DDoS Incident Response for Institutions
What to do when an attack hits — a simple playbook for campus IT teams.
When a DDoS attack hits, campus IT teams need to act quickly and calmly. A simple playbook prepared in advance makes the difference between hours of disruption and a short interruption.
Recognise the signs
Sudden slowdowns, unreachable portals, saturated internet links and traffic spikes from many sources suggest an attack. Monitoring tools help confirm it.
Contact your provider immediately
Call your connectivity provider's NOC or security team. Provide affected IP addresses, services and the time the issue started. Upstream mitigation can begin quickly.
Activate protection
If protection is on-demand, request diversion to scrubbing. For websites, enable stricter CDN and WAF settings.
Communicate internally
Inform leadership, faculty and helpdesk staff about the situation and expected impact.
Communicate externally
If public portals are affected, post updates on official channels and offer alternatives, such as extended deadlines.
Preserve evidence
Keep logs, traffic captures and any extortion messages for investigation.
Watch for other attacks
DDoS attacks are sometimes used to distract from intrusion attempts. Monitor other systems closely.
Report
Report significant incidents to CERT-In and relevant authorities as required.
Review afterwards
Hold a review to understand what happened and improve defences and procedures.
The bottom line
A clear playbook and a responsive provider keep DDoS incidents short. Prepare your plan before you need it.
Learn more about DDoS Protection for Education from UbiFi, or talk to our team.
Keep admissions, results and online exam portals online during DDoS attacks with always-on, network-level mitigation.
