Here, John, and welcome back now in today's video will be looking into the mitigating aspects associated
with a distributed denial of service attacks.
So when you discuss about the mitigating details, there are four important points that you need to
remember.
First one is that you need to be ready to scale as the traffic surges.
Second is to minimize the attack surface area.
Third is know what is normal and abnormal and for this to create a plan for attacks.
So let's quickly look into each one of these in more detail.
So the first important point is be ready to scale so your infrastructure should be designed to scale
whenever the traffic increases.
So it not only will help you in business perspective, but also during the attacks.
So, for example, whenever a CPA load is more than 70 percent within an application, so you can Gordon
automatically add one more applications over to meet the needs.
So this can be possible with the help of Elby as well as auto scaling.
So whenever or typically during the U.S. attacks, you get a huge surge in traffic.
So if you have auto scaling enabled with Elby, you should be able to withstand the surge at a certain
level so that your website keeps on working and also serving the customers.
The second important point is associated with the minimizing of the attack surface area.
So always decouple your infrastructure.
So, for example, application as well as database should not be part of the same server so you can
separate it out to different servers altogether.
Second important gear is to only include the servers that need to be exposed within the public subnet
or in the DNC.
What a lot of organizations they do is they even include servers like database or in public subnet.
However, that is something that might not be needed.
So you need to be aware about that.
So also decoupling your infrastructure with the help of rescuers and also using elastic Bienstock is
something that can help.
Our third important part is to know what is normal or abnormal.
Sooky matrix needs to be defined to understand the behavior.
So, for example, the website is getting a huge surge in traffic in the middle of the night at three
a.m. So you should know whether this is normal or abnormal.
So based on this, you can go ahead and have the incident response team ready so there can be multiple
services that can help you.
So you have cloud watch.
You also have a Senate which can notify whenever traffic is considered to be abnormal.
And therefore, the important point here is to create a plan.
So if you're getting a divorce attack, what is the next step that you can perform?
So the forces check whether the source I.P. address is the same.
So typically this can be considered in a DOS attack, but typically in a distributed denial of service
attack.
You will have a wide variety of IP addresses.
So, again, you can verify that the source IP addresses are SIM or whether a single IP address is making
multiple request seconds you can take from which country the increased traffic is coming from.
You can also look into the nature of attack so there can be multiple attack types.
So you have simpler.
You also have the application level attacks next.
Important point is that you can also check if it can be blocked at the network or a security group level
or even a Web application firewall limit.
So it is also recommended to have the support, at least the business support whenever you are dealing
with this.
Now, one very important part to remember is that you should know the services for the U.S. attack mitigation,
so you should know about some of the services that will help Boyette.
So either she is one of the very important service.
Then you have other services like Lautrec, you have about 53.
You have the Web application firewall.
You can also make use of elastically load balancing, as well as the Lepke and security groups, as
well as their leaders.
Attack mitigation is concerned.
So that's the high level overview about the mitigating deduces attack.
I hope this video has been informative for you and I look forward to seeing the next video.