Running at 99%: Surviving an Application DoS

Presented at ToorCon San Diego 15 (2013), Oct. 19, 2013, 2 p.m. (50 minutes).

Application-Level Denial of Service (DoS) attacks are a threat to nearly every website. DoS attacks are simple to launch, but by nature difficult to defend against. They are rather like a ‘malicious load test'. Modern websites are a diverse set of moving parts. A malicious actor only needs to find the point at which one of these systems is overwhelmed to bring your infrastructure to a halt. Some orginizations approach this problem by increasing capacity, perhaps leveraging the cloud to expand horizontally. This can be a successful mitigation strategy, but a combined historic and real-time view of who is accessing your website (and why) gives you the chance to actively defend as opposed to simply absorbing the traffic. Trending this data over time allows your response time to decrease while keeping your front door open. In this talk, I will cite examples, successes, lessons learned, and present a new open source project (DoDoS, written in a combination of Node.js and python) that can be used as a defense framework for mitigating these attacks.


Presenters:

  • Ryan Huber
    Ryan is a security generalist. Hailing from rural Illinois, he had plenty of time to develop his skills with a 1200-baud modem and some epic phone bills. He was a member of the primary security team at Orbitz.com and later the head of EU Information Security for sister site Ebookers.com for a combined 11+ years. These jobs exposed him to many modern security concerns including the subject, denial of service attacks. He currently works as a developer for Risk I/O, a vulnerability management software company.

Links:

Similar Presentations: