Sybex CEH Certified Ethical Hacker Version 8 Study Guide

276 Chapter 11 ■ Denial of Service
DoS Defensive Strategies
Let’s look at some DoS defensive strategies:
Disabling Unnecessary Services You can help protect against DoS and DDoS attacks by
hardening individual systems and by implementing network measures that protect against
such attacks.
Using Anti-Malware Real-time virus protection can help prevent bot installations by
reducing Trojan infections with bot payloads. This has the effect of stopping the creation of
bots for use in a botnet. Though not a defense against an actual attack, it can be a proactive
measure.
Enabling Router Throttling DoS attacks that rely on traffic saturation of the network can
be thwarted, or at least slowed down, by enabling router throttling on your gateway router.
This establishes an automatic control on the impact that a potential DoS attack can inflict,
and it provides a time buffer for network administrators to respond appropriately.
Using a Reverse Proxy A reverse proxy is the opposite of a forward or standard proxy.
The destination resource rather than the requestor enacts traffic redirection. For example,
when a request is made to a web server, the requesting traffic is redirected to the reverse
proxy before it is forwarded to the actual server. The benefit of sending all traffic to a middleman
is that the middleman can take protective action if an attack occurs.
Enabling Ingress and Egress Filtering Ingress filtering prevents DoS and DDoS attacks by
filtering for items such as spoofed IP addresses coming in from an outside source. In other
words, if traffic coming in from the public side of your connection has a source address
matching your internal IP scheme, then you know it’s a spoofed address. Egress filtering
helps prevent DDoS attacks by filtering outbound traffic that may prevent malicious traffic
from getting back to the attacking party.