New answers tagged denial-of-service
The most easiest way to determine the impact of the DOS/DDOS attack would be to try and access one of the legitimate services hosted on the server under attack, if the server does not respond to the service request then it would be due the DOS/DDOS. But the above test can be done only for services that we know are publicly hosted on the target.
Recent attacks seem to have been aiming to get media coverage of outages - see things like the December 2014 Lizard Squad attacks on Xbox Live and PSN, or the November 2015 Armada Collective attacks. Throw enough traffic at a high profile target (social network, gaming service, news service) and sooner or later you'll get media reports about it. Beyond ...
The answer to this comes down to a risk-management decision that the organization makes. There are best practices, but even the bestest of practices can be compromised by risk-management decisions. There are no absolutes, even patch broken stuff is not an absolute. You had a clue in their response: compensating controls This phrase is used to justify ...
Personally, I use fail2ban to stop bruce force logins. Brute force tools tend not to open many parallel connections. As for brute forcing HTTP logins, your connection limiting rules will depend on how many parallel connections your web applications requires. If you set it too short, your legitimate users won't be able to use your service.
Top 50 recent answers are included