A distributed denial-of-service (DDoS) attack is a malicious attempt to disrupt the normal traffic of a targeted server, service, or network by overwhelming the target or its surrounding infrastructure with a flood of Internet traffic.
In a DDoS attack, An attacker uses a number of machines across the internet (or what’s called a “botnet”). Those machines send a high volume of fake traffic to the target site, all in an attempt to overload server resources and bring the site down.
There are many types and sizes of DDoS attacks and they can be devastating regardless of their size. Even an attack from a single system (DoS) can paralyze a site, so consider the ruthless efficiency of a multi-system attack through DDoS. A powerful DDoS can be as tiny as one request per second, and it can still have devastating effects on a website.
Types of DDoS Attacks & How Each Work
Volumetric Attacks
The most common DDoS attack overwhelms a machine’s network bandwidth by flooding it with false data requests on every open port the device has available. Because the bot floods ports with data, the machine continually has to deal with checking the malicious data requests and has no room to accept legitimate traffic. UDP floods and ICMP floods comprise the two primary forms of volumetric attacks.
UDP stands for User Datagram Protocol and refers to the simple transmission of data without checking its integrity. The UDP format lends itself well to fast data transmission, which unfortunately makes it a prime tool for attackers.
ICMP stands for Internet Control Message Protocol, referring to network devices that communicate with one another. An attack focused on ICMP relies on attacking nodes sending false error requests to the target. The target has to deal with these requests and cannot respond to real ones, similar to how a UDP attack works.
Application-Layer Attacks
The application layer is the topmost layer of the OSI network model and the one closest to the user’s interaction with the system. Attacks that make use of the application layer focus primarily on direct Web traffic. Potential avenues include HTTP, HTTPS, DNS, or SMTP.
Application-layer attacks are not as easy to catch because they typically make use of a smaller number of machines, sometimes even a single one. Therefore, the server can be tricked into treating the attack as nothing more than a higher volume of legitimate traffic.
Protocol Attacks
A protocol attack focuses on damaging connection tables in network areas that deal directly with verifying connections. By sending successively slow pings, deliberately malformed pings, and partial packets, the attacking computer can cause memory buffers in the target to overload and potentially crash the system. A protocol attack can also target firewalls. This is why a firewall alone will not stop denial of service attacks.
One of the most common protocol attacks is the SYN flood, which makes use of the three-way handshake process for establishing a TCP/IP connection. Typically, the client sends a SYN (synchronize) packet, receives a SYN-ACK (synchronize-acknowledge), and sends an ACK in return before establishing a connection. During an attack, the client only sends SYN packets, causing the server to send a SYN-ACK and wait for the final phase that never occurs. This, in turn, ties up network resources.
Often, would-be hackers combine these three types of approaches to attack a target on multiple fronts, completely overwhelming its defenses until stronger and more thorough countermeasures can be deployed.
How to Defend Against a DDoS Attack
These steps defend your site against DDoS attacks:
Rate Limiting
Limiting the number of requests a server will accept over a certain time window is also a way of mitigating denial-of-service attacks. While rate limiting is useful in slowing web scrapers from stealing content and for mitigating brute force login attempts, it alone will likely be insufficient to handle a complex DDoS attack effectively.
Monitor Your Website Activity.
Track your network activity carefully so you can recognize when anything is amiss. This will help you identify traffic spikes and if a DDoS attack might be occurring.
Use A Web Application Firewall.
A Web Application Firewall (WAF) is a tool that can assist in mitigating DDoS attacks. By putting a WAF between the Internet and an origin server, the WAF may act as a reverse proxy, protecting the targeted server from certain types of malicious traffic.
Consider The Impact If Unprepared.
While most of these safeguards do increase your investment in security, the cost is usually much smaller than the financial impact of a DDoS attack (or any other hacking attempt). An attack on an e-commerce business during the holiday shopping season can break the entire company’s profitability for the year.
Maintain Strong Network Architecture
Focusing on a secure network architecture is vital to security. Businesses should create redundant network resources; if one server is attacked, the others can handle the extra network traffic. When possible, your business servers should be located in different places geographically. Spread-out resources are more difficult for attackers to target.
Leverage The Cloud
Outsourcing DDoS prevention to cloud-based service providers offers several advantages. First, the cloud has far more bandwidth, and resources than a private network likely does. With the increased magnitude of DDoS attacks, relying solely on on-premises hardware is likely to fail.
Second, the nature of the cloud means it is a diffuse resource. Cloud-based apps can absorb harmful or malicious traffic before it ever reaches its intended destination. Third, cloud-based services are operated by software engineers whose job consists of monitoring the Web for the latest DDoS tactics.
Deciding on the right environment for data and applications will differ between companies and industries. Hybrid environments can be convenient for achieving the right balance between security and flexibility, especially with vendors providing tailor-made solutions.
Understand The Warning Signs
Some symptoms of a DDoS attack include network slowdown, spotty connectivity on a company intranet, or intermittent website shutdowns. No network is perfect, but if a lack of performance seems to be prolonged or more severe than usual, the network likely is experiencing a DDoS and the company should take action.
