Distributed Denial of Service / DDoS

Description

The attack can hit network capacity, the transport layer, or the application itself. Sometimes a huge volume of traffic is sent to congest the link, sometimes connections are exhausted, and sometimes expensive application requests are sent that consume CPU, memory or the database. On the victim's side the result is the same: the service stops working.

DDoS is not always a technical show of force. It can be a method of extortion, political pressure, disruption of a competitor, or a smokescreen while something else is attempted in parallel. So it is worth looking not only at the traffic graph but at the context in which the attack begins.

Examples

• A botnet of compromised IoT devices sends enormous traffic at the public site of a financial institution.
• The attack hits the network layer and the application's login endpoint at the same time, so protection at one layer is not enough.
• An online service becomes unreachable during an important event because application requests exhaust the database and the backend.

Notes

• DDoS is not solved while the attack is under way. It takes capacity arranged in advance, scrubbing, a CDN, rate limiting and a clear line to the provider.
• If all the traffic has to reach your infrastructure before you can filter it, you are in a poor position.