Improving Web Application Security: Threats and - CGISecurity

756 Improving Web Application Security: Threats and CountermeasuresContentsThis How To is divided into sections that address specific types of denial of serviceprotections that apply to the network. Those sections are:● Protect Against SYN Attack● Protect Against ICMP Attacks● Protect Against SNMP Attacks● AFD.SYS Protections● Additional Protections● Pitfalls● Additional ResourcesProtect Against SYN AttacksA SYN attack exploits a vulnerability in the TCP/IP connection establishmentmechanism. To mount a SYN flood attack, an attacker uses a program to send a floodof TCP SYN requests to fill the pending connection queue on the server. This preventsother users from establishing network connections.To protect the network against SYN attacks, follow these generalized steps, explainedlater in this document:● Enable SYN attack protection● Set SYN protection thresholds● Set additional protectionsEnable SYN Attack ProtectionThe named value to enable SYN attack protection is located beneath the registry key:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services.Value name: SynAttackProtectRecommended value: 2Valid values: 0–2Description: Causes TCP to adjust retransmission of SYN-ACKS. When you configurethis value the connection responses timeout more quickly in the event of a SYNattack. A SYN attack is triggered when the values of TcpMaxHalfOpen orTcpMaxHalfOpenRetried are exceeded.