Reference no: EM133310328
Respond to the In 2020 AWS disclosed that AWS Shield mitigated one of the most significant DDoS attacks on record (Cimpanu, 2020). The attack was reported at data transfer speeds of 2.3 Tbps, a 70% increase over the previous DDoS on record (Nicholson, 2020). This high traffic rate was generated by abusing a CLDAP (Connection-less Lightweight Directory Access Protocol) (Cimpanu, 2020). Paul Nicholson reports that CLDAP is a DDoS reflection attack that incorporates amplification to reach high data volumes.
What is the alert that is coming in and from what device(s), tool(s), or software? What is it indicating?
Performance monitoring devices will alert a SOC analyst of a DDoS attack. System and network performance would be dramatically affected by a 2.3 Tbps attack.
What actions will you take and what tools will you use to determine if the alert is real or a false alarm?
The alert can be confirmed as legitimate by viewing the metrics produced by AWS CloudWatch and their Web Application Firewall (WAF). AWS Shield alerts are derived from AWS CloudWatch by monitoring deviations from established traffic baselines (Yun, 2021).
What tool(s) are you using from chapters 2 through 12 in your process?
Tools that can confirm if the DDoS alert is real, besides AWS CloudWatch, are SIEM/IDS/IPS/Firewall solutions. Performance monitoring can show SOC analysts that high traffic rates are bogging down the network. PRTG is a popular network monitoring tool that can quickly assess a DDoS attack.
What framework(s) are you using from chapters 2 through 12 in your process?
NIST 800-61 can be used to respond to DDoS incidents. When AWS Shield and CloudWatch are configured, preparation is conducted to detect network abnormalities. These services can identify, contain, and eradicate attacks in real-time.
What data are you collecting during your initial stages, where are you recording it, and why?
AWS network data is collected by using CloudWatch. CloudWatch collects metrics and logs from various sources (AWS, n.d.). These logs and metrics are monitored to provide alerts to AWS Shield. Automated responses are initiated based on detected abnormal network activity.
Are they taking the correct steps in the process of determining where an alert is coming from and using the right tools? Why or why not?
Are they proceeding correctly/effectively in determining if it is a false alarm or a real threat? Why or why not?
Are they using the correct tool(s) and framework(s)?
Why or why not? Which one(s) would you recommend?
Are they collecting the data that should be collected and recording it in the right places? Why or why not?
Based on the above questions, what would you recommend instead for any of these - steps, methods, frameworks, etc. and why?