A denial-of-service (DoS) attack attempts to make a service unavailable to legitimate users. It may exhaust processing, storage, network, or other resources with a few carefully crafted requests or with overwhelming traffic. section 9.3
A distributed denial-of-service (DDoS) attack launches requests from multiple origins or nodes. The resulting outage can also become a financial failure when unlimited cloud scaling turns malicious traffic into an unaffordable bill. section 5.1 section 9.3
An unbounded products request
Suppose GET /products lets a client request any number of products. An attacker can request millions of items in one call, exhausting application resources without sending millions of separate requests. A different attack may send millions of HTTP requests or target lower networking layers with ICMP, SYN, UDP, DNS amplification, or IP fragmentation floods. section 9.3
Figure 5.1 Unrestricted resource consumption happens when threat actors get unfettered access to our servers. In this example, a threat actor launches a DDoS attack from three servers.
Use the diagram to visualize how concurrent requests from several servers can consume shared API resources and bring services down. section 5.1
Reduce the attack surface and limit the consequences:
- Bound resource-intensive API inputs, including the number of records returned by an endpoint; pagination is specifically identified as a design control. section 1.1 section 9.3
- Protect infrastructure with restrictive firewalls, secure network topology, load balancers, API gateways, and web application firewalls. section 1.2.3
- Threat-model system unavailability alongside other risks, then review and validate the selected mitigations. section 2.7
- Treat infrastructure controls as layers rather than a complete solution: attacks can target application behavior or OSI layers 3–6. section 9.0 section 9.3
