1. Introduction

DDoS protection for businesses is usually treated as a “bandwidth problem”, and that simplification is why so many websites go down every year. A distributed denial-of-service attack is not a network problem: it is a design, provider and response problem. Meanwhile, the numbers keep growing: Cloudflare mitigated 21.3 million DDoS attacks in 2024, 53% more than the previous year, and the historic record was set on Halloween 2024 with 5.6 Tbps generated by around 13,000 Mirai IoT devices.

In this article we cover DDoS protection for businesses from start to finish following the denial-of-service chapter of the author’s book “Protocolos y procedimientos prácticos de ciberseguridad” (Confemetal, 2026): OSI-layer vectors, amplification, who attacks you, ransom DDoS, cloud mitigation with WAF and bot management, and the response runbook including NIS2 notification obligations.

The goal is that your company knows whether it needs protection, where to put it before the attack happens and what to do during the first hours of downtime.

2. What a DDoS Is and Why Filtering IP by IP Is a Lost Battle

The difference between DoS and DDoS is a matter of scale. In a DoS, a single source saturates the service and blocking its IP is enough. In a DDoS, thousands of compromised devices — a botnet — hit at the same time; filtering IP by IP against a botnet means losing the battle before it starts. The book’s analogy is precise: it is the difference between one person and 50,000 people trying to get through the same revolving door.

The origin of modern botnets is well documented: Mirai, whose code was published in September 2016, turned cameras, DVRs and routers with default credentials (admin/admin, no updates, open UPnP) into an army of devices; its records were 1.1 Tbps against OVH and around 1.2 Tbps against Dyn DNS, which took down Twitter, GitHub, Spotify and Netflix. Its variants — Mozi, Meris, RapperBot, Aisuru — remain active. The result is a cheap, always-available and hard-to-shut-down attack resource.

3. The Attack Vectors: Every OSI Layer Has Its Method

An attack is not “an attack”: the book classifies vectors by the network layer they exploit, and the defense changes depending on the layer. The table summarizes the map:

Layer	Attack type	Examples
L3-L4 volumetric	Saturate the link and the stack	UDP flood, ICMP flood, SYN flood
Amplification/reflection	Multiply traffic using third parties	DNS, NTP, Memcached (up to 51,000x), SSDP, CLDAP
Protocol	Exploit protocol flaws	Smurf, Ping of Death, Teardrop
L7 application	Exhaust application resources	GET/POST flood with bots, Slowloris, Slow POST
L7 logical	Abuse expensive endpoints	Reports, exports, searches, basket recalculation

Fig. 1 – DDoS vector classification by OSI layer according to chapter 5 of “Protocolos y procedimientos prácticos de ciberseguridad”.

Application attacks deserve double attention because they do not need high volumes: a few dozen requests to an expensive endpoint (a report generator, a heavy search) can bring down a service with barely 1 Gbps. It is the most neglected defense line because it requires working on code, not just on bandwidth.

4. Amplification: The Cybercriminal’s Multiplier

Amplification is the trick that turns a few servers into an avalanche: the attacker sends a small request with a spoofed source address to a server that responds with far more traffic than it received. The book’s extreme cases: Memcached reaches amplification factors of up to 51,000 times, while NTP and DNS sit at lower but equally devastating orders. With a few thousand devices and amplifiable protocols, the record-breaking Tbps are within reach.

Passive defense is simple and almost free: disable amplifiable services in your own infrastructure, keep DNS servers with rate limiting and never expose open Memcached, NTP or SSDP to the internet. Every amplifiable service that does not exist is no longer a multiplier for anyone; that is why DNS hardening (with providers such as Cloudflare DNS, AWS Route 53 or Azure DNS) is part of any serious plan.

5. Who Attacks You and Why?

Knowing who is knocking on your door shapes the defense. The book distributes motivations with data: around 40% of attacks come from competitors (very common in online gaming, betting, ecommerce on dates such as Black Friday and crypto), 17% from state actors (groups such as NoName057(16), Killnet or Anonymous Sudan) and about another 17% from disgruntled individuals who hire booter or stresser services for a few euros. The rest is completed by hacktivists and, increasingly, extortionists.

That last group is the fastest growing during commercial seasons: ransom DDoS. The group sends a note demanding payment to avoid interrupting the service, sometimes with a demonstration attack of a few minutes. The book’s recommendation is blunt: do not pay. Paying guarantees nothing, finances criminals and marks the company as a payer in the groups’ informal records, guaranteeing future rounds. Absorb and ignore the demonstration attack, strengthen mitigation and report the extortion to the authorities.

6. Protection: Cloud Mitigation, WAF and Bot Management

The cornerstone of DDoS protection for businesses is cloud scrubbing mitigation: traffic is diverted to a cloud network that cleans it before forwarding it to the origin. Providers such as Cloudflare (anycast network with more than 500 Tbps of capacity and over 330 cities), AWS Shield Advanced, Akamai Prolexic, Azure DDoS, Imperva, Radware or F5 Distributed Cloud make the difference between absorbing an attack or falling. There are three deployment models: always-on (permanent proxy), on-demand (DNS or BGP diversion with a window of minutes) and hybrid, which is the most common in production. This is the protection tier that cannot be improvised: a DDoS protection for businesses that only relies on the ISP will always lose against a 5.6 Tbps wave.

DDoS protection does not end with network traffic: layer 7 requires a WAF with anti-DDoS features (rate limiting, JavaScript challenges, CAPTCHA, geoblocking and ASN filtering) and bot management with TLS/HTTP fingerprinting and ASN reputation. Products such as Cloudflare WAF, AWS WAF, Imperva or F5, and bot management tools such as Cloudflare Bot Management, Akamai Bot Manager, DataDome or HUMAN, are part of the same solution. Do not forget your own hardening: hide the origin IP (provider ACLs or tunnels such as Argo Tunnel), over-provision links and disable amplifiable protocols in the TCP stack (SYN cookies) — low-cost, high-impact measures.

An example of preparation checks:

# Basic DDoS readiness checks
# 1. Is your DNS behind a provider with mitigation?
dig +short www.yourdomain.com | head
# 2. Are there exposed amplifiable services?
nmap -sU -p 161,1900,11211,123 --script broadcast-* origin.example
# 3. Does the origin only accept traffic from the mitigation proxy?
iptables -A INPUT -p tcp --dport 443 -s PROXY_RANGE -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

Fig. 2 – Preparation commands for a DDoS mitigation plan, inspired by chapter 5 of the book.

Finally, defensive application design: expensive endpoints with authentication and rate limiting, pagination on heavy queries and circuit breakers to offload saturable services. Fixing those three points removes the appeal of the layer 7 logical attack, which crosses companies with good network mitigation but fragile code more easily than any other. Together with the WAF and bot management above, they complete the application half of any DDoS protection for businesses.

7. What to Do During the Attack

Response starts before the attack: a documented and rehearsed runbook. Triage answers three questions: is it a DDoS or an internal problem? Which layer is being attacked? Which services are affected? Once decided, active mitigation follows an order: divert traffic to scrubbing, apply aggressive rate limiting — the book’s operative question is “degraded service for everyone or down for everyone?” —, mass challenges, temporary geoblocking and upstream filtering with the ISP using BGP FlowSpec or blackhole. A crisis committee with communication and business owners closes the circle, because a downed website is also a reputation problem.

# Initial triage of a DDoS incident
1. DDoS or internal? -> Check CPU, disk and processes at the origin
2. Which layer?      -> Analyze protocol and destination of inbound traffic
3. Which services?   -> List impact: web, API, email, DNS

Fig. 3 – The three questions of DDoS incident triage according to chapter 5 of the book.

Legal obligations complete the response: the NIS2 directive requires notifying the CSIRT within 24 hours, with the full report within 72 hours, when the outage affects essential services. Filing a police report with the attack logs is usually the first documentary step.

8. After the Attack: Measure, Review and Practice

Once the incident is over, the post-mortem per NIST SP 800-61 must answer with metrics: time to full absorption, volume directed at the origin and affected endpoints. Review the mitigation provider’s contract (included coverage and extraordinary charges — an unexpected invoice after a massive attack is a classic) and reinforce the application if the attack was layer 7. Finally, practice: legitimate load testing with Locust, k6 or JMeter, and DDoS simulations with your provider under an authorized contract, so the runbook becomes a reflex instead of a document. You can see how a good SIEM helps detect these and other incidents early in our article on building a SOC on a SIEM, and how to plan technical audits and planned tests to validate your DDoS protection.

9. Conclusion

DDoS protection for businesses is no longer an option for large corporations only: with 21.3 million attacks mitigated in 2024 alone and records of 5.6 Tbps, any business with online sales, APIs or a reputation to protect is a target. The book’s formula is clear and within reach of a medium budget: cloud mitigation with scrubbing, WAF and bot management for layer 7, hardening of your own DNS and amplifiable protocols, defensive application design and a rehearsed runbook with NIS2 notification included. Those who prepare those four pieces before the attack will not fall; those who improvise during it probably will.

Need help with DDoS protection for businesses?

At Jaymon Security, we help organizations protect their systems. From security audits to SIEM/SOC implementation, our expert team designs custom solutions.

Contact us for a free infrastructure assessment.