Study options for DDoS attack prevention

[ccsr]

Study DDoS attack prevention and mitigation for APInf

Definition of done

• [ ] Study options / strategies
• [ ] Document
  • [ ] a small description of the problem
  • [ ] 2-3 options with pros and cons (options may be tools and/or processes)
• [ ] Document is stored in docs repository

There is a DDoS-prevention document created in our docs repository.

[as33ms]

IMHO, this should be done on the server level rather than at the software level.

[kyyberi]

+agreed. Search for existing solutions instead of building one from scratch.

[kyyberi]

A little more information about possible strategies http://security.stackexchange.com/questions/73369/how-do-major-sites-prevent-ddos

[kyyberi]

CDN is the most reliable approach.

[bajiat]

@jawidahmadi

First of all, thanks for reading a good number of sources for your research. :)

I know your research text has already been merged, but I still have a few comments to make. Sorry for not being able to read the text sooner.

If there is text that is copy from someone else's text, please mark it as a quotation, if it is longer than 3 words. For instance, this snippet of text is copied from one of your sources: "It is a subtle dance and requires a bit more understanding of the application and its flow," If we copy text from others without marking it as a copy (and giving the source), we are plagiarizing.

I'm wondering about this recommendation in a research document for APInf (API management tool): "Consider using AWS API gateway as the second stage for your API requests. AWS API gateway provides filtering, throttling, security,auto-scaling and HA for your API."Maybe @brylie can comment, whether this is an ok recommendation or not. I found this as a recommendation to use another tool.

Based on this research, what levels do you think we should be focusing on and are these some concrete first steps?