Edge Distributed Denial of Service (Edge DDoS) service description
Description of services
(a) Description of Services: Bell will provide the Network DDoS Security services (“Services”) described herein. The Services are managed security services, providing threat detection and mitigation for distributed denial of service attacks from within Bell’s network. The Services provide for the monitoring, verification, and blocking/filtering of DDoS attacks before they reach Customer’s routers or firewalls.
Edge DDoS: Covers standard volumetric attack vectors
The Services provide the Customer with all of the standard detection and mitigation capabilities along with the reporting as described in the following features of the Services:
-
DDoS Mitigation Process:
When a Known Attack occurs:
- An alert is reported and documented
- Mitigation starts automatically.
- In the scenario where a volumetric DDoS attack occurs at such volume that it is over the subscribed Bell BID OE internet bandwidth associated with the Service, an alert is raised, reported and documented. Bell operations staff will redirect that traffic to volumetric cleansing facilities within Bell’s core network to assist in volumetric cleansing.
When an Unknown Attack/Event is suspected:
- This kind of attack includes a potential threat that either Customer reports to Bell or Bell’s infrastructure identifies as potential threat that requires further investigation.
- Once validated as malicious, Bell will notify Customer’s “Security” and “IS&C” departments prior to any action being taken by Bell which may include applying a combination of blocking and filtering to either filter attack traffic or block the offending source IP Address in the most efficient manner possible
- Bell deploys Updates as appropriate and /or takes the required corrective measures.
-
Types of Attack: The types of attacks that will be monitored by Bell include:
Attack Vectors Edge DDoS* Flood/Volumetric Attacks TCP Syn + ACK Floods ✓ TCP Fragment Floods (packet anomaly) ✓ TCP Reset Floods ✓ TCP Stack Resource Floods ✓ TCP FIN Floods ✓ UDP flood attacks ✓ ACK Floods (packet anomaly) ✓ IGMP Floods (multi-cast attack) ✓ ICMP flood attacks and reflected attacks (e.g. smurf attack, ping flood) ✓ Concurrent Connection Attacks ✓ GRE Floods ✓ IP fragmentation (e.g. tear drop attack) ✓ DNS Query Floods / amplification attacks ✓ RFC Violation Attacks (packet anomaly) ✓ Memory Allocation Attacks ✓ SIP Attacks ✓ UDP Attacks ✓ Enhanced DNS Protection ✓ Small Volume Burst Attack Protection ✓ Behavioral Denial of Service ✓ * In the case of Edge DDoS, there are volumetric thresholds that must be exceeded before the noted protection is applied. All traffic is sent, as directed, to destination until such threshold has been reached. Only after such volumetric thresholds are reached, will traffic be diverted to scrubbing center to be inspected.
- 7x24x365 Monitoring: Bell will maintain a staffed and secured security operations environment for the management of security and incident requirements; and management of security appliances is performed through the network operations team(s).
- Initial Setup and Configuration: During the initial setup and configuration of the DDoS Security Service, Bell will conduct tests on the connection, setup and configuration of the Customer’s traffic routing and DDoS mitigation infrastructure configuration. These tests may include such actions as sending malformed packets or simulated volumetric attack traffic to the Customer’s infrastructure to ensure the appropriate flags and redirections occur within the Bell network necessary for the DDoS Service to be effective. This testing phase will be coordinated with the initial configuration, coinciding with the initial maintenance window required for the initial implementation. These tests are intended to confirm the successful setup and configuration of the Service. While highly unlikely that these tests would result in the Customer’s infrastructure being affected, this could occur, and the Customer understands and accepts the risks this presents.
- Change Management: Bell will provide a process that allows Customer to request changes to the IP address ranges currently being monitored, changes in bandwidth, options, reporting IDs and notification settings. Fees applicable during Regular Business Hours are reflected in the Fees section of this Service Schedule. Fees for work outside regular business hours will be provided at Bell’s current overtime rates (4 hour minimum) or the rates as reflected in the Fees section of this Service Schedule (whichever is higher). Fees set out in Table 2 will apply.
- Bell Service Desk/ Single Point of Contact: Customer shall have a 7x24x365 Bell single point of contact for all inquiries or change requests.
- Soaking Period: Upon successful implementation of the Service, the Customer’s traffic will be directed through the Distributed Denial of Service detection infrastructure. During the first fourteen (14) days, the infrastructure will be learning the typical traffic patterns for the Customer. During this period of time, known as the “soaking period”, the SLOs around threat detection, mitigation, meantime to respond, notify and mitigation are not applicable. The “soaking period” may be extended or abbreviated if mutually agreed upon by the Customer and Bell Canada.
- Reporting:
- Monthly reporting: Monthly reporting will be available through Customer access to the Bell Business Self-Serve Portal (BBSSC). Initial login ID’s and passwords will be provided in the DDoS Security welcome package. Log Retention and recovery: Bell retains logs in raw data format as per regulation compliance for 12 months. In order for Bell to retrieve such raw data logs, and provide it to the Customer, the Customer shall be required to provide written request, including legal justification. The Customer can raise such request from BBSSC portal under “Technical Inquiries” with clear justification. Upon receipt of such request, Bell shall validate the requirement and, upon such validation, shall provide necessary log data within 7 business days.