Home>
SSDP
02
What Are the Dangers and Risks of SSDP?
Despite its usefulness, SSDP also presents security risks: SSDP can be exploited for DDoS amplification attacks. Attackers send manipulated SSDP requests to several vulnerable devices (hosts), which then react with significantly larger responses and thus overload the target system via a spoofed IP address. This increases the request volume many times over.
According to the US cyber security authority CISA, attacks using SSDP can be amplified by a factor of 30. For the affected targets, the origin of the attack cannot be traced in the event of an acute attack, as the traffic originates from conventional hosts.
Myra's Security-as-a-Service solutions reliably protect your systems against cyber threats such as SSDP floods. Defend your critical IT infrastructure proactively, sustainably and in compliance.
How to Secure SSDP?
To minimize the risks associated with SSDP, the following security measures are recommended:
Access control
Restricting access of devices with SSDP enabled to trusted and internal networks
Network segmentation
Strict isolation of devices with activated SSDP from critical systems and resources
Vulnerability management
Regular updating of firmware and programs on devices to eliminate known vulnerabilities
Traffic monitoring
Use of network monitoring tools to detect and analyze unusual SSDP traffic patterns
SSDP disabling
Deactivation of SSDP on devices when it is not required
IPv4 Access Control Lists (ACLs)
Implementation of ACLs on layer 3 interfaces to limit SSDP traffic
