How a DDoS attack works
Attackers direct large numbers of compromised devices, usually a botnet, to send traffic at a target. Volumetric attacks saturate bandwidth, protocol attacks exhaust resources such as connection tables, and application-layer attacks send seemingly legitimate requests that overload a web service.
Some use amplification or reflection, where small requests to third-party servers trigger much larger responses aimed at the victim. Motives include extortion, activism, competition, and distraction while another intrusion takes place. Attacks can last minutes or days. Awareness of these categories helps match defenses to the attack.
Why it matters for Canadian organizations
Online services such as banking, e-commerce, healthcare portals, and government sites depend on availability. Downtime brings lost revenue, customer frustration, and in some sectors regulatory scrutiny of operational resilience, including OSFI expectations for federally regulated institutions.
The Canadian Centre for Cyber Security issues guidance on preparing for DDoS and works with providers on mitigation. Because attacks can mask other activity, security teams should watch for intrusion attempts during an outage. Extortion messages threatening an attack should be reported and handled through the incident response plan.
How to defend against it
Use a DDoS mitigation service or content delivery network that can absorb and filter large floods upstream, since on-premises capacity alone is rarely enough. Work with your internet provider on response procedures before an attack occurs.
Design for resilience with redundancy, rate limiting, and a web application firewall for application-layer attacks. Maintain a runbook that covers who declares an incident, how traffic is rerouted, and how customers are told. Test it, and monitor traffic baselines so abnormal spikes are noticed early.
Frequently asked questions
What is the difference between DoS and DDoS?
A DoS attack comes from a single source, while a DDoS attack comes from many distributed sources, usually compromised devices. DDoS is harder to block because the traffic does not originate from one address. Mitigation providers can also filter traffic from many sources at once.
Can a firewall stop a DDoS attack?
A firewall helps with some smaller or protocol-based attacks, but large volumetric floods can saturate your connection before traffic reaches it. Upstream mitigation services and a web application firewall are typically needed. Any reports should be made to police and the Canadian Anti-Fraud Centre as appropriate.
Is a DDoS attack illegal in Canada?
Yes. Deliberately disrupting a computer system or its data can violate the Criminal Code, including provisions on mischief in relation to computer data. Hiring someone to launch an attack is also unlawful. Legal advice can confirm how the law applies in a specific situation.
Related service: Managed security services