Most businesses worry about the wrong cyber threat first.
They picture a hacker stealing files, draining bank accounts, or locking up systems with ransomware. Those risks are real. But there is another attack that can hurt a business fast, even if no one breaks in. It is called a denial-of-service attack, or DoS attack. Its goal is simple: stop your services from working so real customers cannot use them.
A DoS attack does not always look dramatic from the outside. Your website slows down. Email gets flaky. DNS stops resolving properly. Customers cannot log in, pay, book, or contact you. Staff lose time. Sales stop. Trust drops. The business starts bleeding before anyone has finished the first incident meeting.
Here is the uncomfortable truth: you cannot guarantee your business will never be targeted. The Australian Signals Directorate says organisations cannot avoid being targeted by DoS attacks. That is the skeptical starting point smart businesses need. Hope is not a control. Waiting until the attack starts is not a plan. If uptime matters, preparation matters more.
What a DoS attack really is
A denial-of-service attack is designed to disrupt or degrade online services such as websites, email, and DNS. Attackers do this by flooding a service with data, connections, or requests until it becomes overloaded and legitimate users are denied access. Sometimes the goal is to consume network bandwidth. Other times the aim is to burn up processing power with more tailored traffic. Either way, the result is the same: your business is online, but not really usable.
Many attacks today are distributed denial-of-service attacks, or DDoS attacks. That means the traffic comes from many devices at once, often spread across many places. Attackers may also hijack a domain registration or DNS service to redirect users away from the real service. So the attack surface is broader than “too many people hit the website.” It can hit the systems customers use to find you in the first place.
Why this problem is getting worse
Businesses should assume this threat is growing, not shrinking.
The guidance explains that DoS attacks are becoming more common in part because of easily compromised internet-connected devices. Weakly secured Internet of Things devices, such as smart TVs, kettles, vacuum cleaners, and security systems, can be remotely compromised and added to botnets. Those botnets can then be used to generate huge amounts of attack traffic. Even worse, that infrastructure may be rented or sold to cybercriminals and hacktivists. In other words, attack capability is becoming cheaper, more available, and more scalable.
That should change how leaders think. This is no longer a niche technical problem for only banks, governments, or giant retailers. As more business moves online and more poorly secured connected devices exist, attacks are likely to continue to increase. If your company depends on a website, portal, booking system, email, or cloud service, this is a business continuity issue, not just an IT issue.
Start with the right question
Before buying tools, ask one blunt question:
Which online services must stay up during an attack, and which can go down for a while?
That is where the official guidance starts. Your organisation should assess its business requirements to decide whether each online service must remain operational during a DoS attack or whether temporary interruptions are acceptable. This is smart advice because not every service is equal. Your public blog is not your payment gateway. Your brochure site is not your support portal. Your leaders should define what truly matters before the stress hits.
This is also where many businesses fail. They treat “the website” as one thing. It is not. Some pages create demand. Some close sales. Some handle support. Some are expensive to serve. Some can be simplified in a crisis. If you do not know the difference in advance, your team will waste precious time arguing while the attack continues.
Build resilience before the bad day
The most important line in the guidance may be this: preparing for DoS attacks before they occur is the best strategy, because without preparation, it is difficult and less effective to respond during an attack. That should be pinned on every IT and executive team wall.
So what does preparation look like?
First, consider using a cloud-based DoS mitigation service. The guidance also recommends highly resilient online services with large bandwidth, adequate processing resources, geographically dispersed hosting, and cloud-based traffic scrubbing. For many businesses, this means working with reputable providers that are built to absorb ugly traffic at scale.
Second, if you use a content delivery network, do not assume you are automatically safe. The source recommends extra steps: protect the origin server, avoid exposing its IP address, use access controls so only the CDN and authorised management networks can reach it, and optimise caching. That last point matters. The more content that can be served from cache, the less work your origin has to do under pressure.
Third, reduce the attack surface. The guidance suggests outsourcing foundational services like DNS to reputable providers, separating critical services such as email from more likely targets like public websites, and limiting the mitigation service to only the network ports needed for the service. This is practical and forward thinking: fewer exposed parts usually means fewer ways to fail.
Ask harder questions of your vendors
A skeptical business should not accept vague promises from providers.
The guidance says organisations should discuss provider capabilities in detail, including whether they can withstand global attacks, whether they automatically mitigate most attacks without human involvement, how pricing works during attacks, when they will notify you, what pre-approved actions they can take, and what arrangements they have with upstream providers.
That pricing point is more important than many leaders realise. If protection costs rise with traffic volume or processing load, a DoS attack may create both downtime risk and surprise costs. Ask whether fixed pricing exists. Ask whether billing caps can be set. Ask what they do automatically at 2 a.m. on a weekend. If the answer is fuzzy now, it will be worse during a live incident.
Monitoring is not optional
If you cannot see the attack, you cannot manage the response.
The source advises implementing real-time monitoring and alerting for system availability, network traffic, processing resources, and associated costs. That means you should know not only when something is down, but also when it is under unusual strain, when bills start climbing, and when service quality drops before full failure happens.
It also recommends preparing a static version of your website that uses minimal processing and bandwidth. This is a great example of smart resilience. During an attack, you may not need your full digital experience. You may just need customers to find basic information, contact details, service status, and critical forms. Fancy can wait. Available wins.
Protect what points people to you
Businesses often forget that domain names are business assets.
The guidance recommends protecting domains by using registrar locking, confirming contact details are correct, and following DNS security guidance. That matters because some attacks aim to redirect users away from your real services. If customers cannot find the right destination, your clean infrastructure will not save you.
It also says you should keep contact details current for service providers and share your own, including out-of-band contacts for trusted communication when normal channels fail. During a serious outage, email may not be the best way to coordinate. You need backup paths and tested contacts ready before the crisis.
Your incident plan must be real, not decorative
The source recommends developing, implementing, and maintaining a cyber security incident response plan that covers different DoS attack types for the services that must withstand attacks, and exercising the plan at least annually.
This is where business maturity shows. A real plan names owners, actions, escalation paths, communications, vendor contacts, technical fallbacks, and service priorities. A decorative plan is a PDF no one has opened in a year. One helps. One comforts.
What to do when the attack starts
During a DoS attack, the guidance says to enact the incident response plan, ask providers to implement responsive actions, disable non-vital functionality or remove content that makes the attack effective, maintain communication with customers and providers, keep monitoring service availability, and consider changing the origin server IP address if it is directly targeted. It also recommends reporting the incident to the relevant national cyber authorities.
Notice what is not in that list: panic, guesswork, and endless internal debate.
A good response is calm and blunt. Strip out search, dynamic features, or large files if they are helping the attacker. Move to a lighter site version. Speak clearly to customers. Coordinate with providers. Protect the new origin IP before exposing it. Keep the goal simple: maintain essential service while reducing the attack’s effect.
Do not become part of someone else’s attack
There is one more lesson here that forward-thinking businesses should not ignore: your own devices and services can be abused to attack others.
The guidance recommends not exposing unneeded or insecure services and internet-connected devices to the internet, securely configuring and maintaining what must be exposed, reviewing known amplification-prone protocols, monitoring for new amplification vectors, applying access controls, blocking anonymous public access where not needed, and using rate limiting when blocking is not possible.
That is more than good citizenship. It is good business. A company that helps fuel attacks on others is showing the same weak hygiene that can later be used against itself.
So, what next?
The smartest businesses do not ask, “Can we stop every denial-of-service attack?” They ask, “How do we keep operating when one comes?”
That is the right mindset. Denial-of-service attacks are not just technical noise. They are business disruption with a cyber trigger. The organisations that fare best are the ones that decide what must stay alive, build for resilience before the crisis, pressure-test their providers, simplify service when needed, and rehearse the response before the alarms go off. Skeptical leaders prepare because they know failure is expensive. Forward-thinking leaders prepare because they know continuity is a competitive edge.
Source: https://www.cyber.gov.au/
