Distributed Denial of Service (DDoS)

Layer 3: Network Medium risk

How it works

A distributed denial of service attack uses large networks of compromised computers and internet-connected devices, often called botnets, to send far more traffic than a target can handle. Some attacks saturate an internet connection with raw volume, while others target a specific website or application with requests designed to exhaust its resources. Others abuse internet services that reply with much larger responses than the requests sent, multiplying the volume of traffic.

The aim may be extortion, protest, distraction from another attack, or simply disruption. Attack services can be rented cheaply, so even small businesses can be targeted. For organizations that rely on online booking, e-commerce, remote access or cloud-hosted phone systems, even a few hours offline can mean lost revenue and frustrated customers. Most small office firewalls and internet connections cannot absorb a large attack on their own, so upstream protection matters.

Warning signs

• Websites or services suddenly very slow or unavailable
• Unusual spikes in traffic from many sources
• Internet connection saturated with no clear cause
• Ransom or threat messages demanding payment to stop
• Firewall or router resources at maximum

How to defend against it

• Host public websites behind a content delivery network with DDoS protection
• Ask your internet provider about upstream mitigation options
• Keep critical systems off a single internet connection
• Monitor network traffic for unusual patterns
• Include service outages in your continuity plan

If it happens to you

1. Contact your internet and hosting providers to apply mitigation
2. Switch to backup connections or communication channels
3. Do not pay extortion demands
4. Watch for other attack activity happening at the same time