I have read so many stories that a major DDoS attack is causing companies thousands of dollars to mitigate. I have two questions:
Is this because they try to keep the servers accessible to real site visitors while an attack is going on?
Does shutting the server down instead of trying to keep it up still cause loss of money? In other words, instead of spending thousands of dollars to try to keep the server up why not just shut it down (concede from the attackers) and spend nothing.
It's because if you shut a server down, you can't use it for revenue. Imagine having a real shop: if you close it during the day, you can't sell anything and offer your services. It's as simple as that.
To improve my answer, it costs a lot to fight because it's pretty much impossible to defend yourself against such attacks, since the attacker can use a very large number of machines to attack you. If you can defend yourself from an attack by 1000 computers, the attacker only needs to add one more to win. And since there is no limit to the number of machines the attacker can use, you basically will never be invulnerable :)
So, in conclusion, shutting the server down means no revenue because you can't offer your services anymore, but at the same time, keeping it up is extremely expensive (but it's better than shutting it down).
It's this simple: If the DDoS attack causes you to shut down, whether by the damage it does directly or by your response to it, then the attacker succeeds. If an attack succeeds, it will be performed every time the attacker wants to succeed.
The way to reduce DDoS attacks is to make sure they fail. If a DDoS attack doesn't take the site down, there's no point in attacking.
So to prevent DDoS attacks, you need to be able to survive them.
In other words, instead of spending thousands of dollars to try to keep the server up why not just shut it down (concede from the attackers) and spend nothing.
Because then you will have to cave in to the attackers every time they want something.
Here's a real-world scenario from the time of unrest in Bosnia:
You operate a chat service that is open to all comers. You also host events for several major companies such as chats with celebrities.
Some racists from a particular country close to the unrest in Bosnia don't like certain channels that speak a language associated with a race they dislike. They demand you prohibit users from that country and close those chat channels that speak in that language. If you don't do what they ask, they will DDoS you during every event you host on your service and cause you to lose those major customers to competitors.
What do you do? And if you cave in to the threats, how do you explain that to your users?
You want to know what they actually did? They multiplied their server capacity by 10 and their Internet bandwidth by 20. They added a full-time DDoS person just to monitor and react to attacks. They spent a lot of money, but they were able to issue some choice words of resistance to the racists. It was money well spent.
Another aspect to the cost for a company, besides lost revenue, is the cost of investigating, verifying, and responding to such attacks. There are conversations with ISPs, combing through log files, re-writing firewall rules, communicating with customers, then postmortems.
But note that a company cannot 'stop' the attack, they can only weather it. 'Stopping' and attack would require ISP cooperation and coordinated action.
** correction as a result of comments **
I had said that there were large costs to an ISP to stop a DDoS attack, but I was working from old experience with ISPs. Given the premise that an ISP can stop an attack with great effectiveness and little cost, it seems the only cost to a company is the lost revenue and market opportunity of having an unavailable asset, as well as the costs of Incident Response.
Shutting the server down to stop DDoS is like killing a patient to cure a disease. This is not "stopping" the attack, this is actually making it succeed by doing the damage yourself.
Remember, the end goal of DDoS is server shutdown...
Stopping DDoS means; handling the attack without interrupting regular website activities.
If you close your website for every DDoS attack (or even for every major one) you`ll be out of business in a week, as the attackers will keep coming back, again and again and again , until you either pay-up of setup a defensive perimeter.
You can also combat DDoS attacks by blocking the traffic before it gets to your server. This can be a very cost effective solution. This is the idea that cloudflare is based on, but there are other similar solutions, both commercial and do-it-yourself.
The cost of a DDoS has mostly to do with lost of revenues, not fixing the problem per se.
I truly don't mean to dumb down the answer, you probably understood all this by now but as an analogy, consider you have a brick and mortar store. One morning, your store gets filled with non-buying customers, with a crowd in front of the door making it seem as if the store is not accessible. Furthermore, not only is the store not available for 'real business', the crowd has planted a huge sign on the front door that says 'CLOSED'.
This would look really awful for customers passing by, and they would go elsewhere.
