What is a DDoS attack?
A DDoS attack (Distributed Denial of Service) is an attack in which a large number of systems simultaneously flood a network, server or application with traffic or requests, overloading it so that it becomes unreachable for legitimate users. The goal is not to steal or alter data but to undermine availability: the A in the CIA Triad.
DDoS attacks are among the most frequently reported cyber incidents and can have serious consequences for service delivery, production and reputation. In OT environments the emphasis differs from office IT: there is often no need for a botnet, because a small traffic spike or a single malformed packet can be enough to disrupt a controller.
🧠 What is the difference between DoS and DDoS?
In a DoS attack (Denial of Service) the attack comes from a single source. In a DDoS attack the traffic comes from hundreds to millions of sources at once, usually devices in a botnet: computers, routers, cameras and other IoT devices that have been taken over by malware. Because the traffic comes from everywhere, you cannot simply block a single IP address.
The best-known example is Mirai. This botnet consisted of poorly secured cameras and routers with default passwords. In autumn 2016 it was used against targets including the DNS provider Dyn, leaving major websites hard to reach for hours. Shortly before, Mirai’s source code had been published, and many later botnets build on it. In autumn 2025 Cloudflare mitigated attacks by the Aisuru botnet of 29.7 and later 31.4 terabits per second, lasting just 69 and 35 seconds respectively.
For an attacker, DDoS is cheap: botnets can be hired as a service (“booter” or “stresser”), often for relatively small amounts. As a result, even an attacker without technical skills can launch an attack.
🎯 What types of DDoS attacks are there?
DDoS attacks are usually classified by the resource they exhaust:
| Category | What is exhausted | Examples |
|---|---|---|
| Volumetric | Bandwidth of the internet connection | UDP flood, ICMP flood, reflection via DNS or NTP |
| Protocol attack | Connection tables of servers, firewalls and load balancers | SYN flood against TCP, fragmentation attacks |
| Application-layer attack | Processing capacity of web servers or APIs | HTTP GET/POST flood, expensive search queries |
| Botnet-based | Any of the above, from many sources | Mirai, Aisuru, hijacked IoT devices |
| OT-specific | Limited processing power and network stacks of controllers | Overload of HMI servers or SCADA network segments |
How do reflection and amplification work?
In a reflection attack the attacker sends small UDP requests with a spoofed source address (the victim’s IP address) to open servers on the internet. Those servers send a much larger response to the victim. The US agency CISA publishes the well-known amplification factors:
| Protocol | Amplification factor (bandwidth) |
|---|---|
| DNS | 28 to 54 |
| SSDP | about 31 |
| CLDAP | 56 to 70 |
| CharGEN | about 359 |
| NTP (monlist) | about 557 |
| Memcached | 10,000 to 51,000 |
A misconfigured server in your own network can therefore unintentionally take part in an attack on someone else. Network operators prevent spoofed source addresses with ingress filtering according to BCP 38.
🧯 How do you recognise a DDoS attack?
A DDoS attack is typically recognised by:
- A sudden overload or unavailability of websites, portals or VPN gateways
- Unexplained spikes in incoming traffic, often from many countries or a single protocol at once
- Reduced performance or time-outs in ICS applications and interfaces
- Alerts from monitoring and logging tools about repeated connection attempts or full connection tables
- Deviations in network behaviour flagged by anomaly detection or an IDS
🔁 What distinguishes a DDoS attack from an ordinary outage?
| DDoS attack | Other network outages |
|---|---|
| Deliberately caused by an attacker | Caused by a configuration error, fault or software update |
| Traffic from many sources at once, often spoofed | Usually traceable to a single device or segment |
| Traffic pattern changes when you mitigate | Pattern stays the same until the cause is fixed |
| Sometimes a diversion or part of a broader campaign | Usually an isolated incident |
In OT the boundary is not always sharp. A broadcast storm caused by a network loop has the same effect as an attack. In August 2006 Unit 3 of the US Browns Ferry nuclear plant had to be manually scrammed after both reactor recirculation pumps were lost. The controllers of the variable frequency drives had become unresponsive; they were connected to the same Ethernet plant network as a PLC that failed at the same time. The US Nuclear Regulatory Commission identified excessive network traffic as the cause.
🏭 Why is DDoS especially sensitive in OT environments?
In OT, availability ranks above confidentiality. Industrial equipment is built for deterministic behaviour, not for traffic spikes:
- Limited network stacks - many PLCs and I/O modules can only handle a limited number of connections. Known vulnerabilities in products from vendors such as Siemens let a single malformed packet put a controller into a fault state that requires a restart.
- Loss of view - an overloaded HMI or Historian means operators can no longer follow the plant, even if the process itself keeps running.
- Watchdogs and time-outs - delayed traffic makes communication watchdogs expire, after which installations go to a safe state and production stops.
- Exposed edges - Remote Access servers, VPN gateways and firewalls at the edge of the OT network are the first targets.
Two examples illustrate this. During the attack on the Ukrainian power grid in December 2015 (see BlackEnergy), the distribution companies’ call centres were flooded with telephone calls so that customers could not report outages. On 5 March 2019 an attacker exploited a known firewall vulnerability at the US renewable energy producer sPower. The firewalls rebooted repeatedly, so the control centre lost visibility of wind and solar farms for a few minutes each time. Generation itself was not interrupted, but the firewall had not been patched.
🔐 What should you do during a DDoS attack?
- Detect peak traffic via SIEM, Firewall logging or network monitoring
- Analyse the source, type and target of the traffic
- Activate mitigation through your internet provider or an anti-DDoS (scrubbing) service
- Communicate internally, with your provider and with your SOC or CSIRT
- Protect production by restricting or disconnecting IT/OT connections if necessary
- Document the attack characteristics, timeline and impact for reporting and evaluation
- Prevent recurrence with an improved network architecture, rate limiting and a rehearsed incident response plan
🛡️ How do you protect IT and OT against DDoS?
On the internet side, protection is about capacity and filtering outside your own network. Scrubbing services and CDNs absorb volumetric attacks before they fill your connection; your own firewall cannot do that. Agree in advance with your provider who does what and how quickly.
On the OT side, protection is about isolation and resilience:
| Measure | Effect |
|---|---|
| Segmentation with an IDMZ according to the Purdue Model | An attack on internet services does not directly hit process control |
| Broadcast storm control and rate limiting on switches | A loop or overloaded device does not bring down the whole network |
| QoS for control traffic | Time-critical traffic gets priority under load |
| Data diode for one-way traffic | Traffic from outside physically cannot reach the OT network |
| Redundancy and high availability | Failure of one path or server does not stop the service |
| Patch management of firewalls and controllers | Known DoS vulnerabilities are closed |
IEC 62443-3-3 captures this under Foundational Requirement 7 (Resource availability): SR 7.1 requires denial-of-service protection, so that a system keeps its essential functions or degrades in a controlled way, and SR 7.2 requires management of system resources.
🇳🇱 What does the Dutch context look like?
In early 2018 DDoS attacks temporarily took down the online services of major banks, the Dutch Tax and Customs Administration (Belastingdienst) and the government login service DigiD. In response, the National Anti-DDoS Coalition was set up in 2018 with banks, internet service providers, AMS-IX, the police and government organisations among its members; the NCSC acts as facilitator. In addition, the NBIP foundation has offered NaWas since 2014, a shared scrubbing service for Dutch organisations.
Pro-Russian hacktivists such as NoName057(16) have repeatedly launched DDoS attacks on Dutch and European government websites in recent years. In July 2025 the international police operation Eastwood, coordinated by Europol, took around a hundred of the group’s servers offline.
Under the Cybersecurity Act (Cyberbeveiligingswet), the Dutch implementation of NIS2 that entered into force on 15 August 2026, a DDoS attack with significant impact can be a reportable incident. The reporting obligation requires an early warning within 24 hours, an incident notification within 72 hours and a final report within one month.
❓ Frequently asked questions
Is a DDoS attack illegal in the Netherlands?
Yes, a DDoS attack is a criminal offence in the Netherlands under Article 138b of the Dutch Criminal Code, which covers the deliberate and unlawful obstruction of access to or use of an automated system. Hiring a booter or stresser service to carry out a DDoS attack also falls under this. Police and prosecutors pursue young offenders for it as well.
Can a firewall stop a DDoS attack?
Your own firewall usually cannot stop a volumetric DDoS attack, because the internet connection is already saturated before the traffic reaches the firewall. A firewall can even become the bottleneck itself when its connection table fills up. Effective protection against a DDoS attack therefore comes from the provider or a scrubbing service in front of your connection.
What is the difference between a DDoS attack and ransomware?
A DDoS attack makes a service temporarily unreachable without breaking in, whereas ransomware penetrates systems and encrypts data. A DDoS attack usually stops as soon as the attacker stops. Criminals sometimes combine the two by threatening a DDoS attack to extort a ransom.
How long does a DDoS attack last?
A DDoS attack can last anywhere from a few seconds to several days. Many modern attacks are short and intense: the record attacks of 2025 lasted little more than a minute at most. Attackers often repeat a DDoS attack in waves to test how quickly the defences respond.
Can a PLC fail because of a DDoS attack?
Yes, a PLC can enter a fault state or lose communication because of a DDoS attack, or even a simple DoS using malformed packets. Industrial controllers have limited network capacity and are not designed for large traffic spikes. Network segmentation, rate limiting and timely patching reduce that risk.
Do I have to report a DDoS attack?
You must report a DDoS attack with significant impact on your services under the Cybersecurity Act if your organisation falls within its scope. The early warning goes to the competent CSIRT and the supervisory authority within 24 hours. Even if you are not obliged to report, filing a police report and informing your sector organisation helps.
📌 In summary
A DDoS attack is a deliberate attempt to make a system or network unreachable by flooding it with traffic from many sources at once. In IT, protection is about capacity and scrubbing at the provider; in OT, it is about segmentation, rate limiting, patched edge devices and controllers that survive a traffic spike.