Case Study: Analyzing and Mitigating a DDoS ICMP Flood Attack Using the NIST Cybersecurity Framework

Overview

As part of my professional development in cybersecurity, I recently completed a comprehensive incident analysis project. In this case study, I acted as a cybersecurity analyst for a multimedia company that provides web design and marketing solutions. The organization was hit by a Distributed Denial of Service (DDoS) attack that crippled their internal network for two hours.

My objective was to analyze this incident, identify the underlying vulnerabilities, and develop a robust security strategy using the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). This report serves as a portfolio piece to demonstrate my ability to translate technical incidents into actionable security roadmaps.

The Incident Scenario

The company’s network services suddenly became unresponsive. Investigation revealed that a malicious actor was sending a massive flood of ICMP (ping) packets into the network. Because the company’s firewall was unconfigured, it was unable to filter this traffic, allowing the “ICMP flood” to overwhelm the system and block legitimate internal traffic.

My Approach & Analysis

To solve this problem, I broke my analysis down into the five core functions of the NIST CSF: Identify, Protect, Detect, Respond, and Recover.

1. Identify: Root Cause Analysis

My first step was to determine why the attack succeeded. While the “what” was an ICMP flood, the “why” was a configuration gap. I identified that the primary vulnerability was an unconfigured firewall. This lack of baseline security meant the network had no “shield” against high-volume, low-level protocol requests.

2. Protect: Hardening the Perimeter

Once I understood the vulnerability, I developed a proactive protection plan. I didn’t just want to “block pings”; I wanted to build a resilient architecture. My solution included:

Rate Limiting: Implementing firewall rules to cap the number of incoming ICMP packets, ensuring that even during an attack, the network wouldn’t be completely overwhelmed.
Source IP Verification: Adding a layer of validation to check for spoofed IP addresses, a common tactic in DDoS attacks.
IPS Integration: Deploying an Intrusion Prevention System (IPS) to automatically filter traffic based on suspicious characteristics.

3. Detect: Enhancing Visibility

A major takeaway from this project was that you cannot stop what you cannot see. I proposed a two-pronged detection strategy:

Network Monitoring Software: To establish a “baseline” of normal traffic and provide alerts on abnormal patterns.
IDS System: To provide real-time alerts specifically for suspicious ICMP traffic, allowing the team to react in minutes rather than hours.

4. Respond & Recover: Business Continuity

During the incident, the team reacted by blocking ICMP and shutting down non-critical services. I analyzed this response to create a formal procedure for future events.

My strategy focuses on Prioritization. In a crisis, not all services are equal. I outlined a recovery roadmap where:

External floods are neutralized at the firewall.
Non-critical services are suspended to preserve bandwidth.
Critical network services are restored first to ensure business continuity.
All other systems are restored systematically once the threat is neutralized.

Final Reflections & Key Takeaways

Beyond the immediate technical fixes, I concluded the project by identifying long-term organizational improvements. I recommended:

Standardized Configuration: Ensuring all new firewalls follow a “secure-by-default” template.
Policy Evolution: Regularly updating firewall rules to stay ahead of evolving attack vectors.
Proactive Testing: Implementing regular penetration testing to find these “unconfigured” gaps before an attacker does.

Conclusion

This project reinforced my belief that cybersecurity is not just about reacting to alerts; it is about building a resilient framework. By applying the NIST CSF, I was able to move from a reactive “firefighting” mode to a proactive security posture that protects both the infrastructure and the business’s reputation.

Note: This narrative is based on an educational case study performed as part of a cybersecurity certification course. It is intended to demonstrate analytical skills and framework application in a simulated environment.