THREATNOIR
Subscribe
NIST SP 800-53 Rev. 5 · SC-5

Denial-of-service Protection

US National Institute of Standards and Technology (NIST) · cited in 21 of our lessons

Explanation

What it asks for. The organisation must protect against, or limit the effects of, defined types of denial-of-service events, using defined controls.

In practice. This means upstream DDoS protection from an ISP or cloud provider, content delivery networks for public web services, rate limiting on APIs and capacity planning for critical services. Auditors look for DDoS service contracts, configuration of protections, and runbooks for handling attacks. Testing the response with the provider is good practice. Monitoring should give early warning of traffic surges, and critical services should not share a single exposed link.

Common gaps. Organisations often protect the main website but not APIs, DNS or VPN gateways. Response procedures with the protection provider are rarely tested. Applications can also be vulnerable to resource exhaustion attacks that network protections do not catch.

Open SP 800-53 at NIST
The official text
a. [Selection: protect against; limit] the effects of the following types of denial-of-service events: [Assignment: organization-defined types of denial-of-service events] ; and b. Employ the following controls to achieve the denial-of-service objective: [Assignment: organization-defined controls by type of denial-of-service event]. Discussion: Denial-of-service events may occur due to a variety of internal and external causes, such as an attack by an adversary or a lack of planning to support organizational needs with respect to capacity and bandwidth. Such attacks can occur across a wide range of network protocols (e.g., IPv4, IPv6). A variety of technologies are available to limit or eliminate the origination and effects of denial-of-service events. For example, boundary protection devices can filter certain types of packets to protect system components on internal networks from being directly affected by or the source of denial-of-service attacks. Employing increased network capacity and bandwidth combined with service redundancy also reduces the susceptibility to denial-of-service events.

From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.

Lessons that cite it

Real incidents where this item mattered: the latest 12 of 21.