DDoS attacks: should NATO have a strategy?

Does Estonia’s experience suggest the West needs to work together to combat cyber attacks?

In May 2007 it looked like a new kind of war had broken out: a cyber war, with one nation bombarding another with distributed denial of service (DDoS) attacks, bringing its e-government services to its knees.

The DDoS frenzy endured by Estonia was closely monitored by Western defence chiefs, particularly at NATO. The Estonian government wanted the US-European alliance organisation to intervene on its behalf; even The Economist magazine felt that it might be called to. But should a traditional military-orientated organisation like NATO have a DDoS strategy?

Hypothetical DDoS attacks possible
There has been little evidence to back up the original assertions that the Russian government were behind the DDoS attacks on Estonia. However, the hypothesis remains in principle: it would be perfectly possible for one government to create a new model army of zombie “bot” computers that it could control to launch a concerted DDoS attack on another country’s government.

In the Estonian case, government websites including those of the foreign and justice ministries were unavailable for days, and privately-owned banking and media sites were similarly affected.

Potential effects of a DDoS attack
Government websites are not yet essential for the running of a country, of course, but attacks on the British Revenue & Customs website and the loss of some other government services would prove inconvenient for millions of people.

Attacks on banking services could prove more crippling to the economy, while paralysing media sites would create a culture of disinformation and even panic, exacerbating the overall effect on the public.

Are DDoS attacks a job for NATO?
That said, is this a job for NATO? Even the organisation itself couldn’t answer the question at the time. A senior NATO official said, “If a member state's communications centre is attacked with a missile, you call it an act of war. So what do you call it if the same installation is disabled with a cyber-attack?”

Two of NATO’s top experts in internet warfare were sent to the Estonian capital – but only in to monitor the effects of the DDoS attacks, not to manage or retaliate against them.

The senior government official who chairs Estonia's cyber-defence co-ordination committee, said that Nato and the EU had to establish a response to DDoS attacks. "The EU and Nato have to work out its doctrines and position on these kinds of attacks and how to deal with them," he said.

The Economist tentatively agreed, saying “the best defence [to DDoS attacks] is to have strong networks of servers in many countries. That is not yet NATO's job. But it may be soon.”

DDoS attacks: protection remains individual’s responsibility
Whether a concerted response is needed, or even possible, remains to be seen – and in the meantime, it is up to individual businesses and government organisations to protect themselves as best as possible before they suffer the same kind of attacks Estonia did.
 
Webscreen is an IT network security technology designed to protect web servers and other network appliances from a DDoS attack. Its unique Guarantee of Service (GoS) technology lessens the impact of DDoS attacks and lets IT managers maintain access for critical system users and important customers during periods of high network activity.

Webscreen also includes a range of network optimisation and monitoring tools to help deliver maximum performance from your network infrastructure resources. To find out more, call 0870 3890022.