I know that one can deny services (DoS) in any of the 7 layers of the OSI model and that in principle, a denial can be done by a single entity (human or machine) or from 2 or more such entities ("distributed" - DDoS).
I also understand that:
- On layers 1 and 2 a DoS can be done by a single entity without software limitations, as these are purely "concrete" layers.
- On layers 3,4,5 and 6, a DoS is software-only and is typically distributed (DDoS) because of typical ISPs bandwidth limitations on entities (so one or more entities would typically need 2 or more ISP accounts) even if the hacking is done from one machine.
- On layer 7, a DoS is software-only and can be either single or distributed easily without bandwith limitations (at least for a few types of attacks), but in any case are easier to manage in comparison to attacks on layers 1,2,3,4,5,6.
Background on cloud hosting services (CHS)
I know that there are basically two types of CHSs used to host web applications:
1. Minimally controlled cloud: The user is provided with an OS, DNS zone management tool, bypass console and some more possible tools while the user adds the rest by itself (examples: DigitalOcean, Linode and so forth).
2. Maximally controlled cloud: Either the user or the company provides the OS, DNS zone management tool, bypass console and some more possible tools while the user adds the rest by itself (examples: Microsoft Azure, Amazon Web Services (AWS), Google Cloud Platform (GCP) and so forth).
The main difference is that the latter allows using the VAD stack (Vagrant, Ansible, Docker) that enables true continuous integration or the closest one can get to it.
On the one hand, in minimally controlled cloud you don't have true continuous integration as when the time comes, you'll have to migrate all your data from one OS to another (say, from Ubuntu 18.04 to 20.04) or at least from one webserver to another (say, from Apache 2.4 to 3.4); these operations can be very resource-demanding and annoying. On the other hand, on maximally controlled cloud, the VAD stack can result in significantly slower performance and higher pricing.
Background regarding my problem
I generally host a few presentational websites with a simple contact form and maybe also a donation form (with PayPal as proxy) - not anything grandiose like some mega ecommerce website with customer financial data, but some of my websites can be in dense competitive fields (like SEO) or at least grow to include more services and in such cases I suspect some form of DoS would be likely from an immoral competitor.
Regarding to layers 1 and 2, I understand that any CHS should protect these layers otherwise they won't be able to operate if an immoral competitor destroys these concrete layers. Regarding to layer 7, I already protect from MITMs with TLS, from SSH and content management system BFAs with at least SSHGuard, and from Backdoors and DB injections (like SQL injections) with various policies and methods.
I can pay up to 20$ (USD) for a CHS but I still need protection from DoS of layers 3,4,5,6 as well, by some technology from within the CHS as (most preferably, as a sub-service of the CHS itself).
As I understand, both the above types of CHSs equally lacks plausible protection from DoS attacks on the aforementioned layers of the OSI model.
The ways I know to handle it
2. Using shared hosting platforms (like SiteGround) that either have their own mechanisms to protect from such DoSs, or they themselves utilize Cloudflare "behind the scenes" or at offer their plugin for quickly utilizing it.
Is there some technology I could use within some CHS to protect my services from being denied in the aforementioned ways?
I wouldn't mind paying say 25$ instead 20$ --- I just desire a technology that I could utilize from within the service, without opening other accounts on third-party providers like Cloudflare or otherwise (I hate opening accounts on SaaS companies in general).