Catalog
concept#Security#Reliability#Architecture#Observability

Distributed Denial of Service (DDoS)

Coordinated attack that overloads services with massive traffic and impairs availability.

Distributed Denial of Service (DDoS) denotes coordinated attacks that overload a service's resources with massive traffic and reduce availability.
Established
High

Classification

  • High
  • Technical
  • Architectural
  • Intermediate

Technical context

Content Delivery Networks (CDN)Web Application Firewall (WAF)Security Information and Event Management (SIEM)

Principles & goals

Early detection via baselines and anomaly detectionLayered defense: edge, network, applicationCoordinate with providers and prepare legal actions
Run
Enterprise, Domain, Team

Use cases & scenarios

Compromises

  • Misconfigurations can make services inaccessible
  • Attackers adapt tactics, e.g., low-and-slow methods
  • Cost spikes due to unplanned scaling or scrubbing
  • Implement minimal attack surface and rate limiting
  • Deploy telemetry on all critical paths and correlate events
  • Practice incident response regularly including provider coordination

I/O & resources

  • Network traffic logs and telemetry
  • Baseline profiles of legitimate usage
  • Access to edge and CDN configuration
  • List of filtered IPs/networks and deployed rulesets
  • Incident documentation and forensic artifacts
  • Recommended architecture changes for risk reduction

Description

Distributed Denial of Service (DDoS) denotes coordinated attacks that overload a service's resources with massive traffic and reduce availability. The concept covers attack vectors, detection principles and mitigation strategies at network and application layers. Relevant measures include monitoring, scaling, filtering, collaboration with upstream providers and legal response.

✔

  • Improved availability and reduced downtime
  • Better situational awareness through telemetry and forensics
  • Scalable mitigation options reduce business risk

✖

  • Complete prevention of large volumetric attacks is costly
  • False positives can impact legitimate traffic
  • Dependence on third parties (CDN/ISP) for effective scrubbing capacity

  • Number of blocked malicious connections per minute

    Measures effectiveness of filters and blacklists against attacking connections.

  • Peak bandwidth utilization during an incident

    Shows maximum load on network and aids capacity planning.

  • Mean Time to Mitigate (MTTM)

    Average time from detection to effective countermeasure.

Mirai botnet (2016)

Large-scale attack leveraging compromised IoT devices that impacted DNS providers and accelerated adoption of DDoS defenses.

Targeted API flood on an online service

Attacks on specific API routes caused elevated latency and required WAF rules and throttling.

Volumetric attack against e‑commerce platform

Massive bandwidth load on infrastructure that required CDN-based scrubbing services and ISP coordination.

1

Baseline analysis: capture traffic profiles and define anomalies

2

Configure monitoring and alerting for relevant metrics

3

Create layered mitigation plan (edge, network, application)

4

Define automated response playbooks and escalation paths

5

Conduct regular tests and drills with providers

⚠️ Technical debt & bottlenecks

  • Old firewall rules without documentation
  • Lack of automation for incident response
  • Insufficient telemetry at edge nodes
Network bandwidthEdge processing capacityDetection accuracy
  • Excessive blocking causes customer loss
  • Focusing only on bandwidth, not application logic
  • No legal documentation during incident, hindering prosecution
  • Relying solely on cloud provider protection without own measures
  • Too tight thresholds lead to frequent false positives
  • Ignoring low-and-slow attacks by focusing on volume
Network engineering and BGP fundamentalsSecurity operations and incident responseConfiguration of CDNs, WAFs and load balancers
Availability and SLAsScalability of network and edge capacityCost control and operational effort
  • • Limited budget and personnel resources
  • • Dependence on ISP/CDN support
  • • Legal frameworks and reporting obligations