DDoS Attacks On The Rise In Africa

Internet usage in Africa has grown exponentially in recent years, with around 570 million internet users in the continent in 2022  – more than double compared to 2015.  As digital growth accelerates, so does the risk of cyberattacks as threat actors see the potential to target organisations whose systems aren’t prepared for their sophisticated methods.

The digitalisation of Africa has increased the amount of technology present in the region, giving threat actors more bases to enter through. This exposes organisations to significant vulnerabilities.

Distributed Denial of Service (DDoS) cyberattacks are an incredibly damaging method being deployed in Africa by threat actors. They have the potential to cause widespread disruption and a recent example of this was a DDoS attack in Kenya which saw citizens unable to access essential services on the country’s e-Citizen platform. These services included buying electricity tokens and making mobile transactions. This came just weeks after the Kenyan government expanded the platform to make 5,000 government services available on the portal to give the public easier access to departments.

Evidently, African security teams need to equip themselves with the right threat detection, protection, and mitigation tools to safeguard their data and ensure customers don’t lose access to vital services.

The Dangers Of DDoS

DDoS attacks involve threat actors connecting multiple online devices and then using them to overwhelm a site with enormous amounts of internet traffic. By inundating the site with this artificial traffic, threat actors can succeed in disrupting it, preventing users from accessing products or services and potentially eroding customer trust in the organisation. These attacks take advantage of network connectivity. As Africa continues to undergo digital transformation, organisations increase the amount of technology they’re utilising, which is interconnected through the internet.

Attackers have a variety of methods for carrying out cybercrime. They can use multiple infected or “bot” computers to carry out tasks simultaneously. These botnets are capable of executing large-scale attacks, with threat actors then assuming control of an organisation’s devices. It is also possible for threat actors to target applications. As more applications are developed, it increases the attack surface as they have vulnerabilities written into their code that cybercriminals can hunt and exploit. Reflection attacks are another popular method in which threat actors spoof a target’s IP address and send a request for information. This typically uses the User Datagram Protocol (UDP). The server will then respond to the request and answer to the IP address.

The motivations for DDoS attacks can range from political to financial. Threat actors often target organisations that provide essential services, such as government and healthcare sectors, to cause as much disruption as possible.

The impacts of DDoS attacks can be devastating, with organisations facing costly revenue losses as a result of the disruption. Gartner estimated that businesses can lose an average of well over $300,000 per hour of downtime caused by an attack. To add to this, organisations are also hit with further consequences including the costs of recovering IT systems and damage to brand reputation. It is possible threat actors will ransom the organisation or even use the attack as a distraction tactic for launching more malicious attacks.

These critical consequences make it all the more crucial to protect against DDoS attacks. Learning how to identify the early signs of an attack and how to protect against them can mitigate the damage threat actors cause and give organisations back control over their security outcomes.

Identifying And Mitigating DDoS Attacks

Cybercriminals can face significant punishment for perpetrating a DDoS attack, including years of prison or a fine. There are also legal implications for businesses to consider as victims of an attack if they haven’t followed the correct procedures. Claims could be raised against service providers for failing to provide contractually guaranteed service levels. The theft of confidential customer data could also result in suits being filed against the organisation. To avoid falling victim to an attack, organisations can take a number of steps to prepare themselves.

Prepare Your Response

Anticipating an attack and understanding the effect it can have on the business is the first step in minimising the damage it can cause. Developing an effective incident response plan is a necessity and can save valuable time when responding to an attack. This involves creating a dedicated team and identifying the organisation’s critical assets and vulnerabilities.

Teams can then divide roles and responsibilities and draft a plan of appropriate responses against cyberattacks. A plan will keep teams organised and shorten response time, lessening the damage threat actors can do. It is also important to regularly test this plan and identify any further weaknesses that can be addressed before a real attack occurs.

Know The Signs

DDoS attacks exhibit various symptoms that organisations should become familiar with. These can resemble non-malicious availability issues, such as technical problems with a network. Other symptoms can include:

• Inability to access a particular network service and/or website
• Slow or unresponsive servers
• An unusually large number of requests in a short time span from a single IP address or a range of them
• Analysis of logs indicating a sudden and large influx of network traffic
• Abnormal patterns in traffic, for example, spikes at odd hours of the day
• 503 errors appearing on the organisation’s websites

Deploy The Right Tools 

One of the most efficient ways of detecting and identifying a DDoS attack is monitoring and analyzing network traffic. Deploying a Security Information and Event Management (SIEM) solution is integral in detecting malicious activity across networks. SIEM platforms allow organisations to identify this activity in networks, system servers, applications and across users.

They can utilise automated rules to spot any suspicious activity and then identify its source. SIEM in combination with skilled security analysts can help avoid damage from threat actors by detecting DDoS attacks and then choosing an appropriate response.

Security teams can also use a firewall to prevent unauthorized access into or out of their systems. By developing a list of rules for the firewall, it can determine whether traffic can enter or exit a network, helping to ensure threat actors cannot reach important data.

Harness Powerful Collaborations

Collaboration is another key aspect of countering DDoS attacks. Governments and businesses have a shared interest in fighting fraud, and they can work together with their complementary strengths. For example, businesses can observe threats within their systems and provide governments with intelligence and the methods threat actors are using. Governments can then provide legal consequences such as financial sanctions to deter criminals.

Taking Back Control

DDoS attacks will remain a key challenge for organisations as Africa continues towards digitalisation and introduces more technology, such as IoT devices, AI, and 5G connections. By being aware of the signs of a DDoS attack and analysing networks/systems constantly, security teams can catch criminals before the damage is severe. Responding quickly and in an organised manner can stop systems from being disrupted, and customers’ trust being compromised. DDoS attacks are not an issue that can be ignored, and businesses must learn to overcome the threats to their systems.

This article was written by Mazen Dohaji, Vice President & General Manager, LogRhythm (iMETA).