Best Practice Detail

13-13-8561

Network Operators, Service Providers, Public Safety and Government should when a network element or server is under DoS attacks, evaluate the network and ensure the issue is not related to a configuration/hardware issue,. If it is not a configuration/hardware issue, determine direction of traffic and work with distant end to stop inbound traffic. Consider adding more local capacity (bandwidth or servers) to the attacked service. Where available, deploy DoS/DDoS specific mitigation devices and/or use anti-DoS capabilities in local hardware. Coordinate with HW vendors for guidance on optimal device configuration. Where possible, capture hostile code and make available to organizations such as US-CERT and NCS/NCC for review. This BP applies to Public Safety only in an NG9-1-1 environment.

Status: Edited

References/Comments:

Historical events:

Network Operators
Service Providers
Public Safety
Government
Cable
Internet/Data
Satellite
Wireless
Wireline
Cyber Security
Disaster Recovery
Emergency Preparedness
Public Safety Service
CSRIC VII: Edited By WG 4 In CSRIC VII