Case Study: Defending a Web Server
Imagine you run a traditional web server. Your customers are paying you to make sure their websites are always available on the Internet, which typically entails providing:
- Reliable Internet access. You typically need a fast and reliable Internet connection, capable of handling large volumes of data, hooked up to your server. Most data centers will also have a backup, in case one line goes down for maintenance or other causes.
- Sufficient system resources. Modern web pages require a surprising amount of server resources to power not only the web and databases, but also the operating system, firewall and other software.
Users visit websites irregularly, consuming varying amounts of data bandwidth and typically a proportionate share of system resources – more traffic generally means higher power consumption. Sometimes a promotion of one or several sites causes a significant traffic spike, which may slow down those sites, or even the entire server. Cyber attackers often simulate such traffic spikes using infected devices, with the goal of running the server, network, or both out of resources and making the service inaccessible. Such an attack is called DDoS, or Distributed Denial of Service.
Unicast DDoS Defense
What do you do, when attackers aim to congest your unicast service?
- More system resources. The first response to a server being slow and running out of resources, is typically allocating more resources. This may help keep the websites running, but typically significantly raises the cost. If your system doesn’t allow you to adjust resources dynamically, you also end up with a lot of idle power once the attack subsides.
- DDoS Filters or Proxy Server. When attacks become commonplace, a DDoS filter system placed in front of the actual web server may seem like a promising solution. However, if the number of DDoS requests congests the Internet connection itself, legitimate requests don’t even reach the filter, much less the server itself.
In our experience, once a strong enough attack gathers from various sources worldwide, no unicast service can withstand it effectively.
Anycast DDoS Defense
Anycast addresses two of Unicast’s main weaknesses:
- Attack Intensity. DDoS attacks typically rely on gathering a strong force of compromised devices from all over the world. This makes the traffic hard to distinguish, until it’s too late, but it also allows Anycast servers to disrupt the attack before the units converge and overwhelm the target Unicast server with sheer request volume.
- Server Downtime. If an Anycast server is down for any reason, clients typically can’t tell at all – they are simply diverted to other available Anycast servers in the same network.
Does that mean your web hosting should run on an Anycast network? The answer is no, such a solution is too expensive for most websites.
Unicast Web Server, Anycast Defense
A common and effective web server security solution is using Unicast for the web server itself, and an Anycast network as a proxy positioned between the web server and the rest of the Internet. This arrangement has the following benefits:
- Anycast cyber attack resiliency. Anycast security systems make sure that any DDoS and other malicious traffic is filtered out as close to its source as possible. As a highly specialized solution, it can serve a large number of users – enough to make it affordable even to small website owners.
- Unicast price and predictability. The problems with a Unicast solution only arose when a high volume of DDoS attacks made it all the way to the server. As long as those are not a threat, you can enjoy the benefits of Unicast web hosting, especially the simplicity and low price.
This is how the WEDOS.protection service works and the driving force behind WEDOS.global. Since its inception, the service offering has expanded to include WEDOS.zone (DNS Anycast) with more services in the works.