D/DoS mitigation hardware/software needed.
Dobbins, Roland
rdobbins at arbor.net
Sun Jan 10 03:56:51 UTC 2010
On Jan 10, 2010, at 10:33 AM, Christopher Morrow wrote:
> separate the portions of the pie... only let the attack break the minimal portion of your deployment. Use the right tool in the right place.
An excellent point. A Web front-end server should be that - merely the front-end. Situationally-appropriate functional separation is a key architectural principle.
Combine that with the measures outlined in <http://mailman.nanog.org/pipermail/nanog/2010-January/016747.html>, coupled with a functionally-separated, bulkheaded DNS infrastructure pictured in <http://files.me.com/roland.dobbins/m4g34u>, and one will end up with a much more robust, scalable, and defensible system.
-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>
Injustice is relatively easy to bear; what stings is justice.
-- H.L. Mencken
More information about the NANOG
mailing list