September 2020 Summaries

This article explores the complexities of Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS) attacks, emphasizing the importance of understanding and mitigating these security risks. It highlights the potential devastating impact of DoS attacks, which can overwhelm servers and disrupt services, leading to financial and reputational losses. The article discusses different types of DoS vulnerabilities, categorizing them into high, medium, and low-risk classes based on the concept of attacker leverage, which evaluates how much effort an attacker needs to cause significant damage. High-leverage vulnerabilities, such as unauthenticated resource starvation attacks, should be prioritized for mitigation, while medium-leverage risks might be addressed with techniques like rate limiting. In contrast, large-scale DDoS attacks are often best managed at the network level with services like Cloudflare, given their complexity and the resources required to counter them. The article provides guidance on evaluating risk and implementing appropriate security measures, urging a balanced approach that considers the specific context and threat level each vulnerability presents.

A recent meetup focused on writing Semgrep rules for improving security, correctness, and performance, took place on August 26th. For those unable to attend, a video recording of the event is available. The presentation also includes examples that are accessible via embedded links in the slides, which can be downloaded for further reference.