When most people hear the term Geo-Blocking, they immediately think of Netflix. When you’re trying to watch a video on a streaming service, you might find the video isn’t available in your country. It can be annoying, but there are many ways around this simple blocking. But when it comes to DDoS security and protection, the term geo-blocking has a different meaning.
Geo-blocked content can be found not only on streaming services but also on online stores that limit sales to specific regions. Governmental entities also prevent access to services like WhatsApp or Twitter. To put it simply, geo-blocking prevents access to online services, based on the perceived location of the system or user attempting to access that resource.
In broader terms, geo-blocking is preventing service based on the region associated with the IP of the sender. It can take the form of network-level actions, such as discarding IP packets. But on the other hand, it can also function as an application-level action, by configuring the application to decline or disregard the requests. Geo-blocking typically lacks precise knowledge of the requester’s location. Instead, it deduces this location using available information, starting with the IP address associated with the request’s origin.
How to use geo-blocking in DDoS protection?
When it comes to DDoS security, geo-blocking is a common yet not highly effective method of DDoS mitigation. Many DDoS protection services use geo-blocking to block malicious traffic using IP geolocation software. Enterprises reject traffic originating from locations that have had a history of launching DDoS attacks. For example, Sudan, Russia, and other countries that may have sponsored DDoS attackers. So once a DDoS attack hits an organization and damages its online services’ availability, the DDoS protection service will first try to use geo-blocking to prevent the malicious traffic from hitting the targets.
But… legitimate traffic from these areas will also end up being blocked – in essence, geo-blocking doesn’t only limit regular traffic but also hampers the expansion of business activities. And yet, despite this challenge, organizations frequently view geo-blocking as a convenient solution to try and mitigate DDoS attacks.
But as time has progressed, we’ve come to understand that DDoS threat actors are clever and adaptable. They manage to circumvent geo-blocking algorithms by spoofing their IP addresses.
Why can’t you rely on geo-blocking alone?
Geo-blocking may appear as a straightforward and accessible solution. But, its efficacy is limited when countering a DDoS attack of higher launched by a skilled attacker. An attack that is complex and adaptable will pose a challenge to your DDoS protection. In many instances, geo-blocking lacks precision, offering only a rough estimation that relies on a “best guess” approach to display information.
Usually, geo-blocking ultimately fails when the attacker spoofs the source IP or uses a reflection attack based on location. The attacker will spoof its IP or even use a reflection attack from the victim’s own region, thus turning geo-blocking useless.
With the surge of DDoS-as-a-service, geo-blocking proves inadequate in countering DDoS attacks, given the increasing sophistication of DDoS-for-hire services. DDoS threat actors are adopting complex strategies, escalating to more intricate attacks that they market for as little as a few hundred dollars.
What can you do instead?
To adopt the new approach of DDoS security and make sure the organization can block a successful DDoS attack, security teams and stakeholders must first accept that the old approach of waiting for an attack to happen isn’t working. DDoS attacks have become the leading weapon of choice for threat actors in recent years. The results speak for themselves – countless hours of downtime, tremendous financial losses, and very angry customers.
Organizations must take proactive steps to build their DDoS resilience. Regardless of the DDoS protection service, the fact remains that organizations spanning various sectors, including finance and gaming, are highly vulnerable and exposed to DDoS attacks. The only way to maintain DDoS resilience is to adopt non-disruptive testing.
Organizations and their protection vendors must perform continuous DDoS testing on live environments to uncover vulnerabilities, prioritize remediation, and validate that the fixes were performed correctly. The old way of protecting online services against DDoS attacks has become ineffective. Geo-blocking as a sole solution or even as an immediate response is outdated. It is time to move from reactive to preemptive in order to stay ahead of the threat curve.
