Cyber Security Denial of Service

A Denial-of-Service attack overwhelms a system so real users cannot use it, and understanding the difference between DoS and DDoS is essential to defending against both.

What Is a Denial-of-Service Attack?

A Denial-of-Service (DoS) attack aims to make a system, network, or service unavailable to the legitimate users who depend on it — directly attacking the Availability pillar of the CIA Triad. Rather than stealing or altering data, the attacker simply overwhelms a target with more requests, traffic, or malformed data than it can handle, or exploits a flaw that causes it to crash or hang.

DoS vs. DDoS

The key difference is the number of sources the attack comes from. A DoS attack originates from a single machine or connection, which makes it comparatively easy to block — the defender can simply drop traffic from that one IP address. A Distributed Denial-of-Service (DDoS) attack instead comes from many machines at once, often thousands of compromised devices (a 'botnet') spread across different networks and countries, all directed at the same target simultaneously. Because the traffic arrives from so many different, often legitimate-looking sources, blocking a DDoS attack by IP address alone doesn't work.

Aspect	DoS	DDoS
Number of sources	One	Many (often thousands)
Ease of blocking	Relatively easy — block the single source	Difficult — sources are numerous and distributed
Typical scale	Limited by one machine's bandwidth	Can be massive, limited only by the size of the botnet
Common tooling	A single script or flooding tool	A botnet of compromised devices, sometimes rented as a service

Common Attack Techniques

Volumetric attacks: flood the network link itself with sheer traffic volume until legitimate traffic can't get through.
Protocol attacks (e.g., SYN floods): abuse the mechanics of network protocols to exhaust server or firewall resources rather than bandwidth.
Application-layer attacks (e.g., HTTP floods): send large numbers of seemingly normal requests to a specific application feature, such as a search or login page, to exhaust server processing capacity.

Impact on Organizations

Downtime translates directly into lost revenue for anything customer-facing, along with support costs, reputational damage, and lost trust. DoS and DDoS attacks are also sometimes used as a smokescreen — keeping a security team busy responding to the outage while a separate, quieter attack (such as data exfiltration) happens elsewhere in the network.

Defending Against DoS and DDoS

Rate limiting and traffic filtering at the network edge to cap how much any single source can send.
Content delivery networks (CDNs) and traffic-scrubbing services that absorb and filter large volumes of traffic before it reaches the origin server.
Redundancy and load balancing across multiple servers and data centers so no single point of failure can take the whole service down.
Upstream DDoS protection from an ISP or cloud provider, which can handle volumetric attacks far larger than an organization could absorb on its own.
An incident response plan specifically for availability incidents, since the right first move during a real attack is rarely to improvise.

Note: Not every traffic spike is an attack. A sudden, legitimate surge in visitors — like a flash sale or a viral social media post — can look similar to the early stages of a DDoS attack. Distinguishing an attack from a popularity spike usually comes down to looking at request patterns: attack traffic tends to hit the same narrow set of endpoints repeatedly from unusual or geographically implausible sources, while legitimate spikes spread more naturally across normal usage patterns.

Keep Going

Cyber Security Interview QuestionsPractice real questions asked for Cyber Security Cybersecurity Analyst SalarySee what Cybersecurity Analyst roles pay in the market Auto Apply for JobsApply to open roles related to Cyber Security and tweak your resume