A CISA is evaluating an organization's network security, specifically focusing on protection against denial-of-service (DoS) attacks. The organization hosts several public-facing web applications that are critical for its business operations. Which of the following is the MOST effective control to implement at the network edge to mitigate large-scale volumetric DoS attacks?
- ADeploying a stateful firewall with deep packet inspection capabilities.
- BConfiguring Access Control Lists (ACLs) on network routers.
- CUtilizing a cloud-based DDoS mitigation service.
- DImplementing rate limiting on web servers.
Show answer & explanationAnswer & explanation
Correct answer: C. Utilizing a cloud-based DDoS mitigation service.
For large-scale volumetric DoS attacks, especially those targeting public-facing web applications, a cloud-based DDoS mitigation service is the MOST effective control. These services operate at a massive scale, absorbing and scrubbing malicious traffic far upstream from the organization's network, preventing it from overwhelming local resources. Local controls like ACLs, firewalls, and rate limiting are often insufficient against truly large-scale attacks.
Why the other options are wrong
- A. Stateful firewalls can offer some protection but will likely be overwhelmed by the sheer volume of traffic in a large-scale DoS.
- B. ACLs are basic filtering but cannot handle the volume of traffic in a large-scale DoS attack.
- D. Rate limiting on web servers is a good application-layer defense, but it's too far downstream and will be overwhelmed by volumetric attacks before traffic even reaches the application layer.
Cloud-Based DDoS Mitigation
A service provided by a third party that reroutes an organization's network traffic through its scrubbing centers to filter out malicious DDoS attack traffic before it reaches the target infrastructure.
- Scales to absorb massive volumetric attacks.
- Protects against various DDoS attack types.
- Operates 'upstream' from the protected network.
Memory trick: For a flood, you need a big dam, not just a small filter.