After an external IT audit, to mitigate DDoS attacks, which countermeasure would you implement?

After an external IT audit, to mitigate DDoS attacks, which countermeasure would you implement?

• A. Enable BGP
• B. Enable direct broadcasts
• C. Disable BGP
• D. Disable direct broadcasts

Answer: (D)

Direct broadcasts can be abused to fuel DDoS attacks, specifically through reflection and amplification techniques like the classic Smurf attack. When directed broadcasts are allowed, an attacker can send a spoofed ICMP request to the broadcast address of a subnet, and every host in that subnet replies to the intended victim, massively increasing the traffic directed at that target. Disabling directed broadcasts eliminates that amplification path. Without the ability to broadcast to all hosts in a subnet, the attack vector is removed and the network becomes much less susceptible to this form of DDoS. Enabling or disabling BGP doesn’t directly address this amplification mechanism. BGP is about routing between networks and doesn’t stop spoofed traffic or reflection-based floods. So the most effective move in this scenario is to disable directed broadcasts to reduce exposure to this DDoS vector.

Direct broadcasts can be abused to fuel DDoS attacks, specifically through reflection and amplification techniques like the classic Smurf attack. When directed broadcasts are allowed, an attacker can send a spoofed ICMP request to the broadcast address of a subnet, and every host in that subnet replies to the intended victim, massively increasing the traffic directed at that target.

Disabling directed broadcasts eliminates that amplification path. Without the ability to broadcast to all hosts in a subnet, the attack vector is removed and the network becomes much less susceptible to this form of DDoS.

Enabling or disabling BGP doesn’t directly address this amplification mechanism. BGP is about routing between networks and doesn’t stop spoofed traffic or reflection-based floods. So the most effective move in this scenario is to disable directed broadcasts to reduce exposure to this DDoS vector.