Distributed denial-of-service attack

Distributed denial-of-service (DDos) attacks are on the rise again, with cheap tools available to launch them and cybercrminals using DDoS as part of broader attacks.

360° cyber protection

In a DDoS attack, a cybercriminal overwhelms your Internet-facing resources with so many demands that they slow to a crawl or stop responding entirely. Defending against DDoS attacks often requires expert help, and we can connect you with the experts you need to prepare for and manage the attack.

The stages of an attack

Sophisticated attacks may start with social engineering in order to get information about an organisation’s website set-up and resources, the size of the IT team, the capacity to pay a ransom, and other sensitive information.
But in a typical attack, one cybercriminal starts with a limited DDoS attack against a web target. Then they engage in further larger attacks until they identify the attack size needed to make the target completely inaccessible. That cybercriminal may then continue or, more often, sell the details on the dark web for another cybercriminal to exploit later.

An organisation may believe the attack was all over, while in fact another cybercriminal could purchase the attack details and launch it at any time. In some cases, it may be months or years before the attack occurs.

You should interpret consecutive and progressive DDOS attacks as a warning sign. Even if no significant DDoS attack happens or it happens for a short time, you should be prepared for worse.
Attacks are typically motivated by money (for ransom) or simply the desire to harm (for political, activist, or competitive reasons), and may be timed to occur before a major event (such as Black Friday). Typically, the cybercriminal uses a network of compromised systems to generate the traffic involved in the attack. Social engineering may continue during such an attack, with cybercriminals posing as service providers who can assist with containment and recovery relating to the attack.

Broadly speaking, DDoS attacks are an attempt to bring down a system or a resource, by flooding it with excessive demands intended to consume the available bandwidth or exhaust an application server
Sophisticated attacks may occur in stages intended to overwhelm the organisation’s IT team. The cybercriminal may target the organisation’s website, and then other website components such as login pages or contact forms, in order to disrupt the website. The attack may also serve as cover for other activity separate from the DDoS attack, such as targeting backups, stealing data, or launching ransomware.
The cybercriminal demands a ransom in order to stop the attack and allow the organisation to recover. In attacks motivated by political or terrorist goals, however, disruption may be the sole goal, with no ransom demand.

How to protect against DDoS attacks

Protection starts with an understanding of your Internet-facing systems and determining what needs to be protected.
Many resources are available to help prevent DDoS attacks but they need to be set up properly and tested under stress. Load balancers spread network traffic to reduce overloads. Web application firewalls (WAFs) can restrict the types of traffic that go to application servers, while input validation can reject web requests that are intended to cause delays. Major cloud providers and expert vendors also offer specialized networks or infrastructure designed specifically to mitigate DDoS.
Work with your Internet service provider (ISP) to understand what protections against DDoS they provide as part of your service. Consider a cloud security assessment to test for vulnerabilities in your cloud services.
Consider providers like Cloudflare or Akamai that offer DDoS protection for both network-layer and application-layer attacks. Reducing and controlling these attacks is much more efficient if that fallback infrastructure is set up ahead of time. We can help by making introductions with the right vendors before an incident occurs.

Prevention Services

View all services

Product

Bullwall Ransomware Encryption, Detection & Response

If you do get a ransomware infection - Bullwall detects encryption of files and triggers an automatic response, minimizing damage. Receive 50% off on installation cost, and up to 25% on licences.

Provided by: BullWall

Product

KnowBe4 Anti-Phishing Training

Up to 25% off on KnowBe4’s anti-phishing tools, including simulated phishing campaigns and interactive awareness training.

Provided by: KnowBe4

Product

Trellix Email Protection

Up to 60% off on Trellix’s Email Threat Prevention - prevent email threats and address business email compromise risks.

Provided by: Trellix

Discover our risk management offerings

We offer our cyber policyholders a range of risk management offerings designed to improve your cyber resilience, reduce human error, and manage digital risk.

Find out more

Distributed denial-of-service attack

360° cyber protection

The stages of an attack

Reconnaissance

Exploratory attacks

The main attack

Possible phased attack

Demand

How to protect against DDoS attacks

How to protect against DDoS attacks

Understand and document your critical assets

Get help with network design and tuning

Understand and test the security functionality of your systems and software

Cloud-based DDoS mitigation service

Prevention Services

Bullwall Ransomware Encryption, Detection & Response

KnowBe4 Anti-Phishing Training

Trellix Email Protection

Discover our risk management offerings

What can we help you with?