5 ms·

These points are so high level and obvious that this is basically useless: >Locate servers in different data centers. >Ensure that data centers are located on

by hueving 10y ago

These points are so high level and obvious that this is basically useless: >Locate servers in different data centers. >Ensure that data centers are located on different networks. >Ensure that data centers have diverse paths. >Ensure that the data centers, or the networks that the data centers are connected to, have no notable bottlenecks or single points of failure. Getting Robbed: Best practices for Prevention and Response * Don't carry all of your money with you at all times. * Don't advertise that you're carrying large sums of money. * Have enough money that getting robbed doesn't really affect you. * Pay someone else to do your errands so you're not at risk.

erikb 10y ago
Not really getting your point. All but "having enough money" are actually good advice to not getting robbed. E.g. if carry around a golden Rolex and/or the newest iPhone you are much more likely to get robbed than if you have no watch and a $150 Android device in your hand. And most people don't carry around all their money for exactly the reason to not lose too much.
- haimez 10y ago
  Except UNLIKE the Rolex analogy, the recommendation is not "do not carry your role" it is more akin too "do not own a Rolex". Or more directly, "avoid the problem by not having enough resources to own a Rolex".
  - 23234242 10y ago
    True but now there's a separate danger with botnets. Now, instead of saying "don't own a Rolex" it's "don't own any silver, because that could be used to make a knife and steal someone else's Rolex." With botnets like Mirai, innocent networks need to protect themselves not to avoid getting attacked themselves but rather to ensure that they don't participate in an attack against someone else.
TeMPOraL 10y ago
I suppose anything more specific - both in case of DDoS and robbery prevention - would require a person/organization specific analysis that takes into account what you want to protect, what resources you have at your disposal and what threat model you operate under. I would love a link to some resources about how to do such analysis. Maybe someone here knows a good one?
gbuk2013 10y ago
I work for a DDoS protection company and while the advice in the article is indeed high level, it is exactly what we do. - buy a ton of network capacity in multiple locations around the world - route incoming traffic to different locations at BGP level This is really the only way to reliably cope with modern volumetric attacks right now. On top of that we: - scrub the traffic using using some expensive fancy appliances(*) - employ a bunch of very skilled people to manage it all and provide support This is what you need to protect against protocol / application level attacks. * which we get a very good deal on by virtue of making said appliances :)
- brownbat 10y ago
  In some ongoing DDoS attacks, I've heard companies say they're dedicating more resources to combatting the problem. Is active mitigation mainly about sifting through incoming traffic, trying to find signatures and update filters in realtime? Or more replacing dynamic with static content as its targeted? Or are there other ways resources get surged during a crisis? ie, Is it heavy on manual analysis, or are we at the point yet where we can automate mitigation? Just curious. Would recommend an AMA, but that's not this site.
  - gbuk2013 10y ago
    (Answer from one of my more knowledgeable colleagues since I work on supporting the infrastructure rather than DDoS mitigation itself): The larger the attack, the simpler the vector. For the Flood (TCP, UDP, DNS, NTP, etc) attacks, creating accurate firewall rules within your cloud-scrubbing provider handles a large portion of this, the remainder can be mitigated by connection rate-limiting or TCP connection mitigations (check to make sure it’s a valid 3WHS before allowing connections to the origin). Complex L7 attacks require more effort and usually shift around in what they are attacking, this takes more analysis to pin down, though the L7 Bot Defenses, intelligent rate limiting and automatic traffic analysis help with this. DDoS mitigation is not explicitly a science, there is an art to it as well that comes from experience and learning day-to-day as attacks evolve. As attacks start up, mitigations may be too strict or too loose, that is the benefit of an expert SOC staff to monitor the situation and adjust as needed. Relying on automation for this will likely leave the customer frustrated with the outcome.
Kephael 10y ago
> These points are so high level and obvious that this is basically useless: In general, this has been my perception of the majority of "software engineering" research which I've encountered.
paulddraper 10y ago
Your advice about robbery seems pretty solid. Out of curiosity, what would you recommend differently? Carrying a weapon and engaging in combat?

by hueving 10y ago

erikb 10y ago

Not really getting your point. All but "having enough money" are actually good advice to not getting robbed. E.g. if carry around a golden Rolex and/or the newest iPhone you are much more likely to get robbed than if you have no watch and a $150 Android device in your hand. And most people don't carry around all their money for exactly the reason to not lose too much.

haimez 10y ago
Except UNLIKE the Rolex analogy, the recommendation is not "do not carry your role" it is more akin too "do not own a Rolex". Or more directly, "avoid the problem by not having enough resources to own a Rolex".
- 23234242 10y ago
  True but now there's a separate danger with botnets. Now, instead of saying "don't own a Rolex" it's "don't own any silver, because that could be used to make a knife and steal someone else's Rolex." With botnets like Mirai, innocent networks need to protect themselves not to avoid getting attacked themselves but rather to ensure that they don't participate in an attack against someone else.

TeMPOraL 10y ago

I suppose anything more specific - both in case of DDoS and robbery prevention - would require a person/organization specific analysis that takes into account what you want to protect, what resources you have at your disposal and what threat model you operate under. I would love a link to some resources about how to do such analysis. Maybe someone here knows a good one?

gbuk2013 10y ago

I work for a DDoS protection company and while the advice in the article is indeed high level, it is exactly what we do. - buy a ton of network capacity in multiple locations around the world - route incoming traffic to different locations at BGP level This is really the only way to reliably cope with modern volumetric attacks right now. On top of that we: - scrub the traffic using using some expensive fancy appliances(*) - employ a bunch of very skilled people to manage it all and provide support This is what you need to protect against protocol / application level attacks. * which we get a very good deal on by virtue of making said appliances :)

brownbat 10y ago
In some ongoing DDoS attacks, I've heard companies say they're dedicating more resources to combatting the problem. Is active mitigation mainly about sifting through incoming traffic, trying to find signatures and update filters in realtime? Or more replacing dynamic with static content as its targeted? Or are there other ways resources get surged during a crisis? ie, Is it heavy on manual analysis, or are we at the point yet where we can automate mitigation? Just curious. Would recommend an AMA, but that's not this site.
- gbuk2013 10y ago
  (Answer from one of my more knowledgeable colleagues since I work on supporting the infrastructure rather than DDoS mitigation itself): The larger the attack, the simpler the vector. For the Flood (TCP, UDP, DNS, NTP, etc) attacks, creating accurate firewall rules within your cloud-scrubbing provider handles a large portion of this, the remainder can be mitigated by connection rate-limiting or TCP connection mitigations (check to make sure it’s a valid 3WHS before allowing connections to the origin). Complex L7 attacks require more effort and usually shift around in what they are attacking, this takes more analysis to pin down, though the L7 Bot Defenses, intelligent rate limiting and automatic traffic analysis help with this. DDoS mitigation is not explicitly a science, there is an art to it as well that comes from experience and learning day-to-day as attacks evolve. As attacks start up, mitigations may be too strict or too loose, that is the benefit of an expert SOC staff to monitor the situation and adjust as needed. Relying on automation for this will likely leave the customer frustrated with the outcome.

Kephael 10y ago

> These points are so high level and obvious that this is basically useless: In general, this has been my perception of the majority of "software engineering" research which I've encountered.

paulddraper 10y ago

Your advice about robbery seems pretty solid. Out of curiosity, what would you recommend differently? Carrying a weapon and engaging in combat?