Protecting against DoS attacks – A great read from Qualsys

Slow HTTP attacks are denial-of-service (DoS) attacks in which the attacker sends HTTP requests in pieces slowly, one at a time to a Web server. If an HTTP request is not complete, or if the transfer rate is very low, the server keeps its resources busy waiting for the rest of the data. When the server’s concurrent connection pool reaches its maximum, this creates a DoS. Slow HTTP attacks are easy to execute because they require only minimal resources from the attacker. In this article, I describe several simple steps to protect against slow HTTP attacks and to make the attacks more difficult to execute.Previous articles in the series cover:

• Identifying Slow HTTP Attack Vulnerabilities on Web Application
• New Open-Source Tool for Slow HTTP DoS Attack Vulnerabilities
• Testing Web Servers for Slow HTTP Attacks

———————————————————————————————————————————————————————————————————————-