Strategic Defense Planning

A framework for objective vendor evaluation.

Protection Capabilities

Mitigation Capacity:

• What's the total mitigation capacity? (Look for Tbps-level)
• Capacity per scrubbing center? (Distributed capacity matters)
• Largest attack successfully mitigated?
• How is capacity handled during simultaneous attacks?

Attack Type Coverage:

• Layer 3/4 volumetric (UDP/ICMP floods, amplification)
• Layer 3/4 protocol (SYN floods, fragmentation)
• Layer 7 application (HTTP floods, Slowloris, API abuse)
• DNS-specific (query floods, NXDOMAIN, amplification)
• Emerging threats (carpet bombing, zero-day, multi-vector)

Test Questions:

• "How do you protect against carpet bombing attacks?"
• "What's your process for zero-day attack response?"
• "Can you mitigate without blocking legitimate traffic?"

Detection & Response Speed:

• How quickly are attacks detected? (Seconds vs. minutes)
• Mitigation activation time? (Automatic vs. manual)
• How fast does mitigation adapt to evolving attacks?

Service and Support

Security Operations Center (SOC):

• In-house or outsourced?
• 24/7/365 coverage?
• Average analyst experience level?
• Languages supported?

Service Level Agreements (SLAs):

• What uptime percentage is guaranteed?
• How is uptime measured?
• Penalties for SLA breaches?
• Response time guarantees?

Escalation and Support:

• How do you reach SOC during an attack?
• Technical support response times?
• Dedicated account management?
• 24/7 emergency contacts?

Operational Considerations

Deployment Methods:

• DNS-based (change DNS records—simple, quick)
• BGP announcement (requires ISP coordination)
• GRE tunneling (more complex, more control)
• Direct connect (for high-volume customers)

Integration:

• Typical deployment time? (Days vs. weeks)
• What's required from your team?
• Professional services included or extra?
• Can you test before cutover?

Network Infrastructure:

• Where are scrubbing centers located?
• How close to your users and infrastructure?
• Anycast routing for optimal paths?
• Direct connections to major ISPs?

Commercial Terms

Pricing Models:

• Flat fee unlimited: Predictable cost (best for frequent attacks)
• Bandwidth-based: Pay for committed capacity
• Pay-per-incident: Lower baseline, higher risk
• Tiered pricing: Different service levels

Watch for Hidden Costs:

• Setup/onboarding fees
• Professional services charges
• Per-IP or per-domain pricing
• Bandwidth overage charges
• Premium support fees

Contract Flexibility:

• Contract length (1-year preferred for first engagement)
• Termination clauses
• Auto-renewal policies
• Trial/proof of concept availability

Transparency and Reporting

Portal Features:

• Real-time traffic dashboard
• Attack detection alerts
• Historical attack reports
• Traffic analytics and insights
• Policy configuration interface

Reporting:

• Incident reports (what happened, how mitigated)
• Executive summaries
• Compliance reports for audits
• Custom reporting options

Key Takeaway: Don't rely on vendor marketing. Ask tough questions, request proof of capabilities, speak to references, and test before long-term commitment.

‍