Canberra to bolster its websites against DDoS attacks

The Department of Finance is weighing up ways to protect dozens of federal government websites on its Drupal-based GovCMS platform against DDoS and other potentially devastating attacks.

At last count, 137 websites were hosted or in development on the whole-of-government web platform, accounting for 52 government customers.

The Drupal platform, provided by Acquia from AWS Sydney data centres, is home to a number of high-profile sites that would appeal to attackers, including for the Australian Army, the Department of Human Services, Australia.gov.au, and the Department of Communications.

In the wake of the Australian Bureau of Statistics’ notorious collapse to a relatively low-intensity DDoS in August, Finance is asking industry members to pitch their services to shore up its GovCMS customers against a similar fate.

Finance wants a single provider to deliver DDoS protection, CDN services, and web app firewall services across the GovCMS fleet, before the end of April.

They will need to be able to cover traffic up to 2.5 TB and 100 million hits a month.

“It is expected that the services platform will have a single URL and the individual websites will be directed to the platform using a DNS CNAME record,” Finance revealed in tender documents issued today.

“It is expected that the services will use a defined set of IP addresses so that the environment being protected can whitelist those addresses to prevent direct access to the origin.”

The suite of security protections will need to defend against cross-site scripting and request forgery, comment spam, SQL injection, and application-specific attacks. Ideally, the department said, it will also offer the ability to limit the hit rate of bots, especially those with IP addresses located overseas.

Bidders will need to detail an ASD-approved encryption method, and explain how they will secure remote administration of the service, be it through multi-factor authentication, encrypted comms, auditing, or IP whitelisting.

Finance expects the successful provider will be certified against federal security standards like the ASD’s information security manual and protective security framework, with compliance with other standards like FedRAMP and ISO 27001.