MazeBolt’s clients include Fortune 1000 & NASDAQ-listed companies in more than 50 countries operating in 20 languages. One of our clients is a global enterprise with more than 1,000 employees across almost 15 locations. A successful DDoS attack would stop them cold.
That client recently told us a bit about the experience undergoing MazeBolt’s comprehensive BaseLine testing process.
*At the client’s request, we agreed to anonymize its name.
Why did you think you needed DDoS testing?
We were implementing a new DDoS protection strategy, built from several layers of defense, which required complex, comprehensive, and high-scale testing. MazeBolt was a great fit for our requirements.
Why did you choose MazeBolt to do it?
We investigated several potential vendors. MazeBolt quickly demonstrated it’s professionalism and reliability. The rate of the attack and source distribution was the best we found, delivering the most accurate, real-world results and the best visibility into how our systems performed. They added significant value, going above and beyond our expectations by providing us with highly customized and professional consultation*, which helped us in building and integrating the different layers of defense.
How did you introduce the process to your team?
Teams from both organizations collaborated closely, from the early stages of the testing design where we decided on the requirements of each layer of defense all the way to the end of the process. Once the systems were ready, we planned together how to try and break the layers.
What did the MazeBolt team do?
They helped us with designing the mitigation layers; MazeBolt clearly demonstrated their vast experience in the DDoS arena and used their testing methodology to verify each stage of our deployment.
What activities did your team to do as part of the process?
My team learned to think like attackers, using that perspective to figure out how to stop MazeBolt from taking our service down.
What surprised you about the test results?
We were sobered to find a couple of simple and “low rate” attacks that we thought wouldn’t be threats but which would have caused us serious negative service impact.
What information did they give you, so you could improve your mitigation processes? How closely did you work with your vendor post-test to increase mitigation? Your internal team?
MazeBolt gave us a very accurate report, which included all the tests results, how it affected our services, and how to solve the issues from the vendor’s side.
This highly accurate report helped us when we worked on fine-tuning the policies internally and working with the vendor.
What advice would you give to another IT security team considering DDoS testing?
Just do it!
You’ll be unpleasantly surprised to find out how easy it will be to take your service down, despite the enormous efforts and mitigation activities that you and your team have heavily invested in and implemented.
How did participating in the process changed your perspective on DDoS attacks? Mitigation? Testing?
For all my life, I was on the defender side. Being part of the DDoS attacks processes showed me for the first time how it looks from the attacker’s point of view. Since then, this new perspective helps me when planning DDoS layers of defenses.
*MazeBolt is generally not a consulting organization. This was a special case due to the high complexity and specific requirements of the DDoS mitigation system.
