MCYSEKA-Maritime Cyber Security Knowledge Archive

Hello!

I work in a security/pentesting company and in the last year the demand for DDoS testing has dramatically increased. The issue is that the customer is not interested in what I call a mislabeled load test, but wants us to test the reaction time and reliability of the (almost always outsourced, mostly to their ISP) DDoS protection provider they are using for their applications, plus the impact of the countermeasures launched to reduce an ongoing attack (which are usually various blocking rules made by the DDoS protection provider).

I’ve identified several issues – figuring out from where to perform the test to still go though the DDoS protection provider (that’s very often an ISP guarding their perimeter), how to avoid affecting unrelated third parties, and how to scale up the attack to at least trigger the detection thresholds of the DDoS protection provider while still keeping the test legal and price in a reasonable ranges, since the cost-value tradeoff is still pretty important.

Since I’ve given it a lot of though and I was unable to come up with a solution, and there are legal companies (not counting the random sites that take payment in bitcoin, but legit security companies that you contact for a quote), I’m really intrigued about how they do it and what am I missing. Is there anyone here who has experience with similar kind of engagement?

I hope that cross-posting from security stackexchage is ok. Copying the text of the post, since it’s mine, here seems unnecessary, but if it is an issue I will fix it and paste the content here.

Here are more details, with more in-depth description of the approaches I’ve explored (and rejected), and ideas I’ve had for the solution:
How to test the reaction of an outsourced DDoS protection provider to a DDoS attack, similar to a red teaming engagement?

Thank you! The issue is bugging me and I honestly think that it’s a pretty interesting challenge to think about, that’s why I’m also posting it here.