A denial-of-service (DoS) attack prevents or impairs authorized users from accessing a system, service, or resource—or delays operations so they cannot happen when needed. Its defining effect is on availability. A distributed denial-of-service (DDoS) attack is a DoS technique that uses numerous hosts or attacking machines.
What does denial of service mean?
NIST’s CSRC glossary lists definitions from different source documents. One, attributed there to CNSSI 4009, describes DoS as “The prevention of authorized access to resources or the delaying of time-critical operations.” NIST’s note explains that “time-critical” can mean anything from milliseconds to hours depending on the service. Another glossary definition describes preventing authorized access to a system resource or delaying system operations and functions. These are source-specific formulations, not one universal quotation. NIST CSRC glossary: DoS
As an Amazon Associate I earn from qualifying purchases.
CISA’s NICCS glossary defines a denial-of-service attack as one that prevents or impairs authorized use of information-system resources or services. In plain terms, a service may be online but too slow or unreliable to use, or it may be unavailable altogether. NICCS glossary
How is DoS different from DDoS?
The distinction is the number and distribution of attacking sources. NIST defines a DDoS technique as one that uses numerous hosts to perform the attack. A joint CISA, FBI, and MS-ISAC guide describes an attack as distributed when overloading traffic comes from more than one attacking machine. A botnet—a group of compromised devices coordinated to send traffic—is one way attackers can assemble those sources. NIST CSRC glossary: DDoS · CISA, FBI, and MS-ISAC guide to DDoS attacks
#1 Best Overall
People sometimes use “DoS” to mean an attack from one source and “DDoS” for one from many. That is a useful shorthand, but the important operational point is whether the attack is distributed; a real incident may involve multiple machines and different resources or techniques.
How can an attack disrupt access?
DoS is not necessarily a flood of enormous traffic. An attack can exhaust different resources or exploit behavior that makes a system unable to serve legitimate users. The joint government guide groups common attacks by the resource they overload:
| Resource targeted | What is consumed | Possible availability effect |
|---|---|---|
| Network | Network hardware, software, or bandwidth capacity | Traffic cannot be handled reliably, slowing or interrupting access. |
| Protocol or session | Connection or session capacity | The system has fewer resources available to establish or maintain legitimate connections. |
| Application | Application compute or storage resources | Requests may become slow or fail as the application runs short of resources. |
NIST’s incident-handling guide gives examples that show why raw traffic volume is not the only concern: malformed packets can crash a server, processor-intensive requests can burden an application, and simultaneous login sessions can be exhausted. NIST SP 800-61
CISA’s quick guide also describes Layer 3 and Layer 4 DDoS attacks as volumetric attacks on network infrastructure: high traffic volumes can slow servers, consume bandwidth, and degrade legitimate access. That describes a category of DDoS, not every DoS attack. CISA DDoS Quick Guide
What are the consequences of a DoS attack?
The direct impact is reduced availability: authorized users cannot use a resource, or it does not perform when required. The practical severity depends on what the affected service does and how time-sensitive it is. CISA’s quick guide says risk, threat, and impact should be determined case by case; the joint CISA, FBI, and MS-ISAC guide lists service outages, financial losses, and reputational damage as possible consequences.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.DoS and DDoS at a glance
| Question | DoS | DDoS |
|---|---|---|
| What does the term describe? | An attack that prevents or impairs authorized access or delays system operations. | A distributed denial-of-service technique using numerous hosts or multiple attacking machines. |
| What is the key distinction? | The term describes the availability impact; it does not by itself specify every attack method. | The attack traffic comes from multiple distributed sources. |
| What can be targeted? | Network, protocol/session, or application resources; the target resource does not determine whether an attack is distributed. | |
Distributed attacks can be more difficult to defend against because their sources are spread across multiple machines, according to the joint government guide. The right response depends on the organization and the systems affected; a definition alone does not determine an appropriate mitigation plan.
Quick Recap
Best Value
- Used Book in Good Condition
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
