haven’t taken any matters to court yet.
“This is the formative stage; we understand the implications for the country as a whole. And usually, when you talk about prosecution, it also involves some criminal activities. So, at this moment, our focus has been on creating awareness.
“But from next year, we will step up enforcement in this area. What we have done so far is to take remedial actions against certain data controllers and processors who defaulted under the Act,” he noted.
He assured investors that Nigeria’s cyberspace is secure for digital transactions.
“Nigerian cyberspace is safe; otherwise, we wouldn’t be experiencing the smooth flow of digital transactions in Nigeria. It is safe but not without threats, and we are doing our best as a country to combat these threats.”
Christopher Odutola, a sales engineer at SOPHOS UK, noted in his presentation that 100% cybersecurity cannot be guaranteed, hence the need for proactive measures.
“A lot of people will come to you and say, ‘We can give you 99.9% or 100% cybersecurity.’ It’s not true.
“Nobody can provide 100% security anywhere in the world. What they can do, as I mentioned earlier, is reduce the risk for you. However, determining the extent of risk reduction is difficult.
“It’s impossible to eliminate 100% of risks anywhere in the world. What we provide is what we call a cybersecurity breach protection warranty. This warranty covers incidents such as data breaches or ransomware attacks. For instance, if you lose your files while we manage your SOC as a service, we will reimburse up to one million dollars in response costs.”
Odutola further stressed the importance of organisations reducing cyber threat risks to secure cyberspace.
“There are risks to businesses, risks from downtime, attackers, scammers, and the rest, trying to infiltrate networks.
“The risk is always high. As cybersecurity professionals, we are doing as much as possible to reduce these risks.
“The various security controls we implement—antivirus software, firewalls, email security, cloud security, network security, and others—are aimed at reducing risks. We must focus on minimising risks. For instance, we currently see risks originating from third-party suppliers and vendors.”
According to him, “We have a process called risk assessment, which helps to evaluate vendors to ensure they do not introduce risks into our environment. This is why these security controls are crucial.
“We have them in place. It’s equally important to involve senior management in the discussion, as this is often where the gap lies. Unfortunately, cybersecurity is often perceived as a cost centre.”
Harrison Oloye, chief executive officer (CEO) of Net-Trix Solutions, said the event aimed to raise awareness about cyber threats and equip users to manage potential attacks.
“What we did, as Net-Trix Solutions Limited in conjunction with Spokes Network, is to create awareness and educate the public and private sectors on how to use Artificial Intelligence (AI) to combat cyber threats.”
Speaking further on achievements in creating awareness, he said: “As part of our Corporate Social Responsibility (CSR), we educate and train as many people as possible on the dangers of cyber threats and cyber-related crimes.”
Ms. Sifon Ufot, head of Business at SPOKES Network, emphasised the need to take proactive measures against cyber threats.
“We need to stay cyber-safe because hackers working behind the scenes are not joking—they work 24/7. For us, staying proactive is essential. With the help of AI, we can stay proactive; it provides information beforehand and even prevents some attacks from reaching us.”
- E-Financial3 days ago
EFCC Says Nigerian Banks are Notorious Conduits of Financial Crimes
- Telecom3 days ago
NASENI Retreat Focuses on Aligning Development Institutes’ Goals
- News3 days ago
TEDxPAU 2024: Exploring New Possibilities and Shaping Tomorrow
- Uncategorized3 days ago
NIMC Introduces Paid National ID Card Amid Low Revenue
- E-Business3 days ago
Data Commission, NAICOM Partner to Safeguard Data in Insurance Industry
- E-Financial3 days ago
N159m Up for Grabs in Fidelity Bank’s GAIM 6 Promo
- Telecom19 hours ago
NCC, CBN to Resolve Telecoms, Banks’ USSD Debt Issue
- Telecom19 hours ago
Prof. Adewale Obadare Shares Key Insights on Breaking into Cybersecurity