SECURITY

Home › Glossary › Security· 128 ·

DDoS Protection

dee-doss pro-tek-shunnoun

Filed underSecurityInfrastructure

In brief · quick answer

Distributed Denial-of-Service (DDoS) protection is a set of techniques and services that defend against attacks attempting to overwhelm a website or server with traffic, making it unavailable to legitimate users.

§ 1 Definition

A DDoS (Distributed Denial-of-Service) attack floods a target with traffic from multiple sources (often a botnet of compromised devices), consuming server resources, bandwidth, or application capacity to the point where legitimate users cannot access the service. DDoS protection encompasses mitigation strategies at multiple layers: network-level (filtering malicious IPs, rate limiting), application-level (WAF, rate limiting, CAPTCHA), and infrastructure-level (traffic scrubbing centers, content delivery networks, auto-scaling). Attacks are measured in bits per second (volumetric), packets per second, or requests per second (application layer).

§ 2 Types of DDoS Attacks

Volumetric attacks: Overwhelm bandwidth. UDP floods, ICMP floods, DNS amplification, NTP amplification. Measured in Gbps/Tbps. Protocol attacks: Exhaust server resources, firewalls, load balancers. SYN floods, fragmented packet attacks. Measured in packets per second (Mpps). Application-layer attacks: Target specific application vulnerabilities or resources. HTTP floods, Slowloris, API abuse. Measured in requests per second (RPS). These are the hardest to detect because they mimic legitimate traffic patterns.

§ 3 Protection Strategies

Traffic scrubbing: All traffic is routed through a scrubbing center that filters out malicious traffic before forwarding clean traffic to the origin. Cloudflare, AWS Shield, Akamai, and Google Cloud Armor offer this. CDN-based protection: A content delivery network absorbs traffic at edge locations, distributing load and filtering at the network edge. Rate limiting: Limit requests per IP to prevent any single source from overwhelming the server. Auto-scaling: Scale infrastructure horizontally during attack events to absorb more traffic. Anycast networking: Distribute traffic across multiple data centers using the same IP address, diluting attack impact.

§ 4 Choosing a DDoS Protection Service

For small to medium businesses, Cloudflare (free tier includes basic DDoS protection) or AWS Shield Standard (free with CloudFront/Route 53) provides baseline protection. For larger organizations, Cloudflare Enterprise, AWS Shield Advanced, or Akamai Prolexic offer dedicated mitigation capacity, 24/7 support, and financial guarantees. Key considerations: always-on vs on-demand mitigation, mitigation capacity (Tbps), application-layer coverage, and cost. DDoS protection is not optional for any business that depends on its website for revenue.

§ 5 Note

DDoS attacks are increasingly common and sophisticated. The largest attacks exceed 2 Tbps. Even small attacks can take down an unprotected site. Cloudflare's free tier absorbs most common DDoS attacks and is a good starting point for most websites.

§ 6 Common questions

Q. Can DDoS protection prevent all attacks?: A. No large-scale, sophisticated attacks can overwhelm even well-protected infrastructure. But good protection makes it much harder and more expensive for attackers. Most common attacks are easily mitigated by cloud DDoS services.
Q. How much does DDoS protection cost?: A. From free (Cloudflare basic protection) to tens of thousands per month (enterprise dedicated mitigation). For most SMBs, a CDN-based service with DDoS protection included (Cloudflare, Fastly) is cost-effective.
Q. What is a DDoS attack in the application layer?: A. An application-layer DDoS (Layer 7) targets specific endpoints with high volumes of legitimate-looking HTTP requests. It is harder to detect than network-layer attacks because it mimics real user traffic. WAF and rate limiting are the primary defenses.

Key takeaways

DDoS attacks overwhelm servers with traffic from multiple sources.
Three types: volumetric, protocol, and application-layer (Layer 7).
CDN-based protection (Cloudflare, AWS Shield) is the standard defense.
DDoS protection is essential for any revenue-generating website.

How Atomic Glue helps

Atomic Glue configures DDoS protection for every client site using CDN-based services, rate limiting, and auto-scaling infrastructure. We recommend and implement appropriate protection tiers based on your risk profile. Trust & Security.

Get in touch

# DDoS Protection

Category: Security (also: Infrastructure)

Author: Atomic Glue Security Team

## Definition

## Types of DDoS Attacks

**Volumetric attacks**: Overwhelm bandwidth. UDP floods, ICMP floods, DNS amplification, NTP amplification. Measured in Gbps/Tbps. **Protocol attacks**: Exhaust server resources, firewalls, load balancers. SYN floods, fragmented packet attacks. Measured in packets per second (Mpps). **Application-layer attacks**: Target specific application vulnerabilities or resources. HTTP floods, Slowloris, API abuse. Measured in requests per second (RPS). These are the hardest to detect because they mimic legitimate traffic patterns.

## Protection Strategies

**Traffic scrubbing**: All traffic is routed through a scrubbing center that filters out malicious traffic before forwarding clean traffic to the origin. Cloudflare, AWS Shield, Akamai, and Google Cloud Armor offer this. **CDN-based protection**: A content delivery network absorbs traffic at edge locations, distributing load and filtering at the network edge. **Rate limiting**: Limit requests per IP to prevent any single source from overwhelming the server. **Auto-scaling**: Scale infrastructure horizontally during attack events to absorb more traffic. **Anycast networking**: Distribute traffic across multiple data centers using the same IP address, diluting attack impact.

## Choosing a DDoS Protection Service

For small to medium businesses, **Cloudflare** (free tier includes basic DDoS protection) or **AWS Shield Standard** (free with CloudFront/Route 53) provides baseline protection. For larger organizations, **Cloudflare Enterprise**, **AWS Shield Advanced**, or **Akamai Prolexic** offer dedicated mitigation capacity, 24/7 support, and financial guarantees. Key considerations: always-on vs on-demand mitigation, mitigation capacity (Tbps), application-layer coverage, and cost. DDoS protection is not optional for any business that depends on its website for revenue.

## Note

## Common questions

Q: Can DDoS protection prevent all attacks?

A: No large-scale, sophisticated attacks can overwhelm even well-protected infrastructure. But good protection makes it much harder and more expensive for attackers. Most common attacks are easily mitigated by cloud DDoS services.

Q: How much does DDoS protection cost?

A: From free (Cloudflare basic protection) to tens of thousands per month (enterprise dedicated mitigation). For most SMBs, a CDN-based service with DDoS protection included (Cloudflare, Fastly) is cost-effective.

Q: What is a DDoS attack in the application layer?

A: An application-layer DDoS (Layer 7) targets specific endpoints with high volumes of legitimate-looking HTTP requests. It is harder to detect than network-layer attacks because it mimics real user traffic. WAF and rate limiting are the primary defenses.

## Key takeaways

DDoS attacks overwhelm servers with traffic from multiple sources.
Three types: volumetric, protocol, and application-layer (Layer 7).
CDN-based protection (Cloudflare, AWS Shield) is the standard defense.
DDoS protection is essential for any revenue-generating website.

## Related entries

Last updated December 2024. Permalink: atomicglue.co/glossary/ddos-protection