4 ms·
I think they need to hire someone that is strong on the security side of the business, for two reasons: * he appears not aware of the role of hardware firewall
by richardfey 6y ago
I think they need to hire someone that is strong on the security side of the business, for two reasons:
* he appears not aware of the role of hardware firewalls in mitigating DDoS by handling efficiently a lot of active TCP sessions (they have specialised hardware for this purpose)
* he is describing in great detail a lot of information that a phisher or other type of hacker can treasure to target him
- tpetry 6y agoYou cant protect from a DDoS with a hardware firewall, a DDoS consists of so much bandwidth that your network hardware is not able to simply handle the incoming traffic before any filtering happens. Your expensive hardware firewall can protect from DoS attacks, but they don‘t happen anymore as DDoS attacks are really cheap.
- e40 6y agoCan you can protect yourself from certain types of things (SYNC flood) with a firewall, though.
- richardwhiuk 6y agoIt's easier to protect against SYN floods if you terminate the connection.
- richardfey 6y agoIn any situation where you need to create a filter rule that needs to run fast against a lot of TCP sessions a hardware firewall will do it faster than your general purpose server. It's not about protection but mitigation.
- rfd4sgmk8u 6y agoI read it this way too. Having the OS kernel have to process all internet junk traffic (including all the IoT worms) wastes CPU cycles that could be used serving traffic to legitimate users. It is better to offload the packet filtering to a dedicated device, with an OOB management. If the host was flooded, one might not be able to activate a host based firewall to fix in such a DDoS condition.