DDoS 방어와 방화벽

Imagine many people calling a small shop at once, trying to order. If too many call, no one can get through, and the shop can't serve real customers.

This is similar to a Distributed Denial of Service (DDoS) attack. It's an attempt to make an online service unavailable by overwhelming it with traffic from multiple sources.

The goal is to exhaust system resources, causing legitimate users to be denied access to the service.

DDoS attacks aren't all the same. They can target different layers of a system:

• Volumetric Attacks: These try to consume all available bandwidth with huge amounts of traffic, like a flood.
• Protocol Attacks: These exploit weaknesses in network protocols (like TCP/IP) to exhaust server resources, often by sending malformed or excessive requests.
• Application Layer Attacks: These target specific web application vulnerabilities, aiming to crash servers or consume application resources with seemingly legitimate but resource-intensive requests (e.g., constantly searching a database).

While advanced attacks need specialized tools, some basic defenses can help:

• Rate Limiting: This restricts the number of requests a user or IP address can make in a given period. It helps prevent a single source from overwhelming your server.
• Ingress Filtering: This technique blocks network packets with spoofed (fake) source IP addresses. It helps prevent attackers from hiding their identity.

These methods are a first line of defense but often insufficient for large-scale attacks.

For robust protection against large DDoS attacks, specialized services are often essential. These services act as a shield:

• They absorb massive amounts of malicious traffic far from your servers.
• They use advanced algorithms to filter out bad requests, allowing only legitimate traffic to reach your application.

Examples include cloud-based DDoS protection services (e.g., AWS Shield, Azure DDoS Protection) and Content Delivery Networks (CDNs) like Cloudflare, which offer built-in DDoS mitigation.

A firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predefined security rules. Think of it as a security guard at the entrance of your network.

• It establishes a barrier between a trusted internal network and untrusted external networks (like the internet).
• Its primary purpose is to prevent unauthorized access and to block malicious traffic.

Firewalls come in different forms:

• Packet-Filtering Firewalls: These examine network packets individually and allow or deny them based on source/destination IP addresses, ports, and protocols. They operate at the network layer.
• Stateful Inspection Firewalls: More advanced, these track the state of active connections. They know if a packet is part of an established, legitimate session.
• Proxy Firewalls: These act as an intermediary between clients and servers, inspecting traffic at the application layer and hiding the internal network structure.
• Host-Based Firewalls: These run on individual servers or devices, protecting them directly rather than the entire network perimeter.

Firewalls operate based on a set of rules. Each rule specifies criteria for traffic and an action (permit or deny).

Common criteria include:

• Source/Destination IP Address: Who is sending or receiving?
• Source/Destination Port: What service is being used (e.g., port 80 for HTTP, 22 for SSH)?
• Protocol: Is it TCP, UDP, ICMP?

Rules are processed in order, and the first matching rule dictates the action. A typical setup denies all traffic by default, only allowing explicitly permitted traffic.

A Web Application Firewall (WAF) is a specific type of firewall designed to protect web applications from common web-based attacks.

• Unlike traditional network firewalls, WAFs understand HTTP/HTTPS traffic in depth.
• They can detect and block attacks like SQL injection, cross-site scripting (XSS), and other OWASP Top 10 vulnerabilities.

WAFs sit in front of web servers, inspecting incoming requests and outgoing responses to filter out malicious patterns.

Firewalls are crucial components in a layered security approach. They can be placed at various points:

• Perimeter Firewalls: Protecting the entire network boundary from the internet.
• Internal Firewalls: Segmenting different parts of an internal network (e.g., separating a database server from a web server) to limit lateral movement of attackers.
• Cloud-Native Firewalls: Managed services provided by cloud providers, integrated with virtual networks and security groups.

A strong security posture often involves multiple firewalls at different points.

Let's test your understanding of system protection. Consider the various tools and strategies discussed.

In this lesson, we explored crucial aspects of system security: DDoS protection and firewalls.

• We learned that DDoS attacks aim to overwhelm systems, coming in volumetric, protocol, and application-layer forms.
• Basic defenses like rate limiting and ingress filtering help, but specialized DDoS mitigation services are vital for large attacks.
• Firewalls act as security guards, filtering traffic based on rules, with different types (packet-filtering, stateful, WAFs) offering varying levels of protection.

Understanding and implementing these protections are fundamental to building resilient and secure systems.