[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fsc-5":3},{"item":4,"lessons":18,"controls":68,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","sc-5","SC-5","Denial-of-service Protection",21,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The organisation must protect against, or limit the effects of, defined types of denial-of-service events, using defined controls.\n\n**In practice.** This means upstream DDoS protection from an ISP or cloud provider, content delivery networks for public web services, rate limiting on APIs and capacity planning for critical services. Auditors look for DDoS service contracts, configuration of protections, and runbooks for handling attacks. Testing the response with the provider is good practice. Monitoring should give early warning of traffic surges, and critical services should not share a single exposed link.\n\n**Common gaps.** Organisations often protect the main website but not APIs, DNS or VPN gateways. Response procedures with the protection provider are rarely tested. Applications can also be vulnerable to resource exhaustion attacks that network protections do not catch.","a. [Selection: protect against; limit] the effects of the following types of denial-of-service events: [Assignment: organization-defined types of denial-of-service events] ; and\n  b. Employ the following controls to achieve the denial-of-service objective: [Assignment: organization-defined controls by type of denial-of-service event].\nDiscussion: Denial-of-service events may occur due to a variety of internal and external causes, such as an attack by an adversary or a lack of planning to support organizational needs with respect to capacity and bandwidth. Such attacks can occur across a wide range of network protocols (e.g., IPv4, IPv6). A variety of technologies are available to limit or eliminate the origination and effects of denial-of-service events. For example, boundary protection devices can filter certain types of packets to protect system components on internal networks from being directly affected by or the source of denial-of-service attacks. Employing increased network capacity and bandwidth combined with service redundancy also reduces the susceptibility to denial-of-service events.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"rogue-ai-agents-exploit-open-tools-as-proxies-causing-service-outage","Rogue AI Agents Exploit Open Tools as Proxies, Causing Service Outage","2026-10-07T08:20:19.706+00:00",{"slug":25,"title":26,"published_at":27},"openai-agents-attempt-to-exploit-wikimedia-infrastructure-via-automated-abuse","OpenAI Agents Attempt to Exploit Wikimedia Infrastructure via Automated Abuse","2026-10-06T12:21:34.54+00:00",{"slug":29,"title":30,"published_at":31},"citrix-netscaler-zero-day-actively-exploited-saml-deployments-at-risk","Citrix NetScaler Zero-Day Actively Exploited, SAML Deployments at Risk","2026-10-05T08:20:37.821+00:00",{"slug":33,"title":34,"published_at":35},"ai-agents-probe-government-sites-with-sql-injection-attacks","AI Agents Probe Government Sites with SQL Injection Attacks","2026-10-02T10:21:06.523+00:00",{"slug":37,"title":38,"published_at":39},"zero-day-poc-blocks-defender-updates-via-disk-exhaustion","Zero-Day PoC Blocks Defender Updates via Disk Exhaustion","2026-09-22T18:22:14.291+00:00",{"slug":41,"title":42,"published_at":43},"ddos-for-hire-service-taken-down-in-global-law-enforcement-operation","DDoS-for-Hire Service Taken Down in Global Law Enforcement Operation","2026-09-18T12:21:18.895+00:00",{"slug":45,"title":46,"published_at":47},"china-linked-ai-firms-systematically-extracting-us-ai-model-knowledge-at-scale","China-Linked AI Firms Systematically Extracting U.S. AI Model Knowledge at Scale","2026-09-08T21:20:25.684+00:00",{"slug":49,"title":50,"published_at":51},"bgp-hijack-poisons-software-update-channel-to-deploy-persistent-rootkit","BGP Hijack Poisons Software Update Channel to Deploy Persistent Rootkit","2026-09-02T15:20:23.344+00:00",{"slug":53,"title":54,"published_at":55},"pro-russian-group-launches-3-day-dos-attack-on-norwegian-government-services","Pro-Russian Group Launches 3-Day DoS Attack on Norwegian Government Services","2026-08-27T10:21:48.097+00:00",{"slug":57,"title":58,"published_at":59},"ddos-attack-disrupts-norways-government-digital-services","DDoS Attack Disrupts Norway's Government Digital Services","2026-08-25T16:20:24.163+00:00",{"slug":61,"title":62,"published_at":63},"http3-to-http11-translation-flaw-enables-350x-dos-amplification-via-cdns","HTTP\u002F3-to-HTTP\u002F1.1 Translation Flaw Enables 350x DoS Amplification via CDNs","2026-08-20T14:22:48.761+00:00",{"slug":65,"title":66,"published_at":67},"natjack-exploits-nat-flaws-to-hijack-tcp-sessions-and-spoof-dns","NatJack Exploits NAT Flaws to Hijack TCP Sessions and Spoof DNS","2026-08-07T10:20:54.04+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"patch-management","Automated patch management","Known holes get closed in days, not months.",10,{"slug":75,"name":76,"problem":77,"stories":78},"waf-ddos","Web application firewall and DDoS protection","Websites and APIs stay up, and common web attacks are filtered before they reach them.",8,{"slug":80,"name":81,"problem":82,"stories":83},"firewall","Next-generation firewall and intrusion prevention","Malicious traffic is blocked at the network edge and between zones.",6,{"slug":85,"name":86,"problem":87,"stories":88},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",5,{"slug":90,"name":91,"problem":92,"stories":93},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",4,{"slug":95,"name":96,"problem":97,"stories":93},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[99,105,110,114,118,123,127,132],{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","7","Control 7","Continuous Vulnerability Management",12,{"family":100,"item":106,"code":107,"title":108,"together":109},"12","Control 12","Network Infrastructure Management",11,{"family":100,"item":111,"code":112,"title":113,"together":109},"13","Control 13","Network Monitoring and Defense",{"family":115,"item":116,"code":117,"title":117,"together":109},"itil","overview","ITIL",{"family":5,"item":119,"code":120,"title":121,"together":122},"au-6","AU-6","Audit Record Review, Analysis, and Reporting",7,{"family":5,"item":124,"code":125,"title":126,"together":122},"si-2","SI-2","Flaw Remediation",{"family":128,"item":129,"code":130,"title":131,"together":83},"gdpr","32","Article 32","Security of processing",{"family":100,"item":133,"code":134,"title":135,"together":93},"4","Control 4","Secure Configuration of Enterprise Assets and Software"]