LinkBermuda has stepped up its ability to guard against internet attacks on its network and its clients.

And almost immediately after deploying the new measures, the company saw how effective they were when a distributed denial-of-service (DDoS) attack was launched against a client on its network.

The technology worked and the attack was dealt with. That result reinforced LinkBermuda’s belief that it made the right move when it partnered with Arbor Networks, a US software company specialising in network security, to provide detection and mitigation solutions against DDoS attacks.

While in the grander scheme of things Bermuda is a relatively small target for would-be internet attackers, that does not mean it is immune to the potentially large scale disruption that can be wrought by such attacks, particularly if they are not dealt with speedily.

Craig Davis, LinkBermuda’s general manager, said it was important for his company to demonstrate to customers that it has a robust detection and mitigation system to deal with such attacks.

He said by partnering with Arbor Networks it had put in place such a solution against “the primary threat to availability of internet-based telecommunications services on the Island”.

Mr Davis said: “At LinkBermuda, we manage and operate capacity on diverse submarine fibre cable systems that connect Bermuda to points of presence in New York, Florida, the Caribbean and Brazil.

“Ensuring the availability of these links is essential for our customers and for Bermuda itself.”

LinkBermuda owns and operates an advanced network of international and domestic fibre cable facilities in Bermuda, and is primarily focused on business customers, although it also has residential customers.

Referring to the attack that was detected on the company’s network after Arbor Networks SP was implemented, Mr Davis said: “Almost immediately after deployment, we were targeted with a DDoS attack and our protection worked exactly as designed.

“Without the Arbor DDoS solution in place, despite LinkBermuda’s position as the market leader in provision of internet capacity to Bermuda, customers would undoubtedly have been impacted.”

Matthew Moynahan, Arbor Networks’ president, said: “The fact that LinkBermuda was able to mitigate a significant attach so quickly after initial deployment is a testament not only to their team’s capabilities, but to Arbor’s engineers as well.”

A DDoS attack can take a number of forms, but essentially is an attempt by an outside party to overload a website or network by bombarding it with “hits”.

Mr Davis explained that a website or group of internet addresses can become unusable if they get too many hits, or traffic, in a short space of time.

“One simple way of doing that is repeatedly asking the website for information at a high rate, such as 50,000 requests per second,” he said.

Such attacks are staged by running malicious programs through connected computers and internet connections, often globally connected and known as a botnet.

The reasons behind attacks can be varied, such as to harm a commercial rival, or they may be driven by political or religious agendas.

Mr Davis said recognition of an attack was key, as there are also legitimate reasons why a website might suddenly experience a dramatic rise in traffic.

“In any system, if a network or internet provider is not ready, a sudden increase in traffic can look like a DDoS,” he said.

LinkBermuda partnered with Arbor Networks to enhance its ability to detect attacks.

“We can tell when the use of the internet has gone up. It is flagged up. We than have to decide if it is a problem and what to do.”

One solution is to turn off the IP address or addresses that are under attack, this reduces the chance of the DDoS attack overloading other parts of the network’s internet pipeline and possibly causing outages to other customers.

The next stage is redirecting the affected traffic to a facility where it can be “cleaned”. LinkBermuda does this in conjunction with Eastlink, a Canadian telecoms company, and Arbor Networks. Legitimate internet traffic is identified and allowed to reach its destination, while DDoS traffic is blocked.

Mr Davies said there is generally a limited life-cycle to the attacks, and an attacker usually withdraws and moves on. However, if they linger and their IP addresses are identified, the matter can be reported to the abuser’s internet service provider (ISP) requesting they resolve the matter.

The issue can also be raised with a heavyweight organisation such as ARIN, the American Registry for Internet Numbers.