Attack on availability (DDoS)

Attack on the availability of websites or other internet services. These services are overloaded by a large number of requests.

A DDoS (distributed denial of service) is a type of attack on computer systems with the aim of making them unavailable. The volume of data often reaches several hundred Gbit/s. Generally, a single organisation cannot cope with volumes of this size without external assistance. Firewalls and IPS (intrusion prevention systems) that have been configured accordingly offer only limited assistance.

Specific measures

Contact your internet service provider. This has the best means of intervening.
Analyse the attack and establish a defence strategy: when facing a DDoS attack, the main aim is to show the attackers that they have not achieved their objective. If you withstand the attempt long enough, the attackers will typically turn their attention to someone else.
Check whether any extortion messages are sent to your publicly known email addresses. Do not under any circumstances pay the ransom. Check the possibility of partially isolating your network from the internet in order to maintain minimal operation.
Record the attack (netflows, server logs, email correspondence with the blackmailers, etc.). These are important for subsequent analysis and for filing any criminal charges.
File a criminal complaint with the cantonal police responsible for your company's/your authority's place of domicile.

Preventive measures

Clarify in advance with your internet service provider what DDoS defence options you have.
Define processes that can be activated in the event of an attack. This applies in particular for companies/organisations that are absolutely dependent on your website. These should be written down in a manual so that all those responsible have access to them at all times.
Identify business-critical IT applications that generate a large proportion of turnover (e.g. webshops). Protect these IT applications from possible DDoS attacks.
Ask your internet service provider whether and what kind of assistance they offer in the event of a DDoS attack. Internet service providers usually offer additional measures to counter DDoS attacks. You can have these activated in the event of an attack being announced.

Effects and risks

Failure of the website or all services that communicate with the internet
Loss of reputation
Financial loss, especially if a company/organisation is dependent on an internet platform

Further Information

You will find further information on our website:
Company: DDoS attack - what next?
Authority: DDoS attack - what next?