Distributed Denial of Service (DDoS)

A denial of service (DoS) attack is an attempt to overload a website or network to degrade its performance or make it completely inaccessible. A DDoS attack is a form of DoS that originates from more than one source. Often each machine in a botnet sends a flood of traffic or requests to the target at the same time. Spreading the attack across many sources usually generates more traffic, makes attacker traffic harder to distinguish from legitimate traffic, and makes the attack difficult to trace and block by IP address.

CISA groups DoS and DDoS techniques into three types. Volume-based attacks consume the target's bandwidth or system resources with a massive volume of traffic. Protocol-based attacks exploit weaknesses in network protocols or services and typically target layers 3 and 4 of the OSI model. Application layer attacks target vulnerabilities in specific applications or services at layer 7, consuming processing power or causing them to malfunction. Attackers can combine several techniques in one attack.

A successful attack results in loss of availability of part or all of a system and can lead to service outages, financial losses, and reputational damage. Common signs include a website or service that suddenly becomes inaccessible or slow, a sudden increase in network traffic, and unusual traffic patterns such as many requests from specific IP addresses.

CISA lists steps to take before an attack, such as a risk assessment, network monitoring with intrusion detection, a baseline of normal traffic, a DDoS mitigation service that filters malicious traffic before it reaches the network, extra bandwidth capacity, load balancing, firewall rate limits, and an incident response plan. The NCSC's guidance sets out four practices: understand your service, understand your defenses, create a response plan, and test your response.