DDoS Attack: What It Is and How to Defend Your Business

A DDoS attack (Distributed Denial of Service) floods a server, website or business connection with traffic from thousands of compromised devices until it becomes unreachable. It doesn't steal data: it takes your services offline. Effective defence combines upstream protection beyond your own line, redundant architecture, perimeter filtering and a response plan written before the attack ever starts.

What a DDoS attack is, in plain language

Picture your company switchboard receiving ten thousand calls a minute, every one of them silent. Genuine customers can no longer get through — not because the switchboard is broken, but because it's saturated. A DDoS attack does exactly that to your digital infrastructure: your website, your e-commerce platform, your staff VPN, your email, any business system exposed to the internet.

The difference from a plain DoS attack sits in the first letter: Distributed. The malicious traffic doesn't come from a single computer, which would be easy to block, but from a botnet — a network of thousands (sometimes millions) of devices infected without their owners' knowledge. Home PCs, IP cameras, routers, networked printers: any poorly protected connected device can be conscripted as an unwitting foot soldier.

It's a point we make clear to clients from day one: a DDoS is not a break-in. The attacker doesn't get inside your systems and doesn't encrypt your files — that's what ransomware is for, and we cover it in detail in our guide to protecting your business from ransomware. A DDoS puts you out of service. The damage is the downtime: lost orders, halted production, remote workers cut off, and a reputation that takes a knock every hour you're offline.

The three families of DDoS attack

Not all DDoS attacks are alike, and the countermeasures change depending on which layer is hit.

Volumetric attacks

The most common and the "loudest": they saturate your connection's bandwidth with enormous volumes of junk traffic, often amplified by exploiting misconfigured DNS or NTP servers scattered around the world (so-called reflection/amplification attacks). They're measured in gigabits per second — attacks recorded in recent years routinely exceed a terabit. No business connection, however generous, can absorb that on its own.

Protocol attacks

These target the network resources of servers, firewalls and load balancers by abusing how protocols work. The classic example is the SYN flood: the attacker opens millions of TCP connections and never completes them, filling the state tables of your equipment until they're exhausted. Your bandwidth may remain perfectly free — it's the devices handling the connections that collapse.

Application-layer attacks (Layer 7)

The most insidious. They mimic legitimate requests — web pages, searches, logins, API calls — at a pace the application server can't sustain. They need far lower volumes, they're hard to tell apart from genuine traffic, and they often target the most "expensive" pages to generate, such as the internal search engine of an e-commerce site. These are the attacks we see growing fastest against SMEs.

Why an SME is a target too

"Who on earth would attack us?" is the question we hear most often — and it's the flawed assumption behind the worst outages. In more than 25 years working with businesses across the Milan area, we've seen DDoS attacks arrive for very concrete reasons:

• Extortion (RDDoS): an email demands a cryptocurrency ransom to keep your site online, often preceded by a demonstration attack lasting a few minutes. The cost of launching an attack is now trivial — "DDoS-for-hire" services rent out for a few tens of euros.
• Unfair competition: an e-commerce site that's unreachable over the Black Friday weekend hands its customers to someone else.
• A diversion: while your IT team is focused on the website that won't respond, the attacker attempts a genuine intrusion on another front.
• Collateral damage: your site sits on the same server or network as the real target, and goes down with it.

Then there's the regulatory picture: for companies within the scope of the NIS2 directive, service continuity and incident management are no longer optional best practice but legal obligations, with accountability resting on management. If you're not sure whether your company is affected, start with our overview of what NIS2 changes for SMEs.

How to recognise a DDoS attack in progress

The symptoms look like an ordinary fault — which is exactly why many companies waste precious hours rebooting perfectly healthy equipment. The typical signs:

• your website or exposed services become extremely slow or unreachable, while the internal network works fine;
• inbound internet bandwidth is saturated with no operational reason;
• the firewall or load balancer shows an abnormal number of half-open connections;
• web server logs record spikes of requests from thousands of different IPs, often with repetitive patterns;
• your connectivity provider contacts you to flag anomalous traffic towards your addresses.

The real differentiator is monitoring: a business with a baseline of its normal traffic spots the anomaly in minutes; one without is left guessing. It's one of the reasons network telemetry is never an optional extra in our managed service contracts.

How to defend against a DDoS attack: countermeasures that work

Effective defence is built before the attack, and it works on several layers at once. No single measure is enough on its own.

1. Protection upstream of your connection

Against volumetric attacks, the only realistic defence sits outside your perimeter, where bandwidth is still available. The practical options for an SME:

• CDN and reverse proxy services with DDoS protection (Cloudflare and similar) in front of websites and portals: they absorb malicious traffic across their distributed network and let only clean traffic through;
• mitigation services from your connectivity provider, which can divert traffic to scrubbing centres or apply filters on the backbone;
• for critical services, consider hosting on cloud infrastructure with native mitigation built in.

One detail that's routinely overlooked: if you put a CDN in front of your site but leave the server's real IP exposed — in historical DNS records, in your mail setup, in a forgotten subdomain — the attacker will find it and hit you directly. Protection needs to be designed, not just switched on.

2. A properly configured perimeter and internal network

A firewall won't stop a volumetric attack of hundreds of gigabits, but it makes a real difference against protocol and application-layer attacks: SYN flood protection, per-IP connection limits, geo-blocking where it makes sense, rate limiting on exposed applications. Business-class appliances offer all of these functions — yet we almost always find them disabled or left at factory defaults. On choosing and sizing the right appliance, see our guide to choosing a business firewall.

The coin has a flip side too: unpatched IoT devices, cameras and appliances on your network can be recruited into a botnet, making your company an unwitting accomplice in attacks on others. Segmentation and patching matter for that reason as well.

3. An architecture that doesn't fold at the first blow

Redundancy and decoupling reduce the impact: DNS with a robust provider separate from your hosting, critical services spread across multiple resources, the ability to scale quickly, and clear separation between your public website and your production systems. If the e-commerce site goes down, the ERP and email must keep working — and vice versa.

4. A response plan written before the attack

There's no time to improvise during a DDoS. The plan must answer simple questions: who do you call (provider, IT partner, and where appropriate the police cybercrime unit)? Who is authorised to activate mitigation? How do you communicate with customers and staff if the website and email are down? How do you tell a DDoS from a diversion, and who watches the other fronts in the meantime? Above all: you don't pay the ransom. Whoever pays marks themselves out as a paying target.

These four layers don't live in isolation: they belong inside an overall security strategy — perimeter, monitoring, incident response — of the kind we design in our cyber security services for business.

What a DDoS attack costs an SME (and what defence costs)

The downtime bill adds up quickly: hours of lost revenue on digital channels, unproductive staff, contractual penalties, customers who bought elsewhere in the meantime. For a mid-sized e-commerce operation, even a few hours of blackout in a peak period can cost more than a full year of protection.

Defence, by contrast, is now genuinely affordable: entry-level CDN plans with DDoS protection start at modest cost (there are even free tiers adequate for many brochure sites), correct perimeter configuration is part of normal IT management, and the response plan is mostly a matter of method. The gap between the cost of prevention and the cost of downtime is so wide that, frankly, not defending yourself isn't an economic decision — it's a gamble.

Protect your business continuity

You can't fight a DDoS attack once your services are already down: you prepare beforehand, with a properly configured perimeter, upstream protection and a tested response plan. It's the work we've been doing for SMEs for over 25 years: TN Solutions is an ISO 9001 and ISO 27001 certified system integrator based in Melzo, just outside Milan, with a 4.7 Google rating across 37 reviews.

Want to know how exposed your infrastructure really is? Call us on 02 9517550 or get in touch through our contact page: we'll analyse your situation and propose a defence plan proportionate to your business — no scaremongering, no over-engineering.