Quick Security Mitigations to Impending attacks

Question

Suppose you are the sysadmin, and you know of an impending attack that just started or about to start soon. You can either wait it out, or try a few tricks and quick mitigation to fend off attackers and try to reduce the attack vector or damage that could be done.

This is definitely not the right way to securing an environment, but when you have attackers at the gate, it's not the time to argue with staff, but to focus on just fending off all the goblins down the gates, with whatever technical or psychological trick you can come up with.

1. What kind of mitigation steps can I do in such case?

2. Can I quickly Install and configure ModSecurity quickly to protect (to an extent) the web apps?

3. What Hardening IIS/Apache quick configurations can I apply?
4. Any web filtering libraries (like antiXSS) that I can install quickly?

Answer 1

Bit of a wide open question really as steps should be taken at multiple levels to increase the security posture of your environment. This can include hardening operating systems, secure network design, strict firewall rulesets, hardened databases, software developed with a good SDLC and security in mind throughout, etc etc.

That said if you know of an attack or one has just started the simplest way would be to block traffic from the source IP address and look to fixing the actually vulnerability as soon as possible.