1. Prerequisites
Before starting this runbook, ensure the following:
- DDoS activity has been validated
- Incident ticket has been created
- Impacted services have been identified
- Service owners have been identified
- Network Operations team has been engaged
- Infrastructure teams have been engaged
- Cloud providers and third-party mitigation providers are identified
2. Step-by-Step Instructions
-
Assess Current Impact
Review:
- Service availability
- Traffic volumes
- Network utilisation
- Application health
- Customer impact
- Business impact
Determine:
- Current attack severity
- Immediate operational risk
- Mitigation urgency
Document findings.
-
Identify Available Mitigation Capabilities
Review available controls:
- CDN protection
- DDoS protection platforms
- WAF protections
- Cloud-native DDoS controls
- ISP mitigation services
- Traffic scrubbing services
- Load balancing capabilities
- Auto-scaling capabilities
Document available mitigation options.
-
Engage Mitigation Providers
Notify and engage:
- CDN providers
- Cloud providers
- ISP providers
- Managed DDoS mitigation providers
- Third-party network providers
Provide:
- Incident details
- Affected assets
- Traffic characteristics
- Current impact assessment
Document engagement activities.
-
Activate DDoS Protection Controls
Enable approved mitigation capabilities.
Examples include:
- CDN DDoS protection
- Cloud DDoS protection
- Traffic scrubbing
- Advanced WAF protections
- Bot mitigation controls
- Network-level filtering
Validate successful activation.
Document actions performed.
-
Protect Critical Services
Prioritise protection of:
- Customer-facing services
- Authentication services
- Revenue-generating services
- Regulatory-sensitive services
- Executive communication systems
- Core infrastructure
Implement service-specific protections where required.
Document priorities.
-
Coordinate Infrastructure Scaling
Review:
- Auto-scaling status
- Load balancing capacity
- CDN capacity
- Cloud resource availability
- Application resource utilisation
Increase capacity where approved and appropriate.
Document scaling activities.
-
Monitor Mitigation Effectiveness
Review:
- Traffic volumes
- Error rates
- Response times
- Availability metrics
- Customer impact metrics
Determine:
- Whether mitigation is effective
- Whether additional controls are required
Document findings.
-
Escalate Additional Mitigation Requirements
If attack impact persists:
- Escalate to network leadership
- Escalate to infrastructure leadership
- Escalate to cloud providers
- Escalate to executive leadership where required
Request additional mitigation resources.
Document escalation actions.
-
Coordinate Stakeholder Communications
Notify:
- Incident Commander
- Security leadership
- Infrastructure teams
- Business owners
- Customer communications teams
Provide:
- Current impact
- Mitigation status
- Recovery expectations
- Ongoing risks
Document communications.
-
Update Incident Record
Record:
- Mitigation controls activated
- Provider engagements
- Infrastructure changes
- Scaling activities
- Mitigation effectiveness
- Escalation actions
- Stakeholder communications
Attach supporting evidence.
3. Post-Action
Upon completion:
- Ensure mitigation controls have been documented
- Ensure provider engagement activities are recorded
- Ensure service protection measures are documented
- Ensure mitigation effectiveness has been assessed
- Ensure stakeholder communications are recorded
- Ensure supporting evidence is attached
- Ensure incident ticket is updated
Contributor
Vishal Thakur GitHub: https://github.com/malienist
Contributed to the Arcana Incident Response Documentation Framework.