How We Organize Large-Scale DDoS Exercises in the Netherlands
No ratings
Presented at BlackHat Europe 2022 by
In the Netherlands, following a large number of DDoS attacks experienced in January 2018, it was apparent that things needed to change. Specifically, we decided to implement the concept of cooperative DDoS mitigation at the national level. To that end, we set up the Dutch Anti-DDoS Coalition, a national voluntary consortium of seventeen organizations from various sectors. The coalition members include ISPs, banks, internet exchanges, not-for-profit DDoS scrubbing centers, government agencies, and the Dutch Tax and Customs Administration. While the backgrounds of the coalition members differ significantly, they share a common goal: to improve the resilience of Dutch online services by fighting DDoS attacks on a cooperative basis across organizations and sectors. The Coalition is unique because we utilize a combination of complementary collaborative capabilities:1. We have shared expertise and experience among coalition members.2. We are sharing metrics and characteristic properties of DDoS attacks.3. We are jointly carrying out DDoS exercises.4. We are providing the public with information about DDoS attacks.5. We are promoting security standards that help to protect against DDoS attacks.We're initially focusing on "critical" service providers; further phases will extend to include other organizations.The Dutch Anti-DDoS Coalition will be discussed during the presentation, briefly introducing the various working groups. One of the working groups is organizing large-scale DDoS exercises. The working group organizes large scale DDoS exercises in a RED/BLUE team setting twice a year, currently working towards a PURPLE team environment.We will discuss the technical as well as the organizational and legal aspects of organizing such an exercise.