[AusNOG] DDOS mitigation

[Dobbins, Roland]

On May 12, 2013, at 9:33 AM, Chris Chaundy wrote:

> I can vouch that it is a non-trivial and expensive process to put in place and unless senior management see some return-from-investment from it, it is unlikely to attract their approval.

Barry Greene & I devised the concept of commercial DDoS mitigation services and coined the phrase 'Clean Pipes' back in 2002 in order to create a funding base/prioritization scheme for ISPs to actually implement the various network infrastructure-related BCPs which never seemed to bubble up to the top of the work-order heap, as they were constantly pushed aside by end-customer-related work-orders which had revenue attached to them.

So, the whole thing was essentially a Trojan Horse to induce network operators to do what's necessary to protect their networks (and, by extension, all other Internet-connected networks) - after all, one can't very well backhaul DDoS attack traffic around on one's network without at least implementing the basics, heh.

;>

Moving forward, my hope is to engage insurance actuaries and underwriters in order to educate them as to a) the risks their clients face in terms of loss of availability and how that can potentially affect the probability and scope of potential business risk policy pay-outs and b) that there is a series of BCPs which their clients can implement which greatly reduces those risks and the probability and scope of said pay-outs, so that the insurance industry will essentially force network operators (enterprises as well as MSSPs) to implement the BCPs in order to qualify for the various insurance policies which are legislatively/regulatorily mandated for the business sector(s) in which they participate.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

	  Luck is the residue of opportunity and design.

		       -- John Milton