Glossary DDoS (Distributed Denial of Service)

A Distributed Denial of Service (DDoS) attack is a malicious attempt to disrupt the normal functioning of a targeted server, service, or network by overwhelming it with a flood of internet traffic. Unlike a traditional Denial of Service (DoS) attack, which typically originates from a single source, a DDoS attack leverages multiple compromised computer systems as sources of attack traffic. These systems can include computers and other networked resources such as Internet of Things (IoT) devices that have been infected with malware and turned into bots. Collectively, they form what is known as a botnet.

The primary goal of a DDoS attack is to render the target server or network resource unavailable to its intended users. This is achieved by consuming the target’s available bandwidth or overloading its processing capacity, causing it to slow down significantly or crash entirely. The impact of such an attack can be devastating, leading to prolonged downtime, loss of revenue, and damage to the organization’s reputation.

DDoS attacks can take various forms, including:

  • Volume-Based Attacks: These aim to saturate the bandwidth of the target site and are measured in bits per second (bps). Examples include UDP floods and ICMP floods.
  • Protocol Attacks: These consume actual server resources or those of intermediate communication equipment, such as firewalls and load balancers. Examples include SYN floods and fragmented packet attacks.
  • Application Layer Attacks: These target specific applications or services with the intention of exhausting their resources. They are measured in requests per second (rps) and include HTTP floods.

Preventing and mitigating DDoS attacks require a combination of strategies. Key measures include:

  • Reducing Attack Surface: Implementing network architecture changes that limit exposure to potential attacks.
  • Threat Monitoring: Continuously monitoring network traffic for unusual patterns that may indicate an impending attack.
  • Scalable Mitigation Tools: Employing scalable solutions like cloud-based DDoS protection services that can absorb large amounts of traffic.

Organizations often use specialized security services that provide DDoS protection as part of their offering. These services use techniques such as rate limiting, web application firewalls (WAFs), and IP blacklisting to filter out malicious traffic before it reaches the target server.