DDoS and Cyber-Attack Prevention

Know the main attack families. You will tell flood, password, attachment and unpatched-software attacks apart by their signs, so you know which defence applies to which threat.

• Flood (distributed denial of service): many requests exhaust a service.
• Phishing: tricking people into giving access.
• Weak or reused passwords; unpatched software.
• Ransomware: files locked until payment; backups are the cure.
• Learn the main types: floods that overwhelm a service, stolen or guessed passwords, malicious attachments, and unpatched software, and note one real-world sign of each.
• Remember that attackers often use automated scans on every address they can find, so a small site is probed within hours of going online.
• Read your host's abuse policy and know how to report an attack to them.
• Learn how to tell a real surge in customers from an attack, using referrer and geography.

Activity. Match five attacks to the controls that reduce them.

Standard to meet. Choose five matches with reasons.

Common mistake. Thinking attacks only hit big firms.

Check yourself. Which attack worries you most and why?

You protect what you can list. You will list every public-facing service with an owner and rank it by tolerable downtime, so your protection effort goes to the critical items.

• Draw the path: user, name lookup (DNS), front service, server, database.
• List admin accounts and who holds them.
• Mark single points of failure.
• Note normal traffic by hour.
• List every public service, such as website, email, remote access and any device with an address, and note its owner and software version.
• Mark each item as critical, important or minor by asking how many hours of downtime the business can accept, and defend the critical ones first.
• List external services you rely on, such as payment or email, because their outage is yours too.
• Record the owner of each domain and certificate expiry dates.

Activity. Draw the path and write the normal traffic table.

Standard to meet. Mark single points and record normal numbers.

Common mistake. Not knowing normal traffic, so a spike cannot be seen.

Check yourself. What is your normal peak?

Most harm is stopped by dull jobs done on time. You will apply a patching routine, multi-step sign-in and account clean-up, which together block a large share of common attacks.

• Apply updates; remove unused services.
• Strong passwords plus a second step on all admin accounts.
• Least access: give only what a role needs.
• Close unused ports.
• Apply security updates promptly, with critical fixes first. Set deadlines in writing and keep a short log of what was patched and when.
• Turn on multi-step sign-in for all admin and email accounts, remove unused accounts, and require long passwords (many guides advise 12 characters or more).
• Turn on automatic updates where safe and schedule a monthly check.
• Use a password manager to avoid reuse.

Activity. Run a hardening checklist and fix the gaps.

Standard to meet. Complete the checklist and fix gaps with dates.

Common mistake. Leaving default passwords on routers.

Check yourself. List devices with default settings changed.

No single tool stops a flood; layers share the load. You will combine filtering, rate limits and a fallback page with provider support details, so a traffic flood is shared across layers.

• Use a filtering and caching front service.
• Set rate limits per visitor.
• Keep spare capacity and the ability to scale.
• Talk to your host before an incident, not during.
• Place a filtering service in front of public sites, set rate limits such as 100 requests per minute per address, and keep a plan to switch to a static page under load.
• Ask your provider what protection is included, what the traffic limit is and how to contact them quickly, and save the answers where the team can find them.
• Know the limits of your hosting plan, such as requests per second.
• Prepare a light "static" page to serve during an attack.

Activity. Set a rate limit and a cache rule on your lab service.

Standard to meet. Test the rule with a safe load.

Common mistake. Relying on one tool.

Check yourself. Which layers do you have?

You cannot respond to what you cannot see. You will set a few meaningful alerts routed to named people and review them weekly, so trouble is noticed while it is still small.

• Collect access logs and error counts.
• Alert on spikes, failed sign-ins and new admin accounts.
• Send alerts to two people.
• Review weekly.
• Set alerts on a handful of signals, such as response time over 3 seconds, error rate above 5 percent and failed logins above 20 per hour.
• Send alerts to two named people by message and email, and review the alert list every week; an alert nobody reads is the same as having none.
• Create a status page for customers on a different provider from your site.
• Review the alert list monthly and remove noisy ones.

Activity. Set three alerts and test each.

Standard to meet. Test that each alert fires in under 5 minutes.

Common mistake. Alerts that nobody reads.

Check yourself. Who gets each alert?

The last defence is a good backup. You will apply the 3-2-1 backup rule and time a real restore, proving you can recover within a goal you have set.

• Three copies, two kinds of storage, one away from the site.
• Test a restore on a schedule.
• Record time to restore.
• Protect backups from deletion.
• Follow the 3-2-1 rule: three copies, on two kinds of storage, with one kept offline or in a separate account, and write down the schedule.
• Test a restore every quarter and record the time it took; set a recovery goal, for example back in four hours, and see if you meet it.
• Encrypt backups and keep keys away from the backup location.
• Test a restore of one file and of the full system.

Activity. Restore a backup and time it.

Standard to meet. Restore time recorded and compared to target.

Common mistake. Backups on the same server.

Check yourself. Where is your off-site copy?

In an incident people forget; paper remembers. You will write a one-page response plan with roles, first steps and a printed contact list, so people act in order under stress.

• Roles: lead, technical, communicator.
• Steps: detect, contain, fix, tell, learn.
• Contact list: host, support, legal help.
• Decide who may shut the service and when.
• Write a one-page plan with who decides, who calls the provider, who tells customers and the first five steps to contain the problem.
• Keep a printed contact list, because email may be down, and note decision limits such as who may take a service offline.
• Print the plan and keep a copy off the network.
• Agree who may speak to the press and customers.

Activity. Write a one-page plan.

Standard to meet. Name every role, step and contact.

Common mistake. A plan nobody can find.

Check yourself. Where is your plan?

A drill turns a plan into habit. You will run a timed tabletop drill and record fixes with owners and dates, turning the written plan into a practised habit.

• Run a table-top drill: read a scenario and act it out.
• Time each step.
• Write three fixes with dates.
• Share lessons with the team.
• Run a 60-minute tabletop drill twice a year with a made-up scenario, such as a flood at 2 a.m., and note every step that was unclear.
• After each drill write three changes with owners and dates, and update the plan within two weeks while the lessons are fresh.
• Run a second drill with a different scenario, such as stolen credentials.
• Record every fix and check it six weeks later.

Activity. Run the drill and write the report.

Standard to meet. List three fixes with owners and dates.

Common mistake. Drills that skip communication.

Check yourself. What is your first public message?

Traffic jumps tenfold at 8 pm; the site is slow.

Question: First three actions?

Model answer: Confirm with logs, enable stricter filtering with the front service, tell your host, and post a notice.

An admin password leaks from another site.

Question: What do you do?

Model answer: Reset it, force a second step, check logs for use, and review other accounts.

On the slide: L1 Basic · Basics of safe use

Notes: Use strong, different passwords, install updates and explain why each protects an account. Notes: set up a password manager and change three passwords in front of a mentor. Standard: no reused passwords and automatic updates on.

On the slide: L2 Awareness · Awareness

Notes: Spot phishing messages and scams by sender, link and urgency, and say what to do next. Notes: run a spot-the-scam quiz with ten real-looking messages and mark them. Standard: eight of ten right, and the right action named for each wrong one.

On the slide: L3 Foundation · Foundation

Notes: Harden one set of accounts with a second sign-in step, recovery options and a list of connected apps. Notes: second step everywhere it is offered, and a note of what you removed. Standard: every account on the list passes a five-point check.

On the slide: L4 Practitioner · Practitioner

Notes: Monitor one small service with logs and alerts, and tell normal traffic from an odd spike. Notes: set an alert on a practice site, then cause a harmless spike and record the alert time. Standard: alert within five minutes and the log shows the cause.

On the slide: L5 Specialist · Specialist

Notes: Harden a small online service, set monitoring and alerts, and run a drill of a simulated flood with a written response plan. Notes: the plan names who calls whom, what is filtered first and how users are told. Standard: drill timings recorded, recovery step tested, plan updated after the drill.

On the slide: L6 Advanced · Advanced

Notes: Run a team through an attack drill and an audit, with testing done only by written permission. Notes: add a scope letter, a test plan and a report with ranked fixes. Standard: every test is inside the signed scope, and fixes have owners and dates.

On the slide: L7 Super expert · Super expert

Notes: Set the attack-response standard (detect, filter, escalate, report) and teach the teams who run it. Notes: review every incident each year and update the runbook and contact list.