DDoS attack

In a distributed denial-of-service attack, large numbers of compromised machines, hijacked IoT devices or rented attack services send requests to a target at the same time until its bandwidth, connection tables or application resources are exhausted. Technically, three families are distinguished: volumetric attacks that flood the uplink and frequently exploit reflection and amplification via open DNS, NTP or Memcached services; protocol attacks such as SYN floods that fill the state tables of firewalls and load balancers; and application-layer attacks such as HTTP floods or Slowloris, which trigger expensive database and rendering operations with comparatively little traffic. Because the traffic originates from many sources that look partly legitimate, blocking individual IP addresses is not an effective defence. Ransom DDoS campaigns, in which a short demonstration attack is paired with an extortion demand, are common, as is the use of DDoS as a smokescreen for intrusion attempts running in parallel.

From a regulatory perspective, a DDoS attack is the textbook attack on the protection goal of availability. Article 21(2) of the NIS2 Directive (EU) 2022/2555 explicitly requires essential and important entities to implement measures for business continuity, backup management, network security and attack detection. Germany implements the directive through the NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG); entities in scope should verify the current status of its deadlines and registration duties rather than rely on earlier timelines. For significant incidents, Article 23 NIS2 sets out a staged reporting process: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month. In addition, ISO/IEC 27001 covers capacity management, network security and ICT readiness for business continuity through its Annex A controls, and the German BSI IT-Grundschutz modules on network architecture address overload protection. Under German criminal law, DDoS attacks regularly constitute computer sabotage pursuant to section 303b of the Criminal Code (StGB).

Effective protection is layered. At network level, spare capacity, anycast distribution and content delivery networks disperse load geographically, while upstream filtering at the provider is essential because a saturated uplink can no longer be relieved inside the own data centre. For larger attacks, traffic is diverted via BGP or DNS to a scrubbing centre that separates attack traffic from genuine traffic and returns the cleaned stream through a tunnel. At application level, rate limiting, SYN cookies, web application firewalls, bot management and caching of static content take effect. Blackholing, which discards all traffic destined for a target IP address, is only a last resort because it takes the target offline itself. Organisationally, this requires a rehearsed incident plan with an escalation path to the provider, contractually agreed activation and response times with the mitigation provider, monitoring with defined alert thresholds, and clear ownership of communication and reporting duties. Paying ransom in ransom-DDoS cases is discouraged by the BSI and law enforcement, since it funds further attacks and offers no guarantee of relief.