DoS/DDoS resilience testing

What we test

With controlled DoS and DDoS testing we assess how resilient your infrastructure, network services and applications are to attacks aimed at reducing their availability or exhausting system and network resources.

In a controlled environment we simulate different attack scenarios and monitor how the infrastructure responds and how effective the protective mechanisms already in place are. We establish the load levels at which service performance begins to degrade, how firewalls, DDoS protection systems and other security controls react, and how quickly the environment returns to normal operation once the attack ends.

The scope of testing, the target IP addresses, applications and services, the time of execution and the maximum permitted attack intensity are always agreed with the client in advance. Testing is carried out in a controlled manner and within agreed time windows, so as to reduce the risk of unwanted impact on business operations.

Volumetric attacks (volume-based)

By simulating large volumes of network traffic we test the capacity of the internet connection and the effectiveness of protection against volumetric DDoS attacks. To generate distributed traffic we use dedicated server resources, including cloud infrastructure. The maximum volume of traffic generated is agreed with the client in advance.

Network and protocol attacks (L3 and L4)

We test the resilience of network infrastructure and services to attacks aimed at exhausting connections, sessions or other system resources. Testing may include:

• TCP attacks, testing resilience to SYN floods and other forms of TCP connection overload,
• UDP attacks, testing how the infrastructure responds to large volumes of UDP traffic,
• ICMP attacks, testing the resilience of the network and security devices to increased ICMP traffic.

Application layer attacks (L7)

At the application layer we test the resilience of web applications, APIs and back-end systems to an increased number of requests that closely resemble legitimate ones. By simulating HTTP and HTTPS load we assess how the application and its infrastructure respond to a sudden rise in requests, and whether the protective mechanisms in place detect and limit the attack effectively.

What you receive after testing

On completion we prepare a report covering the scenarios carried out, the loads reached, the response of individual systems and the limitations identified. We highlight the points at which service performance degraded or services became unavailable, and provide recommendations for improving DDoS protection, network architecture, security device configuration and application resilience.

Testing therefore does not answer only whether a service can be overloaded. Above all it shows where the limits of the existing protection lie and how to increase the resilience of the environment to a real DDoS attack.