Blog

Providers of Anti-DDoS services often offer to connect protection using the asymmetric scheme: only incoming traffic is filtered — the one that goes to the protected resources, and outgoing traffic is not considered at all. In a number of other situations, they use a symmetrical scheme when not only incoming, but also outgoing traffic or service information about it is analyzed.

Mistakes in the organization of protection against the risks associated with DDoS attacks almost always lead to a reduction in the resilience of their Internet resources to these risks, and it is impossible to compensate for them solely by connecting anti-DDoS services, even when they are most advanced. The situation is often aggravated by the fact that the combination of several flaws increases their overall negative impact. In this article, we will analyze some of these flaws we encountered while building protection against DDoS risks at a rather large client managing several hundred websites.

It often happens that customers of DDoS protection services believe that just by connecting to these services they are fully protected. Unfortunately, it is not quite right: DDoS protection is not magic or a superpower, and in order for it to work effectively, the services themselves must have sufficient immunity against DDoS risks.

In this article we will discuss how to achieve security of websites and server components of browsers, mobile applications and services that interact with HTTP/HTTPS-based protocols via APIs.

We provide a brief guide that will help to improve the effectiveness of protecting networks and autonomous systems from DDoS attacks. It lists the aspects that should be taken into account.