Get All Access for $5/mo

What 'DDoS' Attacks Are and How to Survive Them Here's how to fight back when a flood of bogus internet traffic threatens to immobilize your website.

By Riva Richmond

Opinions expressed by Entrepreneur contributors are their own.

What DDoS Attacks Are and How to Survive Them
Illustration from Shutterstock.com

Never heard of a DDoS attack? Small companies that do business online ought to learn about this growing online threat -- and figure out how they'll respond should one ever hit them.

Consider what happened to Los Angeles-based business-planning publishing and advisory company Growthink. Last September, a surprise flood of bogus traffic knocked its website off the internet for several days. Growthink turned to its hosting firm for help, only to have its website sidelined so other sites wouldn't be collateral damage. It finally recovered by hiring a DDoS-protection firm, BlockDos, to filter out the bad traffic. Then it moved to a new hosting service, Rackspace, so it would be better prepared next time.

"It was pretty intense," says Kevin McGinn, Growthink's IT director. "We had no idea why we were being singled out."

Growthink had suffered a "distributed denial-of-service" attack. In a DDoS attack, legitimate site visitors are denied access by hackers who immobilize the site either with a flood of bogus internet traffic or a surgical strike that exhausts the resources of a specific web application. Successful attacks can cripple business operations. Growthink estimates its website outage erased $50,000 in revenue.

Related: Why You Might Need to Rethink Your Internet Security -- Now

As Growthink discovered, it isn't always clear who's out to get you. Experts say e-commerce outfits and other businesses that rely heavily on the web for their livelihoods are most at risk. Smaller companies are most often attacked by unscrupulous competitors and extortionists, although disgruntled former employees, vandals and "hacktivists," or hackers with a political agenda, are also known culprits.

With both the number and ferocity of attacks rising, DDoS incidents are a growing threat. In the last year, CloudFlare, a San Francisco cloud-based web performance and security firm, said it has seen a 700 percent rise in DDoS traffic.

Small companies are increasingly finding themselves in the crosshairs, experts say, as the cost of mounting attacks drops and large companies get better at stopping them. Attackers can rent "botnets" of 1,000 hijacked malware-infected home PCs capable of taking down sites of most small-to-medium-sized businesses for only $400 a week, according to Incapsula, a competitor to CloudFlare that's a subsidiary of security firm Imperva, both of Redwood Shores, Calif.

Even modest extortionists can profit. Australian e-commerce company Endless Wardrobe received an email in May demanding $3,500 via Western Union. When the firm didn't comply, its site was knocked offline for a week by a torrent of bogus visits. The downtime cut revenue by at least the amount of the demanded ransom.

Here are tips on how to survive if you find your business under a DDoS attack, too.

Related: How to Make Your Website Hacker-Proof

Find a hosting service or ISP that will help.
Many hosting services put large numbers of small websites on the same servers to boost efficiency. That's fine until one site is attacked and the hosting company takes it offline so other customers on the server aren't hurt as well.

Check your contracts and speak with your hosting service or internet service provider, or ISP, to find out what it will do if you come under attack. Will it help you stop the attack and recover, and if so, at what cost? Will it send you a giant bill because an attack generated a ton of extra traffic to your site?

A growing number of these service providers are offering security features, including DDoS protection, as a way to differentiate themselves in a crowded market. Such companies, which often employ technology from specialists such as Arbor Networks, include Firehost, Rackspace and iWeb.

Hire help.
Companies that provide website acceleration services also often help fend off DDoS attacks. For instance, CloudFlare provides a free basic level of DDoS protection that it says will stop most attacks, and two tiers of service at $20 and $200 a month that can stop larger attacks. Incapsula includes DDoS protection as part of its Enterprise tier of service for an undisclosed fee.

If you're targeted with a highly sophisticated attack, however, you may want to consider hiring a DDoS-protection specialist, such as Prolexic, a cloud-based security company based in Hollywood, Fla.

Investigate ways to fortify your site.
CloudFlare co-founder and CEO Matthew Prince suggests using nginx web server software -- favored by the likes of Netflix and WordPress -- because it can be more resistant to DDoS than other programs. He also recommends using the latest versions of your web software, such as WordPress and shopping carts, to prevent some application-based attacks.

Related: How to Determine If Cyber Insurance Coverage Is Right for You

Riva Richmond is a freelance journalist who has covered technology for more than a decade. She focuses on computer security, privacy, social networking and online business and has written for The New York Times, The Wall Street Journal and other national publications. Previously, Riva was a technology reporter at Dow Jones Newswires and regular contributor to The Journal's "Enterprise" small business column.

Want to be an Entrepreneur Leadership Network contributor? Apply now to join.

Editor's Pick

Starting a Business

I Left the Corporate World to Start a Chicken Coop Business — Here Are 3 Valuable Lessons I Learned Along the Way

Board meetings were traded for barnyards as a thriving new venture hatched.

Business News

'Passing By Wide Margins': Elon Musk Celebrates His 'Guaranteed Win' of the Highest Pay Package in U.S. Corporate History

Musk's Tesla pay package is almost 140 times higher than the annual pay of other high-performing CEOs.

Business News

Joey Chestnut Is Going From Nathan's to Netflix for a Competition 15 Years in the Making

Chestnut was banned from this year's Nathan's Hot Dog Eating Contest due to a "rival" contract. Now, he'll compete in a Netflix special instead.

Marketing

Are Your Business's Local Listings Accurate and Up-to-Date? Here Are the Consequences You Could Face If Not.

Why accurate local listings are crucial for business success — and how to avoid the pitfalls of outdated information.

Money & Finance

Day Traders Often Ignore This One Topic At Their Peril

Boring things — like taxes — can sometimes be highly profitable.

Growing a Business

He Immigrated to the U.S. and Got a Job at McDonald's — Then His Aversion to Being 'Too Comfortable' Led to a Fast-Growing Company That's Hard to Miss

Voyo Popovic launched his moving and storage company in 2018 — and he's been innovating in the industry ever since.