DDoS Defence: What to Prepare For

A denial-of-service attack steals no data; it makes you unreachable. Many therefore treat it as lower priority, yet for a webshop or a customer portal downtime is direct revenue loss, and it increasingly comes paired with extortion.

Three types

Volumetric. Saturating bandwidth with sheer traffic volume. The most common type, and one you cannot defend against on your own infrastructure: by the time traffic arrives it is too late. Only the provider or a specialist service can filter it.

Protocol-based. Exhausting state tables rather than bandwidth: half-open connections, fragmented packets. Firewall or load balancer capacity runs out.

Application-layer. Low traffic loading an expensive operation: search, report generation, login. Hard to distinguish from genuine traffic, because it consists of technically valid requests.

What your provider handles

This is the first question to settle, and most organisations do not know the answer.

• Is there any DDoS filtering in the provider contract?
• Does it engage automatically, or must it be requested?
• Up to what traffic volume does it protect?
• What is the response time, and is there 24-hour availability?

If any answer is uncertain, mid-attack is a poor time to find out.

What you must solve yourself

Application-layer rate limiting. Rate limits per user and per IP on expensive operations (search, export, login). This is the only defence against application-layer attacks.

Caching. Whatever is static should not be served by the application. A well-configured CDN also absorbs a significant share of volumetric attacks.

Resource limits. Connection counts, request sizes, timeouts. Without them a single slow client can tie up resources.

Autoscaling, where available. In cloud environments scaling absorbs the peak, but take care: the attacker then inflates your bill if there is no ceiling.

What to prepare in advance

Contact list. Who to call at the provider, on which channel, with what contract number. On paper too.

Decision points. When filtering is engaged, when functionality is restricted, when customers are informed.

A static fallback page. If the application cannot cope, a simple cached page that informs beats an error message.

Communication template. What is said to customers, and where. If your own site is unreachable, another channel is needed.

What not to do

Do not block IP ranges blindly. Mid-attack it is easy to accidentally exclude genuine customers, and hard to notice afterwards.

Do not assume the firewall solves it. In a volumetric attack the firewall is the bottleneck, not the defence.

Do not skip rehearsal. A DDoS plan is still a plan: if never walked through, gaps emerge mid-attack. We covered this in our first 24 hours article.

Our IT security services include reviewing availability architecture.