DDoS attacks have long been known as the main form of cyber attack risk. “The Financial Inspection Manual” revised by the Japanese government’s Financial Services Agency in April 2015, identifies the risk of "DDoS attacks", and the need to take countermeasures is strongly emphasized. Other government agencies also acknowledge the frequency and severity of DDoS attacks. However, a clear method to completely prevent DDoS attacks has not been established yet. Why is that? What are the best measures that companies can take at the present time?