Distributed Denial of Service (DDoS)
An attack that floods a website, service or network with traffic from many compromised sources to make it slow or unavailable.
Even short outages from a DDoS attack interrupt sales, lead capture and customer access, and attacks are sometimes used for extortion or as a distraction, so availability protection belongs in hosting and vendor decisions.
An ecommerce site moves DNS to a CDN with always-on DDoS mitigation, hides its origin IP, accepts origin traffic only from the CDN's IP ranges, and challenges clients that exceed 100 checkout requests per minute.
Mitigation switched on only after an attack starts can leave minutes of downtime. Separating attack traffic from real spikes, such as a campaign launch, is difficult, and on-premise defenses cannot absorb volumes larger than upstream bandwidth.
Attackers direct botnets of infected computers and IoT devices at a target. Volumetric attacks saturate bandwidth, often through amplification; protocol attacks exhaust server, firewall or load balancer resources at layers 3 and 4; and application-layer attacks send costly HTTP requests. Defenses include anycast distribution across a Content Delivery Network (CDN), rate limiting, Web Application Firewall (WAF) rules and blackhole routing, supported by a tested response plan.
Systems Architecture
Cloudflare — What is a DDoS attack? — https://www.cloudflare.com/learning/ddos/what-is-a-ddos-attack/; NCSC — Denial of Service (DoS) guidance — https://www.ncsc.gov.uk/collection/denial-service-dos-guidance-collection