Q15Information Security Systems
Question
4 marks
Compare and contrast DoS and DDoS attacks with examples.
Answer
A definitive comparison between DoS and DDoS attacks. Contrasts the limited mathematical power of a single-source TCP flood against the catastrophic, globally distributed bandwidth exhaustion executed by massive botnet architectures.
Both Denial of Service (DoS) and Distributed Denial of Service (DDoS) are highly aggressive cyber-assaults designed to mathematically exhaust a target server's hardware (RAM, CPU, or Network Bandwidth) to violently deny access to legitimate users. The absolute difference lies in the architectural scale of the attack vectors.
1. Denial of Service (DoS)
- Architecture: A 1-to-1 mathematical assault. Exactly ONE malicious computer aggressively attacks the target server.
- Mechanism: The attacker might utilize a "Ping of Death" or a SYN Flood, rapidly firing malformed packets to crash the server's TCP/IP stack.
- Defense: Highly trivial to stop. The target's Firewall simply detects the massive spike in traffic coming from a single IP address and violently blocks that specific IP, instantly neutralizing the attack.
2. Distributed Denial of Service (DDoS)
- Architecture: A Many-to-1 catastrophic assault. The attacker utilizes a massive Botnet—100,000 infected IoT devices (fridges, cameras) geographically scattered across the globe.
- Mechanism: The attacker commands all 100,000 devices to simultaneously blast HTTP requests at the target server. The server is hit with 500 Gigabits per second of raw traffic, completely annihilating the data center's physical internet pipe.
- Defense: Mathematically horrific to defend against. The firewall cannot simply block one IP; the attack is coming from 100,000 legitimate residential IP addresses. Defeating it requires massive Cloud Scrubbing Centers (like Cloudflare) to mathematically filter the global traffic before it ever reaches the physical server.