skip to content

The board asks whether a 600 Gbps flood means a well-resourced adversary. How do you answer?

level: principalimportance: nice to knowfreq 30%

answer

  1. volume is rented, not owned
  2. the meter runs on duration, not peak
  3. attention is scarcer than bandwidth
  4. say what you can defend to a board
  5. cheap to them is not cheap to us

basics

~20 s

Peak volume no longer indicates resources. Very large short bursts are rented cheaply from fleets somebody else built and holds, so the headline number describes the seller's stock. Duration and adaptation are what imply a budget.

solid answer

~50 s

I would separate what the number proves from what it cost. Capacity is a commodity sold by the minute from fleets built and held by others, so 600 Gbps mostly characterises the seller's stock rather than the buyer's means; a single aggrieved person can buy that peak. What does track spending is duration and persistence, because price scales with sustained rate over time, so a multi-day flood means either a real budget or an operator running their own fleet and paying no rental margin. Adaptation tracks it too: rotating traffic types and re-launching in response to each change we make consumes an operator's attention, which is scarcer than bandwidth. So I would tell the board the honest version, which is that this looks like purchased capacity and is cheap to repeat, and steer the decision toward standing protection and contractual guarantees rather than a campaign narrative I cannot defend.

go deeper

for a junior

Know that flood capacity can be bought, so a huge number does not mean a huge adversary. Avoid describing any large flood as sophisticated.

for a middle

Be able to explain why price scales with duration and sustained rate rather than peak, and therefore which observable properties of an event carry information about spending.

for a senior

Demonstrate the reasoning from observed behaviour to inferred resources: sustained duration, rotation across traffic types, re-launches timed to your changes, and company kept with other pressure.

for a principal

Own the decision the answer commits the organisation to. Attribution language drives funding shape and external messaging, both hard to withdraw, so give the board what is defensible and then name the availability tradeoff as theirs to settle.

## Why the question is a trap Boards, and plenty of engineers, treat the peak figure as a proxy for adversary capability, because in most domains a bigger effect implies a bigger effort. In flood supply that relationship was severed by the rental market. Capacity built once by a herder is sold to anybody, in slices, so the peak that arrives is a fact about the fleet on the other end of a purchase, not about the purchaser. The number tells you what was available for sale that day. The correct answer is therefore not "no" and not "yes" but a reframing: here is what volume can support, here is what it cannot, and here is what would actually change my assessment. ## What peak does not prove A very large short burst is the cheapest product in the catalogue relative to its headline number, because peak is simply how much of an existing fleet is pointed at one address for a moment. Nothing about it requires the buyer to have money, organisation, patience or skill. Attributing a large peak to a resourced adversary is the single most common over-claim in this area, and it is the one a board is most likely to repeat outside the room. ## What actually correlates with spending **Duration at rate.** The meter runs on time. Sustained high-rate pressure across days is a recurring cost, and somebody is choosing to keep paying it. That is a budget signal in a way that peak is not. **Persistence across changes.** Traffic that comes back after each adjustment, in a different shape each time, means somebody is watching and re-buying, or is running their own capacity and paying no margin at all. Both imply more than a checkout page. **Attention.** Rotating targets across the estate, mixing traffic types, and timing re-launches to our operational rhythm all cost operator hours. Attention is the scarcest input in this market, far scarcer than bandwidth, and it is the best available proxy for how much this matters to whoever is doing it. **Company it keeps.** A flood accompanied by an extortion demand, or synchronised with pressure elsewhere, is part of an operation with a plan. A flood on its own frequently is not. **Capacity that is not for sale.** If the supply does not resemble anything on the open market, that is worth more than any peak figure. ## The organisational layer, which is the actual question The board is not asking a taxonomy question. They are asking what to believe and what to fund, and the answer commits the organisation: - **Spending shape.** "Targeted by a resourced adversary" argues for a persistent posture and a programme. "Cheap, repeatable purchase" argues for standing capacity and contractual guarantees, which is a procurement decision with a known price. - **External messaging.** An attribution offered to customers, insurers or a regulator is very hard to withdraw. Claiming a sophisticated adversary and later discovering a single aggrieved individual with a payment card is a credibility loss that outlasts the outage. - **Who owns the risk.** If the honest reading is that anyone can repeat this next week for pocket money, then the decision is a business one about acceptable downtime and what protection is worth, and it belongs to the board rather than to engineering. Saying that plainly is the point of the answer. - **What you promise next.** Beware committing to "it will not happen again" when the supply that produced it remains on sale. ## How to deliver it Give three sentences the board can hold: what we know, what the number cannot tell us, and what would change the assessment. Then state the decision you want from them. Resist both failure modes: the inflation that turns a rented burst into a nation-state campaign, and the dismissal that treats a repeatable, cheap capability as unimportant because it was cheap. The second is its own error, because cost to the attacker has nothing to do with cost to us. ## The one-line version Volume is rented, so peak measures the market rather than the adversary. Duration, adaptation and attention are what money buys, and those are what I would report as evidence of resources.

  • What would move your assessment toward a genuinely resourced adversary?
    Sustained high rate over days rather than sold-looking windows, several traffic types rotated as each is dealt with, re-launches timed to our own changes, an extortion demand or synchrony with pressure elsewhere, and capacity that does not resemble anything on open sale. Those cost money and attention; a peak figure does not.
  • Why is over-claiming a sophisticated adversary expensive?
    It moves budget toward a persistent-adversary posture, escalates the story told to customers, insurers and regulators, and anchors the organisation on an attribution that a second cheap purchase by one aggrieved individual would contradict in public. Withdrawing an attribution costs more credibility than never making one.
  • Is 'it was only a cheap rented attack' a reason to do nothing?
    No, and that is the opposite error. What the capability cost the attacker says nothing about what the outage cost us, and cheap capability is by definition easy to repeat. The correct conclusion is that recurrence is likely and the decision is a straightforward business one about how much availability is worth.

saying these in an interview costs you the question

  • Treats peak bits per second as a proxy for adversary budget
  • Calls any very large flood a nation-state operation
  • Forgets that rental price scales with duration, not peak
  • Gives a board an attribution the evidence cannot carry
  • Dismisses a cheap attack as unimportant to the business

context

resolving links…