To do this, you need to understand the characteristics of good traffic that the target usually receives and be able to compare each packet against this baseline.ĭeploy Firewalls for Sophisticated Application attacksĪ good practice is to use a Web Application Firewall (WAF) against attacks, such as SQL injection or cross-site request forgery, that attempt to exploit a vulnerability in your application itself. More advanced protection techniques can go one step further and intelligently only accept traffic that is legitimate by analyzing the individual packets themselves. Whenever we detect elevated levels of traffic hitting a host, the very baseline is to be able only to accept as much traffic as our host can handle without affecting availability. Additionally, it is also common to use load balancers to continually monitor and shift loads between resources to prevent overloading any one resource. You can either do this by running on larger computation resources or those with features like more extensive network interfaces or enhanced networking that support larger volumes. Most DDoS attacks are volumetric attacks that use up a lot of resources it is, therefore, important that you can quickly scale up or down on your computation resources. Additionally, web applications can go a step further by employing Content Distribution Networks (CDNs) and smart DNS resolution services which provide an additional layer of network infrastructure for serving content and resolving DNS queries from locations that are often closer to your end users. Since the ultimate objective of DDoS attacks is to affect the availability of your resources/applications, you should locate them, not only close to your end users but also to large Internet exchanges which will give your users easy access to your application even during high volumes of traffic. When architecting your applications, make sure your hosting provider provides ample redundant Internet connectivity that allows you to handle large volumes of traffic. The two key considerations for mitigating large scale volumetric DDoS attacks are bandwidth (or transit) capacity and server capacity to absorb and mitigate attacks. In other cases, you can use firewalls or Access Control Lists (ACLs) to control what traffic reaches your applications. In some cases, you can do this by placing your computation resources behind Content Distribution Networks (CDNs) or Load Balancers and restricting direct Internet traffic to certain parts of your infrastructure like your database servers. Thus, minimizing the possible points of attack and letting us concentrate our mitigation efforts. We want to ensure that we do not expose our application or resources to ports, protocols or applications from where they do not expect any communication. One of the first techniques to mitigate DDoS attacks is to minimize the surface area that can be attacked thereby limiting the options for attackers and allowing you to build protections in a single place.
For instance, a flood of HTTP requests to a login page, or an expensive search API, or even Wordpress XML-RPC floods (also known as Wordpress pingback attacks). These attacks are typically small in volume compared to the Infrastructure layer attacks but tend to focus on particular expensive parts of the application thereby making it unavailable for real users. While these attacks are less common, they also tend to be more sophisticated. But fortunately, these are also the type of attacks that have clear signatures and are easier to detect.Īttacks at Layer 6 and 7, are often categorized as Application layer attacks. These attacks are usually large in volume and aim to overload the capacity of the network or the application servers. These are also the most common type of DDoS attack and include vectors like synchronized (SYN) floods and other reflection attacks like User Datagram Packet (UDP) floods. Attacks at Layer 3 and 4, are typically categorized as Infrastructure layer attacks.
0 kommentar(er)
