How to prevent DDoS attacks: tips from security experts

How DDoS attacks work

DDoS attacks can strike at any time and aim to overwhelm a server, service, or network with excessive Internet traffic, disrupting normal operations.

DDoS attackers often use botnets — compromised computer networks, known as “zombies” or “bots.” These bots are typically infected with malware and controlled remotely by the attacker.

When the attacker initiates a DDoS attack, they command all the bots in the botnet to send a massive volume of requests to the target server or network. This overwhelming influx of traffic exceeds the server’s capacity to handle legitimate requests, causing a slowdown or complete outage.

There are three types of DDoS attacks:

1. Volume-based attacks\xa0— These are the most common types of DDoS attacks. They aim to saturate the bandwidth of the targeted site or network. Techniques include UDP floods, ICMP floods, and other spoofed-packet floods.
2. Protocol attacks\xa0—These attacks consume server resources or intermediate communication equipment like firewalls and load balancers. Examples include SYN (synchronize) message floods, fragmented packet attacks, and the oversized packets used in ping-of-death attacks.
3. Application layer attacks\xa0—\xa0These are the most sophisticated and stealthy DDoS attacks, targeting specific applications or services. They generate legitimate-looking requests but in large volumes, making distinguishing between legitimate traffic and attack traffic hard. Examples include HTTP floods and Slowloris attacks, which can be effective at lower request volumes than standard HTTP floods by keeping server connections open.