Control Strategy FilterDosAtInterface

URI: CSG-FilterDosAtInterface

Package: NetworkConnectivity

< prev | next >

Description: Filter DDoS messages to a target in the core network. This normally has to be arranged through the Internet connection service provider, so it is modelled by assigning the corresponding control to the final interface to the Internet.

Blocked Threats (4)

I.M.I.8

Message traffic from LogicalSubnet via Host is unconstrained: if the interface between Host and LogicalSubnet is in service, then traffic that is not blocked will not be subject to any bandwidth limits unless controls are used to impose such limits.

I.O.DDoH.3

Remote DDoS attack from AttackerSubnet on Host connection to LogicalSubnet: an attacker able to orchestrate clients on subnet AttackerSubnet arranges for them to send too many messages to the network address of the target device Host on LogicalSubnet.

I.O.HIoH.3.2

Remote DDoS attack from LogicalSubnet on Host: an attacker able to orchestrate clients on subnet LogicalSubnet arranges for them to send too many messages to the network address of the connected target device Host.

P.O.DDoS.3

Distributed DoS attack on service Process from subnet LogicalSubnet: an attacker with control over multiple vulnerable systems connected to LogicalSubnet can use them to send excessive messages via a privileged network paths through firewalls and overload service Process. The best defence is to arrange with your ISP to manage and restrict the traffic sent from the Internet (check threat causes for an unrestricted network interface).