Denial of Service Attack: Definition, Examples, and Prevention

What Are Denial of Service Attacks?

A denial-of-service (DoS) attack is a tactic for overloading a machine or network to make it unavailable. Attackers achieve this by sending more traffic than the target can handle, causing it to fail—making it unable to provide service to its normal users. Examples of targets might include email, online banking, websites, or any other service relying on a targeted network or computer.

There are different types of DoS attacks such as resource exhaustion and flood attacks. Resource exhaustion attacks cause the targeted infrastructure to use all of its available memory or storage resources, slowing the service's performance or stopping it all together. Flood attacks send an overwhelming number of packets that exceed server capacity.

A distributed denial-of-service (DDoS) is a type of DoS attack where the traffic used to overwhelm the target is coming from many distributed sources. This method means the attack can't be stopped just by blocking the source of traffic.

Botnets are often employed for DDoS attacks.

Protection Against Denial of Service Attacks

While DoS attacks are less challenging to stop or prevent, DDoS attacks can still present a serious threat.

Prevent spoofing: Check that traffic has a source address consistent with the set of addresses for its stated site of origin and use filters to stop dial-up connections from spoofing.

Limit broadcasting: Often attacks will send requests to every device on the network, amplifying the attack. Limiting or turning off broadcast forwarding where possible can disrupt attacks. Users can also disable echo and chargen services where possible.

Streamline incident response: Honing your incident response can help your security team respond quickly when DoS attacks are detected.

Protect endpoints: Ensure that all endpoints are patched to eliminate known vulnerabilities. Endpoints capable of running EDR agents should have them installed.

Dial in firewalls: Ensure your firewalls are limiting ingress and egress traffic across the perimeter wherever possible.

Monitor the network: The more you know about what normal inbound traffic looks like, the quicker you'll spot the start of a DDoS attack. Real-time visibility with network detection and response (NDR) is an efficient and reliable way to maintain a profile of what your network should look like (using machine learning) so you can detect suspicious surges immediately.

Denial of Service History