Revision as of 08:53, 20 March 2017

Last revision (mm/dd/yy): 03/20/2017

Introduction

This article is focused on providing clear, simple, actionable defense guidance for preventing denial of service in your web applications. Denial of Service attacks are very common due to two factors :

1. The significant prevalence of cloud and web services
2. Easy to get testing tools to cause denial of service attacks.

Because it's very simple to launch the DOS attack, any web services don't have Anti-DOS defenses mitigation in place will be vulnerable to DOS attacks.

To avoid and mitigate DOS attack, both developers and operations engineering will need to have layered of defenses in place:

a) Service: When the service is built, it's developed with anti-DOS in mind such Input validation, Resource handling, Size or Length validation.

b) Web Host: Every Web server such Apache, NginX or Linux host provides the configuration of connection. Properly configure these network configuration may also help to mitigate the DOS attacks.

c) Infrastructure: Signature-based or behavior detection firewalls, load balance, fail-over, cloud anti-DDoS service

This objective of the article is to provide a list of common techniques for preventing DOS attack regardless of technology and platforms.

Coding Defenses

Web Services Defenses

General web services protection against DOS

• l 针对每一个IP位址限制最大的连接数
• l  定义HTTP request可以请求的最大报文
• l  HTTP request 的timeout时间
• Host Defenses

Network Infrastructure Defenses

Related Articles

Authors and Primary Editors

Tony Hsu - hsiang_chih[at]yahoo.com

Other Cheatsheets