Denial Of Service

Definition

Explore More Terms

Examples & Use Cases

## Why It Matters in Practice
Availability is one of the core pillars of cybersecurity (CIA Triad).  
DoS attacks can:
- Interrupt business operations
- Cause financial losses
- Impact customer trust
- Distract defenders while other attacks occur

Even short outages can severely affect critical services such as banking, healthcare, e-commerce, and government systems.

---

## Types of DoS Attacks
- Volumetric Attacks (bandwidth exhaustion)
- Protocol Attacks (network stack exhaustion)
- Application Layer Attacks (HTTP floods, API abuse)
- Distributed Denial of Service (DDoS) using botnets
- Reflection & Amplification Attacks (DNS, NTP, Memcached)

---

## Key Points
- Targets system availability rather than confidentiality
- Often uses large numbers of compromised devices
- Can affect websites, APIs, DNS, VPNs, and cloud services
- Frequently used for extortion or disruption campaigns
- Detection often relies on traffic baselining and anomaly analysis

---

## Common Usages
- Flooding a server with HTTP requests
- SYN flood attacks against TCP services
- Overwhelming DNS infrastructure
- API rate exhaustion
- Botnet-driven traffic spikes
- Layer 7 attacks against login portals

---

## Real-World Example
An online retail company experiences a massive surge of malicious traffic during a sales event.  
Attackers use a botnet to send millions of requests per second, overwhelming the web servers and causing the site to become unavailable for legitimate customers.

---

## Detection & Mitigation Techniques
- Rate limiting
- Web Application Firewalls (WAF)
- CDN-based traffic filtering
- Load balancing
- Anycast routing
- Traffic scrubbing services
- SYN cookies and connection limiting
- Behavioral anomaly detection

---

## Indicators of a DoS Attack
- Sudden spikes in inbound traffic
- Increased latency or timeouts
- Service unavailability
- High CPU or memory utilization
- Large numbers of requests from unusual IP ranges
- Network saturation alerts

---

## Limitations
- Difficult to fully prevent against large-scale attacks
- Mitigation can be costly
- False positives may block legitimate users
- Encrypted traffic inspection adds complexity
- Attack traffic may originate from legitimate but compromised systems

---

## Further Reading
- [Cloudflare - What is a DDoS Attack?](https://www.cloudflare.com/learning/ddos/what-is-a-ddos-attack/)
- [AWS - DDoS Resilience Best Practices](https://docs.aws.amazon.com/whitepapers/latest/aws-best-practices-ddos-resiliency/welcome.html)
- [CISA - Understanding Denial-of-Service Attacks](https://www.cisa.gov/news-events/news/understanding-denial-service-attacks)
- [Microsoft - DDoS Protection Overview](https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview)