# What Is a DDoS Attack? Risks, Attack Types and Protection Methods for Organisations

**URL:** https://securesys.com.tr/en/learning/ddos-simulation/what-is-a-ddos-attack-risks-types-protection

![What Is a DDoS Attack? Risks, Attack Types and Protection Methods for Organisations](/images/bilgi-merkezi/covers/cover-ddos-01.webp)

A company's website may be running.

The firewall may be active.

The servers may be up to date.

The WAF may be in place.

The SOC team may be monitoring the systems 24/7.

But the moment the internet connection or critical services can no longer handle the incoming traffic, all of these systems become unreachable from the user's point of view.

That is the fundamental objective of **DDoS attacks**:

**To make the system unusable rather than to break into it.**

A distributed denial of service (DDoS) attack is a type of cyber attack that targets a website, server, application, API, DNS service or network infrastructure with heavy or resource-consuming traffic from a large number of sources, with the aim of disrupting legitimate users' access to the service. CISA likewise defines DoS/DDoS attacks as attacks that consume the target system's resources and render an application or website inaccessible to legitimate users. (CISA)

In a DDoS attack the attacker does not have to steal data, install malware or compromise an administrator account.

Sometimes the success of the attack is measured by a single outcome:

#### Can the service be delivered, or not?

DDoS security is therefore not a matter for network teams alone.

It is one of the shared concerns of **business continuity, cyber resilience, incident response, the SOC, network security, WAF, CDN, DNS security and corporate risk management**.

#### What Is DDoS?

**DDoS – distributed denial of service** describes an attack distributed across many sources.

The fundamental aim of the attack is to disrupt the availability of the target system or service.

The **CIA triad**, one of the core principles of cyber security, consists of three main elements:

#### Confidentiality

Preventing unauthorised people from accessing data.

#### Integrity

Preventing unauthorised modification of data.

#### Availability

Ensuring systems and data are usable when they are needed.

DDoS attacks act mainly on the third element, **availability**.

MITRE ATT&CK likewise covers the **Network Denial of Service – T1498** technique under the Impact tactic, noting that attackers can reduce the availability of web, email, DNS and web-based applications by consuming resources such as network bandwidth. (d3fend.mitre.org)

### What Is the Difference Between DoS and DDoS?

The terms DoS and DDoS are similar but not the same.

In a **DoS – denial of service** attack, the attack may be carried out from a single system or a limited source.

In a **DDoS – distributed denial of service** attack, the traffic can come from a large number of distributed sources.

Those sources may be;

compromised computers,

servers,

IoT devices,

routers,

botnet members.

The distributed structure makes defence harder.

Because blocking a single IP address may not be enough to stop the attack.

Traffic can arrive from thousands of different sources.

In some cases the attack traffic is geographically spread across different parts of the world.

### What Is the Purpose of a DDoS Attack?

The fundamental purpose of DDoS attacks is to create a service outage.

But attackers' motivations can vary.

For example;

#### Extortion

The attacker may demand payment in return for stopping the attack.

#### Hacktivism

The organisation's services may be targeted for political or ideological reasons.

#### Competition or sabotage

Digital services may be made unreachable at critical moments.

#### Distraction

DDoS can be used to distract security teams while another cyber attack is under way.

#### Reputational damage

Preventing customers from reaching the service may be the goal.

MITRE ATT&CK notes that network DoS activity can also be used to support hacktivism, extortion and other malicious activity. (d3fend.mitre.org)

A DDoS incident should therefore not be assessed merely as:

**“The website was down for a few hours.”**

Whether another attack lies behind the incident must also be investigated.

### How Does a DDoS Attack Work?

At its simplest, an internet service can be thought of as a business's front door.

Say 1,000 users per second can normally be served.

If hundreds of thousands of fake or malicious requests suddenly begin arriving, one or more of the system's components can exceed its capacity, such as the;

internet link,

firewall capacity,

connection table,

load balancer,

web server,

application server,

CPU,

memory,

database.

The result is that real users cannot reach the service.

But modern DDoS attacks consist of more than “sending a lot of traffic”.

Some attacks consume bandwidth while others target protocol resources or the application's processing capacity.

DDoS attacks must therefore be examined at different layers.

### What Are the Types of DDoS Attack?

From a corporate security perspective, DDoS attacks can generally be assessed in three main groups:

#### Volumetric Attacks

Aim to consume bandwidth by generating high-volume traffic.

#### Protocol Attacks

Try to consume protocol and connection resources at the network or transport layer.

#### Application Layer Attacks

Target the resources of web applications, APIs or other application services.

In terms of the OSI model, DDoS attacks can be seen at **layer 3, layer 4 and layer 7**. (Cloudflare Docs)

This distinction is important.

Because the same security technology may not be effective against every attack type.

### What Is a Volumetric DDoS Attack?

A **volumetric DDoS attack** aims to fill the target's internet connection or network capacity with a high volume of traffic.

The main measure here is generally traffic volume.

For example:

Mbps,

Gbps,

Tbps

are the usual units.

If the organisation's internet connection has 1 Gbps of capacity and attack traffic far above that is arriving at the upstream infrastructure, having a powerful firewall inside the company may not be enough on its own.

Because the internet link can reach saturation before the traffic even reaches the firewall.

In high-volume DDoS attacks, therefore, **upstream mitigation and scrubbing** mechanisms become important.

### What Is a Protocol DDoS Attack?

Rather than merely consuming bandwidth, protocol attacks can target the connection management resources of network devices or servers.

One of the best-known examples is the:

#### SYN Flood

attack.

By exploiting characteristics of the TCP connection establishment process, large numbers of half-open connections can be created on the target system.

The result is that the resources of components such as;

the firewall,

the load balancer,

the server,

connection tracking

can be exhausted.

This is one of the reasons modern DDoS protection systems look not only at traffic volume but also at **packet rate, connection state and traffic behaviour**.

### What Is a SYN Flood?

TCP connections involve a connection establishment process between client and server.

This process is generally known as the **TCP three-way handshake**.

In a normal connection the steps are;

SYN,

SYN-ACK,

ACK.

In a SYN flood attack, large numbers of connections are initiated with the aim of exhausting the target system's connection resources.

Tracking Mbps/Gbps figures alone is therefore not enough.

During DDoS monitoring, metrics such as;

#### Packets Per Second (PPS)

#### Connections Per Second (CPS)

also matter.

### What Is a UDP Flood?

A **UDP flood** is one of the DDoS attack types based on sending large volumes of UDP traffic to the target system.

Because UDP is connectionless, attackers can generate large numbers of packets.

The aim may be to consume;

network capacity,

firewall resources,

server processing capacity.

MITRE ATT&CK notes that stateless protocols such as UDP and ICMP are commonly used in direct network flood attacks. (MITRE ATT&CK)

### What Are Reflection and Amplification DDoS?

Two of the important concepts in the DDoS world are:

#### Reflection

and

#### Amplification

attacks.

In a reflection attack the attacker uses third-party systems rather than sending traffic directly to the target.

When the source IP address is spoofed to look like the target's address, the responses are directed at the victim.

Amplification takes advantage of a small request producing a much larger response.

MITRE ATT&CK classifies this as **Reflection Amplification – T1498.002**. (MITRE ATT&CK)

There can therefore be a serious difference between the traffic the attacker generates and the traffic that reaches the target.

### What Is DNS Amplification?

A **DNS amplification attack** is one of the best-known examples of amplification-based DDoS.

Misconfigured or abusable DNS services can be used to magnify attack traffic.

The victim's IP address is shown as the source address.

A query is sent to the DNS server.

The response goes not to the attacker but to the target.

When this behaviour is carried out across a large number of systems, the target can receive a very high volume of traffic.

In current DDoS protection systems, DNS amplification, DNS query floods and more advanced DNS attacks are handled as separate attack vectors. (Cloudflare Docs)

**DNS security** is therefore one of the important parts of DDoS resilience.

### What Is Layer 3 DDoS?

**Layer 3 DDoS** refers to attacks targeting the network layer of the OSI model.

IP and routing processes matter at this layer.

The aim is to affect the capacity or availability of the network infrastructure.

Layer 3 attacks can focus on the infrastructure rather than a specific web application and do not have to open a TCP connection. (Cloudflare)

Fighting layer 3 attacks therefore cannot be solved using a WAF alone.

### What Is Layer 4 DDoS?

**Layer 4** is the transport layer of the OSI model.

TCP and UDP are the important protocols at this level.

Layer 4 DDoS attacks can target areas such as;

connection capacity,

TCP state,

packet processing,

firewall resources.

SYN flood and various UDP flood behaviours can be assessed in this context.

L3/L4 attacks matter particularly for network infrastructure and upstream DDoS protection.

### What Is Layer 7 DDoS?

**Layer 7 DDoS** targets services at the application layer.

One of the best-known examples is the **HTTP flood** attack.

The aim here is not always to generate enormous bandwidth.

The attacker can target the application's resource-consuming functions.

For example;

search,

login,

reporting,

API calls,

dynamic page generation,

database queries

consume far more system resources than normal static content.

Layer 7 attacks typically try to consume web or API resources through HTTP requests. (Cloudflare)

Layer 7 DDoS attacks can therefore be effective even at low traffic volumes.

### What Is an HTTP Flood?

An **HTTP flood** is an application layer DDoS approach carried out by directing large numbers of HTTP GET or POST-like requests at a web application.

The important point separating these attacks from volumetric ones is this:

From the outside, the traffic can resemble normal user traffic.

A real user also sends:

GET /products

as a request.

A bot can send exactly the same request.

The defensive system should therefore not look at IP or traffic volume alone.

It must also assess;

request rate,

session behaviour,

URL pattern,

user-agent,

cookies,

client fingerprint,

request distribution,

application behaviour.

At this point **WAF, bot management, rate limiting and behavioural analytics** become important.

### What Is Slowloris?

In some application layer attacks the attacker tries to hold connections open for as long as possible rather than sending very high traffic.

**Slowloris** is one of the known examples of this approach.

The aim is to exhaust the server's connection pool or worker resources.

This example shows an important truth about DDoS:

**A DDoS attack does not always need enormous Gbps traffic to be dangerous.**

Low-volume attacks targeting how the application works can also cause a service outage.

### What Is a Botnet?

A **botnet** is a network of many compromised devices controlled by an attacker.

These devices may be;

computers,

servers,

cameras,

IoT devices,

routers.

The device owners may not realise their systems are part of a botnet.

The attacker can direct thousands of devices or more at the same target to create a distributed attack.

MITRE ATT&CK likewise notes that large botnets can generate high-volume traffic from systems spread across different parts of the world. (MITRE ATT&CK)

This structure is one of the main factors making DDoS attacks hard to block.

### Which Systems Can Be Targeted in a DDoS Attack?

DDoS is not aimed at websites alone.

The target may be;

the corporate website,

an e-commerce platform,

a mobile application backend,

an API gateway,

a DNS server,

a VPN gateway,

the internet connection,

a game server,

a mail gateway,

an authentication service,

a cloud workload,

a customer portal.

When carrying out a DDoS risk assessment, therefore, the company website should not be the only thing considered.

An inventory of **internet-facing critical services** must be produced.

### How Does a DDoS Attack Harm Organisations?

The most visible effect of a DDoS attack is the access outage.

But the real business impact can be far broader.

#### Revenue Loss

In e-commerce or online service organisations, every minute can create direct revenue loss.

#### Customer Dissatisfaction

When users cannot reach the service they may turn to alternative platforms.

#### Reputational Damage

A prolonged outage can create a negative perception of the organisation's technology and security competence.

#### Operational Cost

SOC, network, systems, application and management teams all have to respond to the incident.

#### SLA Breach

Service level commitments given to corporate customers may be breached.

#### Business Continuity Risk

The loss of critical digital services can halt business processes.

CISA likewise draws attention to the fact that DDoS attacks can cost organisations time, money and reputation. (CISA)

### How Is a DDoS Attack Detected?

DDoS detection consists of more than a “traffic increased” alert.

The organisation's normal traffic behaviour must be known.

This approach is called a **traffic baseline**.

Under normal conditions the values for;

average bandwidth,

PPS,

CPS,

HTTP request rate,

DNS query rate,

concurrent connections,

CPU utilisation,

application response time

must be known.

Unexpected changes in these values can be an early indicator of an attack.

MITRE's current detection approach likewise takes behavioural signals such as high traffic volume, abnormal packet rates and incomplete TCP sessions into account for network DoS detection. (MITRE ATT&CK)

### What Are the Signs of a DDoS Attack?

Possible signs include;

the website slowing down,

high latency,

packet loss,

rising CPU,

a sudden jump in firewall session counts,

the internet link reaching saturation,

large numbers of similar HTTP requests,

traffic from unusual geographies,

a rise in DNS queries,

increasing API response time,

a rising 5xx error rate.

But none of these signs necessarily means DDoS.

A flash crowd or a successful campaign can also produce a traffic increase.

Separating **normal user demand from attack traffic** is therefore critically important.

### How Is DDoS Protection Achieved?

Achieving full protection against DDoS with a single security product is unrealistic in most cases.

A layered approach is required.

In a corporate DDoS protection architecture;

#### Anti-DDoS

filtering high-volume and protocol-based attacks,

#### Scrubbing Centre

cleaning the traffic so only legitimate traffic reaches the organisation,

#### CDN

serving web content from distributed infrastructure,

#### WAF

analysing application layer attacks,

#### Rate Limiting

limiting the request rate of particular clients or behaviours,

#### Bot Management

analysing automation and bot behaviour,

#### Load Balancing

distributing traffic across different systems,

#### DNS Protection

protecting the DNS infrastructure against attack,

#### SOC/SIEM/NDR

monitoring and correlating events

can all be considered together.

Modern DDoS defences likewise handle L3/L4 and L7 attacks in separate layers. (Cloudflare Docs)

### Does a Firewall Block a DDoS Attack?

The answer to this question is:

**It depends on the type and size of the attack.**

A firewall can limit certain flood behaviours.

It can apply connection limits.

It can block particular IPs or protocols.

But if the attack is larger than the capacity of the organisation's internet link, the traffic can exhaust the connection before it even reaches the firewall.

If the organisation has a 1 Gbps internet connection and a far higher volume attack is filling the upstream link, having a high-capacity firewall inside does not solve the problem on its own.

It is therefore important that volumetric DDoS protection can filter attack traffic **before it reaches the organisation's internet link**.

### Does a WAF Provide DDoS Protection?

A **web application firewall (WAF)** is an important security layer, particularly against layer 7 attacks.

A WAF can assess information such as;

HTTP request patterns,

the URL,

headers,

cookies,

request rate,

client behaviour.

But it is wrong to see the WAF as the single solution for every DDoS type.

A WAF works mainly at the application layer.

Very high-volume network attacks may require upstream anti-DDoS capacity.

For that reason:

**WAF + CDN + anti-DDoS + network security**

must be considered together.

### How Does a CDN Help with DDoS Protection?

A **content delivery network (CDN)** can serve content from distributed systems in different geographies.

Traffic is therefore not concentrated on a single origin server.

Through mechanisms such as;

caching,

distributed infrastructure,

edge filtering,

a CDN can improve the resilience of web services in particular.

But using a CDN does not mean the organisation is automatically protected against every DDoS attack.

Origin IP exposure,

DNS architecture,

API endpoints,

non-HTTP services

must be assessed separately.

### What Is a Scrubbing Centre?

A **DDoS scrubbing centre** is the infrastructure used to analyse internet traffic, clean out attack traffic and forward legitimate traffic to the target system.

The basic logic is as follows:

#### Internet Traffic

↓

#### Scrubbing Infrastructure

↓

**Malicious traffic → dropped**

**Legitimate traffic → customer**

Scrubbing capacity is critically important in high-volume volumetric attacks in particular.

### What Is DDoS Mitigation?

**DDoS mitigation** is the general name for the technical and operational processes applied to reduce or entirely prevent the impact of a DDoS attack.

Mitigation is not simply blocking traffic.

It can include;

traffic filtering,

rate limiting,

IP reputation,

behavioural analysis,

challenge mechanisms,

traffic diversion,

scrubbing,

autoscaling,

geo-based controls.

What matters is how quickly the mitigation mechanism engages once the attack starts.

### The Difference Between Always-On and On-Demand DDoS Protection

Two different approaches can be seen in corporate DDoS solutions.

#### Always-On DDoS Protection

Traffic passes continuously through the protection infrastructure or is analysed continuously.

Its advantage is being able to respond to an attack faster.

#### On-Demand DDoS Protection

Normal traffic follows the standard route.

When an attack is detected, traffic is diverted to the mitigation infrastructure.

Here detection and diversion time matter.

Which model is right should be assessed against the organisation's;

risk profile,

service criticality,

latency requirements,

cost structure,

network architecture.

### What Is a DDoS Resilience Test?

Having an anti-DDoS solution in place does not mean it will definitely work during a real attack.

A controlled **DDoS resilience test** or **DDoS attack simulation** can therefore be carried out.

The aim is not to create a real service outage.

The aim is to measure how the organisation's DDoS defence responds within safe boundaries.

During the test;

network capacity,

firewall behaviour,

the WAF,

the CDN,

anti-DDoS,

the SOC,

the SIEM,

the alert mechanism,

incident response

can all be assessed together.

### Is Only Traffic Capacity Measured in a DDoS Test?

No.

This is where the real value of a professional DDoS attack simulation lies.

These questions should be asked, for example:

#### Was the attack detected correctly?

#### Did anti-DDoS engage automatically?

#### Did the SOC receive an alert?

#### Did the notification reach the network team?

#### Could the WAF distinguish the layer 7 attack?

#### Did real users continue to receive service?

#### How much was application response time affected?

#### How long did mitigation take to begin?

#### Did the service return to normal after the attack ended?

The exercise then moves beyond a bandwidth test and becomes a genuine **DDoS resilience assessment**.

### Are a DDoS Attack and a Penetration Test the Same Thing?

No.

A **penetration test** focuses on identifying vulnerabilities in systems and assessing the risk of unauthorised access or a security breach.

A **DDoS test** mainly measures availability and service resilience.

A pentest asks:

**“Can I get into the system?”**

A DDoS simulation focuses on:

**“Can I stop the system serving, and how does the organisation respond?”**

The two exercises are not alternatives to one another.

They measure different security risks.

### Why Must a DDoS Test Be Controlled?

Unlike many other security tests, DDoS tests can directly affect service capacity.

Before the test, therefore;

authorisation,

rules of engagement,

target IPs,

the maximum traffic level,

test hours,

stop conditions,

emergency contacts,

ISP/CDN/anti-DDoS coordination

must be clearly established.

A badly planned DDoS test can turn into a real service outage.

Corporate DDoS simulation must therefore be carried out in a controlled and graduated way.

### Why Is a DDoS Incident Response Plan Necessary?

Asking the question:

**“What do we do now?”**

for the first time once the attack has begun may be too late.

The organisation must have a prepared **DDoS incident response playbook**.

That playbook must define responsibilities between;

the SOC,

network,

systems,

applications,

the ISP,

the CDN,

the anti-DDoS provider,

management.

Contact details and escalation mechanisms in particular must be verified before the attack.

### Is DDoS Part of Business Continuity?

Absolutely.

Although DDoS is a technical network attack, its consequence is a business continuity problem.

When;

a bank's mobile banking,

an e-commerce company's payment page,

a holding group's customer portal,

a SaaS company's API

becomes unreachable, the problem is no longer the SOC's alone.

DDoS scenarios must therefore be assessed within **business continuity plan (BCP)** and **disaster recovery (DR)** processes.

### How Should Organisations Assess DDoS Risk?

The first step is to identify critical internet services.

These questions can then be asked for each service:

#### How does the service reach the internet?

#### What is the internet capacity?

#### Is the origin IP visible from outside?

#### Is a CDN in use?

#### Is there a WAF?

#### Is an anti-DDoS service in place?

#### Is the DNS infrastructure redundant?

#### Is there L3/L4 protection?

#### Is there layer 7 protection?

#### Is rate limiting applied?

#### Can the SOC see the attack?

#### Is the DDoS playbook ready?

#### When was the last DDoS test carried out?

These questions reveal the organisation's real **DDoS readiness** level.

### The Biggest Mistake in DDoS Security: “We Have Anti-DDoS”

Buying a security product does not mean the risk has disappeared entirely.

An anti-DDoS service may be in place.

But it may be misconfigured.

The traffic threshold may be wrong.

The origin IP may be exposed.

The layer 7 service may not be protected.

DNS may sit on different infrastructure.

SOC integration may not have been done.

Who calls the provider during an attack may be unknown.

The core question should therefore not be:

**“Do we have a DDoS protection product?”**

but:

**“When a DDoS attack happens, does our whole defensive chain actually work?”**

### Conclusion: DDoS Protection Is Not a Product but a Resilience Process

DDoS attacks are one of the important availability threats aimed directly at modern organisations' digital services.

An attack can target;

bandwidth,

network devices,

TCP connections,

DNS services,

web applications,

APIs.

No single defence mechanism is therefore sufficient for every attack type.

A strong DDoS defence requires the layers;

**anti-DDoS + scrubbing + CDN + WAF + DNS security + rate limiting + network monitoring + SOC + incident response**

to work together.

But above all of these sits another requirement:

**Testing.**

Because a security architecture that works on paper and one that works under a real attack are not the same thing.

It must be measured;

how many Gbps or PPS of traffic the organisation can absorb,

which attack types it detects automatically,

at which point the service slows down,

at which point the anti-DDoS system engages,

how long the SOC takes to notice the attack.

That is exactly why **corporate DDoS attack simulation and DDoS resilience testing** are carried out.

But to measure DDoS resilience correctly we first have to understand how the attacks differ from one another.

Because a **SYN flood**, a **DNS amplification** attack and an **HTTP flood** are not the same DDoS attack.

They target different resources.

They produce different symptoms.

And they require different defence mechanisms.