How to protect your business from DDoS attacks: a practical guide

A distributed denial-of-service (DDoS) attack tries to knock a website, application or network offline by flooding it with more traffic than it can handle. Attacks are cheap to launch — they can be rented by the hour — and they hit companies of every size, from online stores to banks, media and government sites. The good news: with the right layers in place, most attacks pass unnoticed by your customers.

The three main types of DDoS attack

• Volumetric attacks saturate your internet link with sheer volume (UDP floods, amplification through DNS, NTP or memcached). They are measured in gigabits per second and must be stopped before they reach your connection.
• Protocol attacks exhaust the resources of firewalls, load balancers and servers (SYN floods, fragmented packets). They are measured in packets per second.
• Application-layer (layer 7) attacks imitate real users, sending requests to expensive pages such as search, login or checkout. They are small in volume but hard to tell apart from legitimate traffic.

Warning signs

• A website or service that becomes very slow or unreachable for no obvious reason.
• A sudden spike of traffic from one network, country or type of device.
• Your internet link at 100 % while internal users can barely work.
• Servers with high CPU on a single page or API endpoint.
• An extortion email demanding payment to "stop" an attack. Don't pay — it rarely stops anything.

A layered defence

1. Upstream network mitigation

Volumetric attacks can't be stopped by equipment in your own office or rack: by then the link is already full. You need mitigation at the provider's network, where malicious traffic is detected and scrubbed before it reaches you, and clean traffic is passed through. Look at the mitigation capacity offered and how quickly it activates. Our DDoS protection plans range from 10 Gbps to multi-terabit upstream capacity.

2. A next-generation firewall

A properly sized firewall blocks protocol attacks, limits connections per source and protects everything behind it. It also gives you the visibility to see what is happening. A managed firewall takes the configuration and updates off your plate.

3. CDN and web application firewall

For websites and APIs, a CDN with a web application firewall (WAF) absorbs layer-7 attacks close to the attacker, caches content and challenges suspicious visitors. Cloudflare, set up and managed properly, is one of the most effective tools here.

4. Architecture and capacity

• Don't expose servers' real IP addresses when they sit behind a CDN.
• Rate-limit login, search and checkout.
• Keep spare capacity, and know how fast you can add more.
• Separate critical services so one attacked site doesn't take everything down.

5. A response plan

Write down who to call, which provider contacts to use, and which services matter most. Test it once a year. During an attack, minutes matter.

What to do if you are under attack right now

1. Call your connectivity or hosting provider immediately and say it is a suspected DDoS.
2. Note the affected IP addresses, domains and the time the problem started.
3. Don't keep restarting servers — it rarely helps and you lose evidence.
4. Communicate with your customers through a channel that isn't affected.
5. After the attack, review what worked and close the gaps.

If you are not a Navégalo customer and need help now, go to our Under attack page or call us. Our team can start mitigating the same day.