I spoke at an Insight research and development forum today and used the room to ask what everybody was doing about denial-of-service attacks.
The answer was that nearly everybody had been hit.
Across the companies represented, most had dealt with a DDoS attack in the previous six months. Roughly half of those attacks had exceeded 100 gigabits per second. Many teams were using a proxy or another preventive layer. Several were using GRE tunnels with mitigation providers.
Shutterstock had spent the previous months in the middle of this problem. An attack had forced us to reconsider the network origin, the role of the proxy, private fiber into our mitigation provider, and the MPLS ring connecting our facilities. By May, I believed we were moving beyond the more common tunnel design by combining the private network with defenses we operated ourselves.
The forum gave us a useful comparison point. We were not uniquely unlucky, and we were not solving an imaginary future problem. Large attacks had become a current operating condition for internet companies.
It also showed how quickly the market had moved. Many of the people in the room had installed their protection only since the beginning of the year. Security talks were becoming a bigger part of the portfolio conversation because every company was suddenly budgeting, designing, and hiring around the same threat.
There is value in gathering this kind of informal field data. A vendor can explain what its platform stops. A public incident report can explain one company’s failure. A room of operators can show which patterns are repeating and which defenses are becoming normal.
I came away encouraged by our direction, but not relaxed. Being ahead of a curve does not mean the attacker stops moving. Our private connectivity was still being built, the design still carried cost and complexity, and the network team would have to operate it after the crisis energy faded.
The important signal was clear: DDoS defense was becoming part of normal infrastructure. We had to build it like a durable system, not a temporary shield we would remove when the attack ended.