This post was originally published in French only. We translated it in 2026 so the archive reads the same in both languages. Read the original →
Denial of service attacks, distributed or not, are not limited to bandwidth alone.
It remains true that one class of denial of service works by saturating bandwidth, but that approach is expensive and not very cost-effective for the attacker. It requires a large mass of drones to pull off this type of attack. Essentially, bandwidth consumption is 1:1. Where it gets more interesting for the attacker is when a denial of service can be achieved with bandwidth usage below 1:1. That's possible when you go after applications, which generally don't “scale” as easily as bandwidth. On top of that, some attack vectors can generate a heavy load with a single packet, saturating the CPU and/or memory quickly and effortlessly. As with everything, leverage is always the most advantageous route for whoever uses it.
Wrongly, availability is viewed only from the security and infrastructure angle. The field of “capacity and performance” specifically covers assessing applications' capacity to handle a defined load, setting up queues to protect the application from a sudden overload, or scaling application capacity up on demand. Among the tools available to capacity and performance specialists, there are security components that specifically protect applications against resource-expensive operations and divert them elsewhere (offloading) or block them outright before they reach the application.