What is a DDoS attack?

DDoS: definition and goal

“Distributed denial of service” means a distributed refusal of service. The goal is not data theft but availability: the service is to be overloaded so much that it no longer works for legitimate users. This hits online stores, booking systems, customer portals and interfaces. During the disruption, revenue is lost, and support and reputation suffer.

The attacks come from a botnet: thousands of hijacked PCs, routers, cameras or servers that a perpetrator controls remotely. Because the requests originate from many addresses, the attack cannot simply be stopped by blocking a single IP address. Motives range from extortion through revenge and competition to distracting from other attacks.

Types of DDoS attacks

Attacks target different layers. Volumetric attacks fill the bandwidth with masses of data, often through amplification effects, for example with DNS queries. Protocol attacks such as the SYN flood exhaust the connection tables of firewalls and servers. Application-layer attacks send seemingly normal requests that make the server compute heavily and are hard to tell apart from genuine traffic. Often several methods are used at the same time to overwhelm the defenses.

• Volumetric: the bandwidth is saturated with masses of data
• Protocol: connection tables and network devices are exhausted, for example by SYN floods
• Application layer: seemingly normal HTTP requests overload the database or search
• Multi-vector: several methods are combined at the same time

Real-world example: an online store before the holiday season

A toy retailer receives an email in early December: pay, or the website goes offline. Shortly afterward, the store collapses—in the highest-revenue month of the year. The retailer’s own server with limited bandwidth is no match for the onslaught, and even the hosting provider throttles the connection to protect other customers.

Had the retailer prepared, the store would run behind a provider with DDoS protection that filters out the flood in its network before it reaches the server. An emergency plan with contacts, a status page and customer communication helps in addition. You do not give in to the demand; you file a report.

Protection, limits and imple­menta­tion

DDoS attacks cannot be prevented completely, but they can be mitigated. Effective measures are an upstream content delivery network or a specialized anti-DDoS service with large capacity, a WAF with rate limiting, scalable infrastructure, caching and a server whose real address is not publicly known. Just as important are monitoring and an emergency plan agreed with the hosting provider.

Nano Concepts plans the protection of shops and web applications against overload, sets up protection and monitoring and, together with you, drafts a procedure for emergencies: who informs whom, what is communicated to customers and when to switch to which protective measure. That way, your company stays able to act even under pressure.