DDoS protection: how we provide the ideal mix of security and flexibility for operators

DDoS attacks grew by 19% in 2020, fueled by increased use of home working and online services. As network providers; operators are the unwilling transporters of these attacks which can greatly damage their B2B customers’ revenues and reputation. As such, operators can also play a major role in protecting their customers against these cybercriminals. Anthony Murphy, Network Security Expert, and Anne Couturier, Security Product Manager, explain how Orange can help.
 

Why should operators invest more in protecting their customers against DDoS attacks?

Anthony Murphy: 
Telecom operators are network providers for their B2B customers and DDoS attacks transit through their networks. You could say that it’s each company’s responsibility to protect their assets against DDoS attacks. However as DDoS attacks increase in size and complexity, most companies, especially SMBs, do not have the expertise, infrastructure or financial resources to implement an in-house DDoS Protection solution.

Telecom operators and specifically those who operate a Tier 1 internet backbone are best positioned to propose a network-based managed anti-DDoS service. They already have a core network infrastructure which can absorb even the largest attacks and are better able to invest in large scale state-of-the-art solutions. These can then be proposed to the operators’ B2B customers. The operators will be able to make a good return on their investment by selling the service to several customers.

In addition security services are real value-added services that operators can use to monetize their network services, improve customer experience and increase customer loyalty.

Anne Couturier:
I would add that Telecom operators and Internet Service Providers (ISP), have been classified as Operators of Vital Importance (OIV). As such, their obligations to protect their business from failure are being reinforced, and that includes enhanced cybersecurity.

In 2016, the EU imposed cybersecurity requirements and incident reporting obligations on operators of essential services and digital service providers. This was called the NIS directive. The EU is now working on an updated version, the NIS 2 Directive, which will make Cybersecurity management and reporting obligations even stricter. Fines for non-compliance could start at EUR10 million or 2% of the total worldwide turnover.

How is Orange helping operators to deliver DDoS services like these?

Anthony Murphy:
We have deployed an online DDoS protection solution with multiple scrubbing centers, strategically placed in our IP network around the globe. In this way we can clean our customers’ international data traffic as close as possible to the origin of a DDOS attack. This is important as it avoids overloading the network and allow us to maintain high levels of quality of service (QoS) for all our customers.

The way our solution is deployed in our network means we can clean the traffic of an individual host which is under attack. There is no need to redirect all the customer traffic to the nearest scrubbing center.
In terms of QoS, this is ideal: only the targeted host will be diverted, while the rest of the customer’s traffic will follow its normal path to its destination. This means the quality of service will be maintained, and the scrubbing will be transparent to end users. 

Our strength relies on our ability to absorb even the largest attacks. With local solutions, operators may not have sized their platforms to support the very rare but highly destructive terabit-sized attacks. Even if the platform is sized correctly, the local network may end up congested on the interconnections between the ISP and its B2B customer, or between the ISP and its Tier 1 provider. On our side, our entire IP network is configured to carry and clean the largest volumes of traffic.

Anne Couturier:
Another important benefit of our offer is its flexibility. We’re not asking operators to get rid of the platforms they may have locally. Our solution can perfectly complement them. Operators can purchase a number of mitigations from us and decide to only use our solution for the attacks their platform cannot handle.
This saves them money both immediately and in the long-term. Their investment is worthwhile, but they don’t need to spend further CAPEX to deal with the newest, largest and most complex attacks.

Finally, our multi-transit option has been designed to make our customers' lives easier: we can clean traffic coming from other service providers. Even if they use several IP Transit providers, our ISP customers can rest assured that all their traffic will be protected by a single DDoS Protection solution.