DDoS and Incident Response

Question 1

What are amplification / reflection attacks?

Answer 1

Spoof an IP, send a 3rd party (eg. NTP server) a request. It responsds with 50x larger response to spoofed IP. Can be coordinated to send multiple requests = 50x multiplication

Question 2

What is Slowloris DDoS

Answer 2

Opens multiple connections and sends partial HTTP requests so it never gets fulfilled and server runs out of max concurrent connections it can handle - does not get caught by regular rate control rules

Question 3

What does Shield Advanced do?

Answer 3

Flow-based monitoring of network traffic and applications at L7

Question 4

What to do if EC2 is hacked?

Answer 4

Stop it
Take EBS snapshot
Terminate it
Create new instance in new VPC in private subnet
Inspect logs

Question 5

What if key is exposed on Github?

Answer 5

1. Deactivate it
2. Delete it from IAM users