4 ms·
In some ongoing DDoS attacks, I've heard companies say they're dedicating more resources to combatting the problem. Is active mitigation mainly about sifting t
by brownbat 10y ago
In some ongoing DDoS attacks, I've heard companies say they're dedicating more resources to combatting the problem.
Is active mitigation mainly about sifting through incoming traffic, trying to find signatures and update filters in realtime? Or more replacing dynamic with static content as its targeted? Or are there other ways resources get surged during a crisis?
ie, Is it heavy on manual analysis, or are we at the point yet where we can automate mitigation?
Just curious. Would recommend an AMA, but that's not this site.
- gbuk2013 10y ago(Answer from one of my more knowledgeable colleagues since I work on supporting the infrastructure rather than DDoS mitigation itself): The larger the attack, the simpler the vector. For the Flood (TCP, UDP, DNS, NTP, etc) attacks, creating accurate firewall rules within your cloud-scrubbing provider handles a large portion of this, the remainder can be mitigated by connection rate-limiting or TCP connection mitigations (check to make sure it’s a valid 3WHS before allowing connections to the origin). Complex L7 attacks require more effort and usually shift around in what they are attacking, this takes more analysis to pin down, though the L7 Bot Defenses, intelligent rate limiting and automatic traffic analysis help with this. DDoS mitigation is not explicitly a science, there is an art to it as well that comes from experience and learning day-to-day as attacks evolve. As attacks start up, mitigations may be too strict or too loose, that is the benefit of an expert SOC staff to monitor the situation and adjust as needed. Relying on automation for this will likely leave the customer frustrated with the outcome.
- brownbat 10y agoFascinating, thanks!