Distributed denial-of-service (DDoS) attacks remain a reliable method for cybercriminals to damage network performance or bring down corporate servers. As noted by SecurityWeek, the purpose of the DDoS attack is now more sophisticated than simple damage or theft. A recent Kaspersky Lab report found almost half of companies victimized say they can identify both attackers and their motivation.

Everything Old Is New Again

DDoS has been an essential part of the attacker toolkit since the late 1990s. Despite advances in both detection and prevention technology, it still remains a viable attack choice today, especially for cybercriminals looking to distract from or obfuscate a secondary and more sophisticated effort.

As noted by the Bitcoin News Service, in fact, some data suggest that 2016 may bring a threefold increase in the number of automated Bitcoin DDoS ransom attacks; through 2015, the number of service-denial attacks jumped by 32 percent each quarter. For attackers, it’s an easy choice: Why design something new, flashy or complicated when old standbys still get the job done?

Know Your Attacker

According to Kaspersky Lab, 48 percent of companies said they can identify their DDoS attacker. For example, 12 percent believe competitors are responsible. Another 38 percent said criminals looking to disrupt operations were the major players in these attacks, while 11 percent pointed the finger at political activists and 5 percent said governments or nation-states shouldered the blame.

When asked about motivation, 28 percent said attackers were looking to disrupt their operations, while 27 percent argued that ransom was the attackers’ key motivation. What’s more, only 6 percent of companies report their data loss, making it hard to compare notes and determine if a specific group or government agency really is behind a DDoS attack.

Put simply, the notion of identity is more speculation than certainty for most companies. Motivations are just as vague; businesses are left interpreting motivations with little in the way of hard data. Unless attacks come with clear messaging, companies must rely on their best judgment, which may be clouded by particular projects in development or may be influenced by the experiences of a specific C-suite executive or IT professional.

Finding the Root of a DDos Attack

Here’s how it all shakes out: The knowledge of an attacker is flimsy at best and often based on internal discourse rather than data. And since most companies aren’t going to go after cybercriminals once a breach has taken place, the focus on identity is actually a red herring; “who” isn’t nearly as useful as the “what” and “how” in this scenario.

Rather than trying to determine which group or agency came looking for data, companies are better served building network infrastructure able to detect the hallmarks of a DDoS attack and stop it before servers are overwhelmed. Knowledge is power, but when it comes to DDoS, names pale in comparison to understanding action.