The bottom line cost of a DDoS attack is as high as $2.3 million for the enterprise, based on the type of business or volume of transactions occurring on a website per day.
Cost of DDoS Attacks: In 2016, similar attacks cost $1.6 million for enterprises, based upon market research of more than 5,200 business professionals by Kaspersky and B2B International. The significant increase is worrying but to be expected the more we rely on our IT infrastructure to be always available.
Why They Cost So Much: One third of the organizations attributed the costs to fighting the attack and restoring services.
Kaspersky’s report further indicated that while the attacks were becoming more costly and frequent, companies’ security teams are not fully responsible for protection; most of the businesses rely on third-party protection via their internet service provider (ISP) or data center and infrastructure providers. 34 percent of organizations expect their ISP will protect them, and 26 percent expect their data center or infrastructure partners will protect them from DDoS attacks.
Not Me: Even though DDoS attacks are increasing in frequency, Kaspersky reported that 28 percent of those who have so far not been affected believe that it is highly unlikely they will be targeted by a DDoS attack.
From the cybercriminals’ perspective, DDoS attacks are very inexpensive. DDoS attacks begin at $5 per hour for a 300-second attack, with a 24-hour attack costing about $400. For DDoS attacks against organizations with higher levels of security, the prices are a bit more expensive.
The volume of attacks is growing because of the increasing availability of IoT devices to serve as DDoS attack engines. This has already been demonstrated in the field late last year and in 2018, it’s cheaper to rent or create a botnet of IoT devices than a botnet hosted on traditional servers.
Complexity of Attacks Increase: As DDoS defenses get more complex, so do the attacks. According to Kaspersky’s SecureList site, cybercriminals can purchase “stepped-up” attacks, which means that the DDoS attack might start with a SYN Flood and then transition to a UDP Flood or other combinations of multi-vector attacks.
Insurance, Not ROI: Paying for DDoS attacks after the fact is a very expensive proposition. Consider DDoS security defense infrastructure as you do traditional insurance (You should of course make sure your cyber insurance does have DDoS coverage). While it may be hard to demonstrate ROI up front, the losses after the fact pile up rapidly.