What is a DDoS Attack? Examples, Types, and Prevention Tips

As technology advances, cybercriminals are finding new, inventive ways to attack legitimate websites. One such method is a distributed-denial-of-service (DDoS) attack. To deploy a DDoS attack, a hacker will flood a company’s server with traffic to block legitimate users from its site.¹

Hackers often use this method to take down popular companies with whose policies they disagree, or to steal customers from a competitor company.

A standard denial-of-service attack deploys bots to jam up services in an attempt to keep people from using the targeted company’s website, flooding its server with fake requests. DDoS takes this tactic to the next level, using multiple sources to make it harder to pinpoint who's attacking the system.²

As a cybersecurity professional, it's important to understand DDoS attacks because they can disrupt your company’s ability to operate. Your website remains inaccessible to legitimate customers, which can damage your company’s reputation and cost a great deal of money.

Knowing how to identify these attacks helps you prevent them. Read on to familiarize yourself with the types of DDoS attacks you may encounter in the cybersecurity field.

A DDoS attack uses multiple devices to send fake requests to overwhelm your server, so it can’t handle legitimate traffic. Threat actors often use botnets—a group of devices that are connected to the internet and infected with malware that the attacker can control—to carry out these attacks.³ They start by using malware to create botnets. They then learn about potential targets to find vulnerable websites, servers, and networks. Once attackers have set their sights on a target, they develop the communication structure that controls the botnet. They then initiate the attack and adjust their tactics depending on how they want to disrupt the system.⁴

When selecting targets, hackers will look for coding loopholes, weak servers, unpatched systems, and other vulnerabilities.⁵

There are many types of DDoS attacks, including application-layer attacks and multi-vector attacks. These produce similar results, but the steps taken to get there vary. A multi-vector attack involves launching multiple DDoS attacks at once for a more severe result. This type of attack can essentially shut down your website and other information systems. An application-layer attack involves specifically targeting vulnerabilities in common applications such as Windows, Apache, or your web server.

A CharGEN attack involves attacking devices that use the Character Generator Protocol for testing and debugging.⁶ Other common attacks include zero-day attacks, which exploit coding errors, and packet flood attacks. Packet flood attacks, which are the most common, involve sending millions of requests to your server to block legitimate traffic.

An attacker may combine different types of DDoS attacks to do the most damage.

When they’re successful, DDoS attacks can have serious consequences for your business. Anytime a company’s servers go down, the company has to pay its IT staff and consultants to recover its systems quickly. Customers who can’t use a company’s app or website as usual often get angry and turn to the internet to trash the company.

In 2016, the Domain Name System (DNS) provider Dyn, which offered domain registration and internet performance management services to multiple customers, fell victim to a DDoS attack. The attackers used botnets to attack Internet of Things (IoT) devices and flood servers with fake requests. Because of the attack, many popular sites, including Twitter, Reddit, and Netflix, were unavailable to legitimate users.⁷

In September 2012, multiple banks in the U.S. were attacked.⁸ This DDoS attack caused website outages for Wells Fargo, JPMorgan Chase, and Bank of America customers. For hours, customers couldn’t access their accounts, pay their bills, or make any financial transactions.

Recent DDoS attacks have also incorporated ransomware, a type of malware attackers use to shut down the targeted system until its owners pay a ransom.⁹

As a cybersecurity professional, you often serve as the first line of defense against DDoS attacks. As you rise through the ranks of your career in cybersecurity, you'll likely encounter DDoS attempts. Thankfully, you can take steps to prevent them. In recent years, large companies, including Amazon and Google, have successfully blocked potential DDoS attacks.¹⁰

A strong system is the best defense.¹¹ Regularly assess your system for vulnerabilities and patch any weaknesses. Choose the right firewalls for your system. Next, determine how people access your network. If your employees work remotely, they might use a virtual private network (VPN). Check these and other entry points to your network.

Use a DDoS protection service that automatically detects and reroutes these attacks. Talk to your internet service provider and other managed service providers about DDoS protection. Regularly assess your system to see how the code and design might make you vulnerable.

Finally, make sure you have a recovery plan in place. Even with proper preparation, you may come under attack. Develop a plan to identify, mitigate, and recover from an attack.

Create detailed protocols for backing up your data and using it to repair your system once you’ve taken it offline. Develop communication protocols for your internal staff and your customers to reassure them about steps you’re taking to resolve the problem.

Gain a deeper understanding of DDoS attacks and the strategies to defend against them with an online Master of Science in Cybersecurity from Yeshiva University’s Katz School of Science and Health. Our affordable program, designed to be completed in under two years, helps you quickly build the skills needed to advance your career.

Our expert faculty bring decades of hands-on experience from high-risk industries such as financial services, telecommunications, wealth management, and financial technology. They've witnessed cyberattacks up close and have crafted a curriculum focused on real-world prevention and response. You’ll learn to manage risk, conduct system audits, and design secure system architectures—all with the support of personalized feedback and flexible virtual office hours.

Take your first step toward success by contacting an admissions outreach advisor today.