中文
devexamples
← Workflows

阅读中文版本

DDoS Readiness Workflow

Establish absorption and rate-limit capacity, configure scrubbing and caching in front, rehearse a response, and agree on thresholds and communication before an attack.

advanced~180 minsecurityresilienceoperations

Objective

Prepare the system and the team to absorb and mitigate a volumetric or application-layer attack.

Environment

  • An upstream provider with scrubbing or protection
  • A runbook and on-call contact tree

Steps

1. Measure current capacity and the protection

Measure current capacity and the protection provider limits.

Expected state: You know the absorption ceiling.

2. Configure caching, rate limits, and any

Configure caching, rate limits, and any scrubbing in front of the origin.

Expected state: Attack traffic is filtered before the origin.

3. Rehearse the response with a load

Rehearse the response with a load or attack simulation.

Expected state: The team has practiced under pressure.

4. Agree on escalation thresholds and customer

Agree on escalation thresholds and customer communication templates.

Expected state: Response is fast and consistent.

Decision points

Absorb or shed traffic?

  • Absorb then shed selectively
  • Shed all non-essential

Absorb legitimate traffic and shed only attack patterns; blanket shedding breaks real users.

Notify customers early or after?

  • On threshold breach
  • After mitigation

Notify on breach with a holding statement; late communication amplifies reputational damage.

Expected outcome

A documented absorption ceiling, filtering in front of the origin, a rehearsed response, and pre-agreed communication.

Verification

Confirm the simulation showed origin traffic stayed within capacity and that the on-call team executed the runbook steps within the target time.

Cleanup

Record simulation results and update the runbook and contact tree.

Overview

Prepare the system and the team to absorb and mitigate a volumetric or application-layer attack. Confirm the simulation showed origin traffic stayed within capacity and that the on-call team executed the runbook steps within the target time.

Steps

  1. Measure current capacity and the protection provider limits. Expected state: You know the absorption ceiling.
  2. Configure caching, rate limits, and any scrubbing in front of the origin. Expected state: Attack traffic is filtered before the origin.
  3. Rehearse the response with a load or attack simulation. Expected state: The team has practiced under pressure.
  4. Agree on escalation thresholds and customer communication templates. Expected state: Response is fast and consistent.
# simulate with a bounded load test against a canary
k6 run --vus 50 --duration 2m attack-sim.js
# watch origin 5xx and connection counts, not only edge status

Verification

  • A documented absorption ceiling, filtering in front of the origin, a rehearsed response, and pre-agreed communication.

Decision points

  • Absorb or shed traffic? Options: Absorb then shed selectively; Shed all non-essential. Recommended: Absorb legitimate traffic and shed only attack patterns; blanket shedding breaks real users.
  • Notify customers early or after? Options: On threshold breach; After mitigation. Recommended: Notify on breach with a holding statement; late communication amplifies reputational damage.