Definition
A Distributed Denial-of-Service (DDoS) attack is a cyberattack that overwhelms a target server, service, or network with a flood of internet traffic from multiple distributed sources. The goal is to make the target unavailable to legitimate users by exhausting its resources.
People Also Ask
Common questions about DDoS answered by our security experts.
DDoS in Practice
A distributed denial of service attack uses many sources to overwhelm a target. The distribution is what makes it effective: blocking one address achieves nothing when traffic arrives from tens of thousands.
It differs from the single-source form in that the mechanism is usually volume rather than a flaw, which makes it a capacity problem and therefore not solvable at your own perimeter.
The three layers it operates at
Volumetric — saturating the connection with traffic. Measured in bits per second, and defeated only upstream, because the link is full before your equipment sees anything.
Protocol — exhausting state on network devices with malformed or incomplete connections. Application — requests that are individually valid and collectively expensive, which are the hardest to distinguish from real users and need the least bandwidth.
Amplification is why the numbers are large
Attackers send small requests to servers that respond with much larger replies, spoofing the victim's address as the source. A modest amount of attacker bandwidth produces an enormous flood.
Several protocols offer high amplification ratios, and the servers that enable it are misconfigured third parties. Ensuring your own services cannot be used for amplification is a courtesy to others and prevents your infrastructure being consumed by it.
Mitigation has to be upstream
You cannot filter traffic that has already filled your connection. Effective defence means a provider or network service absorbing it before it reaches you, with capacity far exceeding your own.
Options: a mitigation service that traffic routes through, provider-level protection, or a content delivery network that absorbs volume as a side effect of its distribution. The decision to make in advance is which, and how quickly it engages.
Ransom demands and probing
Extortion demands accompanied by a short demonstration attack are common, and many are from actors with no real capacity. Paying is generally ineffective and invites repetition.
Short attacks are also used to test defences before a larger attempt, or to distract during an intrusion. A brief unexplained outage is worth investigating rather than dismissing, because it may be reconnaissance.
Preparing rather than reacting
Know your normal traffic so an anomaly is recognisable. Have mitigation contracted with a documented activation procedure and out-of-hours contacts.
Know your provider's escalation path. Ensure critical services do not share infrastructure with the most attackable ones. And have a communications plan, since the visible symptom is customers unable to reach you.
What happens to everything else during one
A volumetric attack degrades the systems you would use to respond: monitoring, remote access, and in some cases internal services sharing the same connection. Responders discover this at the worst possible moment.
Practical preparation is separating management and monitoring paths from the connection carrying public traffic, and confirming that out-of-band access to infrastructure exists. Both are ordinary architecture decisions and both are frequently absent.
Where to start
Establish whether you have mitigation available and how it is activated out of hours. If the answer is unclear, that uncertainty is the length of your next outage.
See load balancers. GuardsArm runs security program reviews.
Related Terms
Botnet
A botnet is a network of compromised computers or devices (bots) that are remotely controlled by a threat actor. Botnets are used to launch distributed denial-of-service (DDoS) attacks, send spam, steal data, and perform other malicious activities at scale.
Firewall
A firewall is a network security device or software that monitors and controls incoming and outgoing network traffic based on predetermined security rules. It establishes a barrier between trusted internal networks and untrusted external networks such as the internet.
Incident Response
Incident response is the organized approach to addressing and managing the aftermath of a security breach or cyberattack. The goal is to handle the situation in a way that limits damage, reduces recovery time and costs, and prevents future incidents.
Related Reading
Enterprise IoT Security: The Devices Nobody Owns
Cameras, door controllers, HVAC, printers, TVs and sensors — installed by facilities, connected by a contractor, patched by nobody. Securing the…
In-House or Retained Incident Response: Choosing Before You Need To
The decision is not either/or. What you can realistically handle internally, when to call, and why the contract has to exist before the incident.
Incident Response Retainer Costs: Prepaid, Zero-Dollar and Subscription
Three ways to buy guaranteed response, what each costs, and the contract terms that decide whether the retainer helps you at 3am.
Speak With an Expert
Book a free consultation to discuss ddos for your organization.
Need Help With DDoS?
Our certified security professionals can help you implement the right ddos strategy for your organization. Get a free assessment today.
Book a Free Consultation