What Is DDoS?

In a world where internet users spend about seven hours a day online, the digital world is as commonplace as the air we breathe.1 As we navigate that world, we run the risk of leaving a long and accessible paper trail of personally identifiable information (PII) in our wake. That’s why it’s important to understand digital security threats.

We recently put together a guide to personal digital security, tapping our combined security expertise to provide a 20,000-foot view of some of the biggest threats out there and how to stay safe. Now it’s time to descend a bit and take a look at DDoS attacks and how they affect our digital safety.

DDoS, or distributed denial of service, attacks are a cybercrime in which a bad actor overwhelms a server with internet traffic, rendering users unable to access internet services and sites. Affected devices can include computers and IoT devices. The attacks are serious and on the rise. Cisco predicted that the total number of DDoS attacks would double from 7.9 million in 2018 to over 15 million in 2023.2

Before we dig deeper into what the attacks are and how to guard against them, let’s start with the types of DDoS attacks.

Did You Know: IoT, or Internet of Things, is a fun umbrella term that refers to all the devices that aren’t your computer but can connect to the internet. Since they connect to the internet, DDoS attacks can affect them as well. That’s why the best smart-home security systems feature DDoS protections.

Types of DDoS Attacks

DDoS attacks come in different forms, but they all have one thing in common: They attack different components of a network connection. Let’s start there, with a quick primer on how network connections are made.

Like a floor plan of a house, there are different layers to a network connection. The OSI, or open systems interconnection, model describes seven layers systems use to communicate via an online network.3 OSI emerged in the early 1980s as the gold standard for major computer and telecom companies. Below is a simple table to lay out the architecture, per the OSI model.

More on How Data Flows

The OSI Model is not explicitly used in the modern internet, but it offers a simple framework for how data flows. This allows us to troubleshoot issues as they come up, whether it’s one user who can’t get their computer online or Amazon being down for millions of users.

Throughout this model, there may be other terms you recognize. The first layer — the application layer — for example, is where we encounter protocols such as HTTP, as well as SMTP (simple mail transfer protocol), which enables email communications. The network layer is where we encounter packets, small units on a sender’s device that are then reassembled on the receiver’s device.

Let’s get back to DDoS and how the attacks can manifest along different rungs of the model — earlier, in the middle, or even at the physical layer.

Where DDoS Attacks Can Crop Up

Recalling our handy-dandy OSI model, DDoS attacks are most common during four layers: network (layer 3), transport (layer 4), presentation (layer 6), and application (layer 7).

The most common DDoS attacks happen at layers three and four, and may include:

• Synchronized (SYN) floods and attacks such as UDP floods. Think of an SYN flood as a worker in the backroom receiving many requests from the front of the store. Sounds overwhelming, right?
• Such attacks are usually very large and seek to inundate the capacity of a network or application server.
• The attacks also have clear signatures and, as a general rule, are easier to detect.

DDoS attacks also happen at layers six and seven. Here’s what to know about those attacks:

• They are less ubiquitous, but they are usually more devastating.
• Generally smaller in nature, they target expensive parts of the application, making them unavailable to users. An example of that is an avalanche of HTTP requests to a login page.
• Another example of a DDoS attack at the application or presentation layers is a WordPress pingback attack, which has impacted the popular content-management system.
• WordPress has a pingback feature that informs the blog owner when another website links to a page of the WordPress blog. On the flip side, though, the tool can be exploited for discovering computers on a network or for DDoS attacks.

>> Read More: How to Unblock a Website: Step-by-Step Instructions

A Brief History of DDoS Attacks

Remember the old saying, “Those who do not know their history are doomed to repeat it”? That also applies to digital security. Below are a few of the most notable DDoS attacks over the past decades.

• Perhaps the first instance of a DDoS attack brings us back to the groovy days of the 1970s. Not all was groovy, however, at the Computer-Based Education Research Laboratory (CERL) at the University of Illinois, Urbana-Champaign, in 1974, when a PLATO computer user learned about a new command that could be run on the computer terminals at CERL — effectively locking up the system.4 At the time, PLATO was a premier computerized shared learning system.
• Other early DDoS attacks include 1996’s attack on Panix, an early ISP. The service was sent offline for several days by what’s called an SYN flood, which inundates a server with a ton of initial connection request packets all at once. We’ll get more into the various kinds of DDoS attacks later on.

• In 2018, software developer platform GitHub was hit with a DDoS attack that clocked in at 1.35 terabits per second. The attack lasted for about 15 to 20 minutes.5 GitHub tapped Akamai Prolexic, its DDoS mitigation service, which took over as an intermediary and blocked suspicious packets. Soon after, the attackers relented.
• In 2022, Google’s DDoS Response Team announced that a Google Cloud Armor customer was hit with a number of HTTPS DDoS attacks. The attacks peaked at 46 million requests per second.6 To put that in perspective, Google says that’s tantamount to receiving all the daily requests to Wikipedia — one of the most trafficked websites in the world — in only 10 seconds. Because the customer had Cloud Armor, the attack was thwarted before it fully ramped up, and the customer’s service stayed online the whole time.

>> Learn About: How to Delete Personal Information From Google

How to Protect Against DDoS Attacks

Finally, the section you’ve been waiting for. How do you stop these attacks and keep your devices and networks safe? We’ve put together a list of best practices to guard against the different kinds of DDoS attacks out there.

As a general rule, the more complex and far-reaching the attack, the more mitigation tools you need to have in your arsenal. Below are a few things you need to have in your quiver of digital security.

1. Get a good web application firewall. As security experts, we’ve stressed the importance of having a good firewall time and again. To review, a firewall acts like a security intermediary between a network and outside traffic. A web application firewall (WAF) specifically protects your web applications from common vulnerabilities and exploits. A WAF also guards sensitive data, such as financial information.
2. Consider black hole routing. One way to deal with a DDoS attack is to give it nothing to work with. Black hole routing involves configuring routers to drop incoming and outgoing traffic to and from a specific IP address. The problem with that tactic is that both benign and malicious traffic is inaccessible. You’re offline — but at least the DDoS attack can’t take root.
3. Use rate limiting. This is something that would be implemented by a security engineer. Rate limiting involves limiting the amount of requests made to a service or system. DDoS attacks aim to overwhelm and inundate, but rate limiting puts a cap on how many requests a given traffic source can make.
4. Connect to a VPN. VPNs can prevent DDoS attacks by preventing attackers from finding your network and hiding your IP address. Instead of attacking your actual network, when you connect through a VPN, a DDoS attacker only knows the IP address of the VPN’s server. The attacks would hit only your VPN, keeping you safe. You can also just connect to a different server.

1. Invest in good anti-DDoS software. We also recommend buying some good anti-DDoS software. We’re particularly keen on Cloudflare Application Security and Performance, as well as HAProxy, both of which are free open-source tools.

What to Do If You’re in the Midst of a DDoS Attack

No prevention method is foolproof. If a DDoS attack happens, one thing you can do is apply black hole routing. The downside is that not only are you blocking attackers, but you’re also potentially blocking legitimate users. Rate limiting is something you can do proactively before a DDoS attack, but also during an attack. In the midst of an attack, you can also ramp up server capacity by adding additional servers to handle the increased load. That would not, however, curtail the root of the problem — an ongoing DDoS attack.

That’s where cyber insurance can come in handy. Let’s face it: There are a lot more risks out there than just DDoS attacks. Having insurance for cyber attacks can definitely come in handy, whether you’re an individual or a business. If you go for cyber insurance, you still need to take your cybersecurity seriously with a top-tier antivirus software. Even if you have car insurance, you still do your best to drive safely and avoid accidents. The same goes for cyber insurance.

Bottom Line

We’ve covered a lot in this primer. A DDoS attack happens when a bad actor overwhelms a server with internet traffic, rendering users unable to access internet services and sites. There are many kinds of DDoS attacks that happen at different levels, leading to things like a cascade of HTTP requests. Firewalls, black hole routing, and good anti-DDoS software can help prevent and curb such attacks and keep you and your systems safe.