The growing threat of DDoS attacks for SMEs and mid-market companies in 2023

Prevalence and frequency of DDoS attacks

In 2023, around 34% of companies reported having suffered at least one DDoS attack, an increase on the previous year. Victims suffered three attacks a year on average, which underlines the need to prepare for several incidents.

Impact on SMEs and mid-market companies

SMEs and mid-market companies are particularly vulnerable to DDoS attacks because of their limited resources for robust defences. Nearly 40% of ransomware attacks target these companies, often exploiting their less secure systems.

Consequences of attacks

DDoS attacks can lead to:

Risk of bankruptcy: one company in two risks insolvency within six months of a major cyberattack.

Service unavailability: disruption of online services, loss of revenue and of customers.

Financial loss: every minute of downtime can be costly.

Damage to reputation: a successful attack can harm a company’s reputation.

Understanding DDoS attacks

DDoS attacks overwhelm a target with malicious traffic, making services unavailable to legitimate users. They can be compared to a flood of fake orders in a restaurant, monopolising resources and preventing real customers from being served.

Types of DDoS attacks

Application-layer attacks: target specific vulnerabilities in web applications.

• HTTP flood: overwhelm a server with HTTP GET or POST requests.
• Slowloris: open many HTTP connections and keep them open, which prevents new connections from being created.

Protocol attacks: exploit weaknesses in communication protocols.

• SYN flood: sending SYN packets without completing the connection.
• Smurf attacks: use ICMP packets to overwhelm a target by spoofing its IP address and sending requests to every computer on the network, which then respond en masse to the target machine.

DNS amplification/reflection attacks: use open DNS servers to create a massive flow of DNS responses towards the target.

Volumetric attacks: overwhelm a target with massive traffic, consuming all the available bandwidth.

Objectives of DDoS attacks

DDoS attacks aim to slow down or block legitimate traffic.

Motivations include:

Cyberwarfare: harming the critical infrastructure of an enemy state.

Entertainment: causing disruption for fun.

Extortion: demanding a ransom to stop the attack.

Commercial competition: disrupting a competitor.

Hacktivism: protesting against a company or an organisation.

Protection measures

SMEs and mid-market companies must adopt proactive cybersecurity measures:

DDoS detection and mitigation solutions:

• Cloud-based DDoS protection services: absorb and disperse malicious traffic.
• Firewalls and intrusion prevention systems (IPS): detect and block attack attempts.
• Real-time monitoring: provides instant alerts when suspicious traffic is detected.

Incident response plan:

• Emergency procedures: define the steps to follow in the event of an attack.
• Communication: inform employees and partners.
• Simulations and training: run regular exercises to prepare people to react quickly and effectively.

Optimising the network infrastructure:

• Redundancy and load balancing: use load-balancing tools and redundant servers.
• Improving network capacity: increase bandwidth and processing capacity.
• Use of CDNs (Content Delivery Networks): disperse traffic to reduce the load on the main servers.

Key takeaways

DDoS attacks represent a serious and growing threat for SMEs and mid-market companies. By adopting adequate protection measures, these companies can better prepare to withstand cyberattacks and minimise their impact, thereby ensuring their longevity and resilience in the face of digital threats.