Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Imagine a multitenant web app that stores data in a Apache Cassandra cluster, with fairly many nodes.

Now assume that:

  1. Mallory launches a DoS attack against one tenant. (Perhaps that tenant is a company that people don't like, for some reason.)
  2. It's a layer 7 DoS attack. I mean, it's not a SYN flood attack or something like that, but a "hand crafted" attack that actually reaches the database layer of the web app.
  3. [Data stored on the Cassandra nodes] is sorted by tenant id. That is, data belonging to the tenant-under-attack is located on fairly few nodes, in comparison to the total number of nodes in the Cassandra cluster.

With these assumptions, other tenants should be largely unaffected by the DoS attack? Assuming that their data resides on [nodes that host no data belonging to the tenant under attack], and neglecting how the attack affects the application/web-server-layer and network I/O.

And, in a manner, Cassandra is more resilient against DoS attacks?

(In comparison to e.g. a RDBMS or MongoDB or CouchDB.)

share|improve this question

1 Answer 1

Well if you have multi-tenant app, you need to monitor each tenant service, and in case of fail, redirect him to a working cluster. Basically, what you do in this case, you redirect affected customer to a blackhole, while the rest remains unaffected. For example, if each of your tenants is using different FQDN, you can block affected customer on L7 load balancer you mentioned. In any case, you can make load balancer to detect DoS and block it automatically. Ideally you need to work out the load balancing using geo-graphic regions and DOS detection as well per-tenant monitoring, so all of this at once will give you automation you are looking for. Also the security and user isolation is also here important, that the CPU spike will not affect another tenant.

share|improve this answer
    
Hi Andrew! Thanks for your reply. Yes they'd each use a different FQDN. With "you redirect affected customer to a blackhole", you mean that traffic-to-the-tenant-under-attack would be dropped? –  KajMagnus Jul 10 '12 at 8:25
    
I'd guess it'd take quite long to implement the ideal solution :-) And it'd take very long to verify that it works — I'm hoping that by simply using Cassandra the whole system would be a little bit more stable, without me having to write so much code :-) –  KajMagnus Jul 10 '12 at 8:29
    
(I'm using PostgreSQL right now though. Cassandra wouldn't happen until after many years) –  KajMagnus Jul 10 '12 at 8:30
    
Well to redirect to black hole would be to point to some ip number like 127.0.0.1 or CNAME it to google. Even Cassandra provide availability and scalability, this doesnt guarantee resilience to attacks, so the standard security mechanisms has to be added, like network policy, network intrusion detection, service monitoring, authentication etc etc –  Andrew Smith Jul 11 '12 at 17:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.