0

I'm looking into Web App security and this question occurred to me: What could be some possible effects of internet speed on Web app security?

I'm thinking of low latency, low bandwidth connections preventing or slowing the effective upload of payloads to compromise a site and things like that. I know increasing the security of the site can affect the speed a little but what of the inverse, whether positive or negative?

Third world countries typically use less malware protection but also have the advanced world's yesterdays internet speeds. I'm thinking this will limit the use of these hosts for attack, say in a botnet or DDOS.

|improve this question

closed as too broad by Marcus Müller, ThoriumBR, grochmal, Anders, S.L. Barth - Reinstate Monica Jan 19 '17 at 8:46

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    this is way too broad. "how could making my car more secure affect its speed" is about the same question clarity. this is impossible to answer without knowing what you're doing now, on what hardware, constrained by what... and "Web app security" is a buzzword, not a specific technology. – Marcus Müller Jan 18 '17 at 18:32
3

Most malicious payloads that you could upload to compromise a website aren't much larger than a typical webpage. So no, intentionally giving the webserver a very slow connection won't be very effective in preventing it from getting compromised.

I wouldn't say it's completely useless though:

  • If the attacker tries to brute-force account passwords on the site, the server's slow connection could slow them down. BUT there are way more effective ways to accomplish rate-limiting, that don't make your site highly susceptible to a denial-of-service attack.
  • If the attacker tries to exfiltrate user data from an already-compromised server, a slow connection would make it take longer and increase the chance that you will notice it.

However, the slight security benefits you get are more than outweighted by the massive increase in susceptibility to denial-of-service attacks (or even periods of higher-than-normal traffic volume), and the negative impact on user experience. A per-user bandwidth limit might make sense, but intentionally giving a webserver an extremely slow connection is NOT a sensible security mechanism.

|improve this answer
  • Higher bandwidth means more chance of a DDoS too – schroeder♦ Jan 18 '17 at 20:02
0

It depends: Fail open or closed?

Security mechanisms that fail open are vulnerable to performance issues, as it could cause certain countermeasures to be bypassed. For example, if there is poor performance between a TLS client and a CRL server, the TLS client may give up on the CRL and allow a blacklisted certificate to be used.

For this reason, most security mechanisms are designed to fail closed, in which case poor performance may affect usability but will not affect security (if it is designed and configured correctly).

|improve this answer
0

"Web app security" typically means how the application is coded, and not the other infrastructure-type considerations. Speed tends to be an infrastructure consideration.

So, constraining the scope to the ability to process code, it is unlikely that an Internet connection will exceed a processor's ability to handle data. Slow speeds are not going to have an effect either, unless you coded while making assumptions about the speed of the incoming data (which would be an odd thing to do, but was done a couple decades ago).

|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.