The Dyn DDoS Attack: Two Key Lessons for Cyber Security

Over the course of several hours on October 21st, 2016, access to a number of major internet sites were disrupted for several hours, including Twitter, Paypal and Spotify. This was the result of a massive Distributed Denial of Service (DDoS) attack on Dyn, an Internet infrastructure company in New Hampshire. Dyn offers Domain Name System (DNS) services, essentially acting as an address book for the Internet.The DDoS attack blunted the ability of the DNS address book to work by swamping it with massive numbers of requests, resulting in the inability of users to connect with the servers of the companies which utilized Dyn's DNS services.

The motivation and identity of those responsible for this attack is being investigated and there will certainly be a lot to learn from this event. For me, there are two immediate lessons that stand out when it comes to cyber security today:

1. Cyber security needs to be embedded into the IoT.

One very interesting fact to emerge from this attack was that it seemed to have used hijacked devices such as webcams, as the basis for creating a massive botnet. Essentially, the attackers hijacked poorly secured Internet of Things (IoT) devices and turned them into a potent DDoS weapon. While individual IoT devices may not have much power or capability on their own, bringing together a large number of them changes the picture significantly as this attack seems to have proven. A lot has been said about the need to secure the IoT and much of the debate tends to be centered around protecting the owners of these devices from breaches and other attacks. But there is a bigger problem here as unsecured IoT devices can have a large impact when they are hijacked and used as a massive botnet. This is yet another reason that we need to ensure that cyber security is not an afterthought when it comes to the IoT and connected devices of the future. It's not just about our own cyber security, it's about everyone's cyber security.

2. Your biggest cyber security vulnerability may be your dependencies.

Organizations can end up spending significant amounts on cyber security and on ensuring that customers are able to access their on-line services reliably. But what happens when your organization is dependent on a third party to ensure that the connection to your customers works? It means that no matter how much you spend on your security, a key potential area of vulnerability will remain out of your control. This DDoS attack was targeted at Dyn, not at any of the organizations that suffered an outage as a result of the attack. When we look at our cyber security posture and vulnerabilities, are we considering the impact from third parties outside our control that play a critical role in connecting us with our customers? Any provider which we are dependent on to provide a reliable service needs to be part of our cyber security considerations.

October happens to be Cyber Security Awareness Month in a number of countries across the world and these are certainly two timely lessons that we need to learn now. We can no longer think of IoT security as someone else's problem because it can affect us all. And we need to factor in our dependencies, especially those outside of our control, when we assess the risk to our systems from a cyber attack. Unfortunately, I am certain that there will be more lessons for us to learn in this rapidly evolving landscape in the coming months and years.