The largest ever distributed denial-of-service (DDoS) attack occurred in the spring of 2018. The attack lasted more than eight minutes and measured 1.3 Tbps, according to Threatpost.

But it’s a record no one in the security industry expects to last long, as DDoS attacks continue to increase in length, strength and damage.

This type of cyberattack could cost your company an average of $50,000 per attack in lost business revenue, according to an April 2018 Coreo study. This amount is considerably less than a February 2018 report, which found that a DDoS attack could cost a small business $120,000 — and an enterprise more than $2 million.

While any dollar amount of lost revenue caused by this style of attack is significant, the Coreo study found that financial loss is only the fourth-worst damaging consequence for businesses.

Loss of Trust and Other Damaging DDoS Consequences

The loss of consumer trust following DDoS attacks ranked as the number one consequence for businesses, according to the Corero study, which surveyed more than 300 security professionals. This was followed by theft of intellectual property as the second-worst consequence and the threat of a malware infection as the third.

The study also found that DDoS attacks are a constant battle for security professionals. Their organizations — no matter the industry — are seeing an average of one DDoS attempt per day.

“DDoS attacks can have an immediate and damaging impact on a company’s bottom line, both in terms of lost revenue and the costs incurred in terms of manpower required to mitigate attacks,” said Ashley Stephenson, CEO at Corero Network Security. “Not all DDoS attacks will cost an organization $50,000, but having your website taken offline can damage customer trust and confidence.”

Evolving Attack Vectors

DDoS attacks were once considered more of a nuisance and reputational style of cyberattack. It’s a favored choice of cyber weapon of hacktivist groups wanting to make a statement and garner attention. There was a time when you could almost count on groups like Anonymous to take down the website of an organization they didn’t agree with.

This has changed: Attacks have become more sophisticated and sustained. Attackers are taking advantage of the increasing number of vulnerable devices connecting to the network. They’re turning to the Internet of Things (IoT) and mobile devices and using them — through the spread of malware — as botnets designed to take down large-scale networks.

Mirai showcased how easy it is to turn an average IoT device into a botnet, and now we’re beginning to see new variations like Reaper (and other botnets) evolving to take over people’s devices.

These rented botnets are a growing trend in attacks — and one of many new avenues attackers are using, CSO reported. “Another trend is the use of multiple attack vectors within an attack, also known as Advanced Persistent Denial-of-Service [APDoS],” CSO reported. “For instance, an APDoS attack may involve the application layer, such as attacks against databases and applications as well as directly on the server.”

Read the complete X-Force research report: Weaponizing the Internet of Things

Smoke Screen: A Distraction Technique

Many of these attacks are designed to be a smoke screen, noted Corero. While the large attacks that target huge enterprises often block access to major retail, media, financial and social websites, most attacks are low-key and under the wire.

Attention has to be paid to these attacks to prevent the major consequences caused by a DDoS attack. While security personnel are focused on mitigating the attack, the attackers get busy testing the organization’s network for vulnerabilities or looking for ways to stealthy access data.

“Considering the huge liability that organizations can face in the event of a data breach, IT teams must be proactive in defending against the DDoS threat and monitor closely for such malicious activity on their networks,” Corero reported.

Prepare for DDoS Attacks

DDoS has historically been one of the most difficult types of cyberattacks to defend. Perimeter defenses don’t work. Instead, experts recommend focusing on mitigation tools and providers. Also, develop a mitigation and incident response (IR) plan that, if you’re taken offline, backup services can kick in, and damage is kept to a minimum.

Customers come to your websites to do business. If they can’t access you, the immediate loss of business revenue will hurt — but their frustration could turn them to another company who is available. Can you afford the loss of customer trust?

More from Network

Cybersecurity in the Next-Generation Space Age, Pt. 4: New Space Future Development and Challenges

View Part 1, Introduction to New Space, Part 2, Cybersecurity Threats in New Space, and Part 3, Securing the New Space, in this series. After the previous three parts of this series, we ascertain that the technological evolution of New Space ventures expanded the threats that targeted the space system components. These threats could be countered by various cybersecurity measures. However, the New Space has brought about a significant shift in the industry. This wave of innovation is reshaping the future…

Backdoor Deployment and Ransomware: Top Threats Identified in X-Force Threat Intelligence Index 2023

Deployment of backdoors was the number one action on objective taken by threat actors last year, according to the 2023 IBM Security X-Force Threat Intelligence Index — a comprehensive analysis of our research data collected throughout the year. Backdoor access is now among the hottest commodities on the dark web and can sell for thousands of dollars, compared to credit card data — which can go for as low as $10. On the dark web — a veritable eBay for…

Cybersecurity in the Next-Generation Space Age, Pt. 2: Cybersecurity Threats in New Space

View Part 1 in this series, Introduction to New Space. The growth of the New Space economy, the innovation in technologies and the emergence of various private firms have contributed to the development of the space industry. Despite this growth, there has also been an expansion of the cyberattack surface of space systems. Attacks are becoming more and more sophisticated and affecting several components of the space system’s architecture. Threat Actors' Methodology Every space system architecture is composed of three…

Beware of What Is Lurking in the Shadows of Your IT

This post was written with contributions from Joseph Lozowski. Comprehensive incident preparedness requires building out and testing response plans that consider the possibility that threats will bypass all security protections. An example of a threat vector that can bypass security protections is “shadow IT” and it is one that organizations must prepare for. Shadow IT is the use of any hardware or software operating within an enterprise without the knowledge or permission of IT or Security. IBM Security X-Force responds…