I know that one can deny services (DoS) in any of the 7 layers of the OSI model and that in principle, a denial can be done by a single entity (human or machine) or from 2 or more such entities ("distributed" - DDoS).
I also understand that:
- On layers 1,2, a DoS can be done by a single entity without software limitations, as these are purely "concrete" layers.
- On layers 3,4,5,6, a DoS is software-only and is typically distributed (DDoS) because of typical ISPs bandwidth limitations on entities (so one or more entities would typically need 2 or more ISP accounts) even if the hacking is done from one machine that includes 2 or more virtual machines.
- On layer 7, a DoS is software-only and can be either single or distributed easily without bandwith limitations (at least for a few types of attacks), but in any case are easier to manage in comparison to attacks on layers 1,2,3,4,5,6.
Background on cloud hosting services (CHS)
I know that there are basically two types of CHSs used to host web applications:
1. Minimally controlled cloud: The user is provided with an OS, DNS zone management tool, bypass console and some more possible tools while the user adds the rest by itself (examples: DigitalOcean, Linode and so forth).
2. Maximally controlled cloud: Either the user or the company provides the OS, DNS zone management tool, bypass console and some more possible tools while the user adds the rest by itself (examples: Microsoft Azure, Amazon Web Services (AWS), Google Cloud Platform (GCP) and so forth).
The main difference is that the latter allows using the VAD stack (Vagrant, Ansible, Docker) that enables true continuous integration or the closest one can get to it.
- Regarding minimally controlled cloud; on the one hand, you don't have true continuous integration as when the time comes, you'll have to migrate all your data from one OS to another (say, from Ubuntu 18.04 to 20.04) or at least from one webserver to another (say, from Apache 2.4 to 3.4); these operations can be very resource-demanding and frustrating.
- Regarding maximally controlled cloud; on the other hand, on maximally controlled cloud, the VAD stack can result in significantly slower performance and higher pricing.
Background regarding my problem
I generally host a few simple presentational websites with only a contact form and maybe also a paypal donation form; not anything grandiose like some mega ecommerce website with customer financial data but from an SEO standpoint, some of my websites can be in dense competitive fields and I suspect some form of DoS would be likely from an immoral competitor.
Regarding to layers 1 and 2, I understand that any CHS should protect these layers otherwise they won't be able to operate seriously because an immoral competitor of their own destroy these concrete layers of them.
Regarding to layer 7, I already protect from MITMs with TLS, from SSH and content management system BFAs with at least SSHGuard, and from Backdoors and DB injections (like SQL injections) with various policies and methods.
I worry about how to protect layers 3,4,5,6 from DDoS attacks, as both general types of CHSs seems to me not to include any internal protection mechanism from such attacks on these layers
Ways I know to handle it
2. Using shared hosting platforms (such as SiteGround) that either have their own mechanisms to protect from such DoSs, or they themselves utilize Cloudflare "behind the scenes" or at offer their plugin for quickly utilizing its full version (no further pay is needed).
Is there some technology I could use within a CHS to protect my services from being denied in the aforementioned ways?
I wouldn't mind paying say 25$ instead 20$ --- I just desire a technology that I could utilize from within the service, without opening other accounts on third-party providers like Cloudflare or otherwise.