What does Feedly, Evernote, Meetup, Aweber, PlentyofFish, StatCounter, WPEngine, and Krebsonsecurity have in common? They’ve all experienced volumetric DDoS attacks, and most have been knocked off line. PlentyofFish was disrupted by an 80Gbps DDoS attack, and Meetup was knocked off line by an 8Gbps DDoS attack. In both cases, the use of a CDN would’ve prevented the DDoS attack from knocking them offline. According to the Verizon “Data Breach Investigations Report” published in April 2014, SQL Injections were used in 80% of the cyber attacks on retail web applications. For the CDNs, it’s no longer a question of “should we invest in comprehensive DDoS capabilities” but the question is now “how come we didn’t invest in this capability six months ago”.
How do application layer attacks and volumetric DDoS attacks alter the CDN landscape? It simply means that CDN players without that capability need to consider otherwise, or they will be at a competitive disadvantage. At one time, the hot new CDN feature was DSA, then FEO, followed by WAF. Today, the hot new CDN feature is DDoS Scrubbing Center, and comprehensive DDoS Mitigation Services. CDNs without this capability are being left behind, and must decide on whether they should build a DDoS Platform or just buy a DDoS-in-a-box solution from the likes of Radware or Cisco.