# Network Security

**Type of attacks on infrastructure**

* Distributed Denial of Service (DDoS) - When your service is unavailable because it's receiving too many requests.
  * SYN Flood (Layer 4): Send too many TCP connection requests.
  * UDP Reflection (Layer 4): Get other servers to send many big UDP requests.
  * DNS Flood: overwhelm the DNS server so the legitimate users cannot find the site.
  * Slow Loris attack: A lot of HTTP connections are opened and maintained.

**Application level attacks**

* More complex, more specific (HTTP level)
* Cache bursting strategies: Overload the backend database by invalidating cache.

**Protection on AWS**

* AWS Shield Standard:
  * Free service for every AWS customer.
  * Protects agains attacks such as SYN / UDP Flood, Reflection and other Layer 3, 4  attacks.
* AWS Shield Advanced: 
  * Optional DDoS mitigation service ($3,000 per month per organization).
  * **Provide notification.**
  * Protect against more sophisticated attack on EC2, ELB, CloudFront, Global Accelerator, Route53.
  * 24/7 access to AWS DDoS response team (DRP)
  * Protect against higher fees during usage spikes due to DDoS. 
* AWS WAF: 
  * Filter specific requests based on rules (layer 7).
  * Define Web ACL
    * Rules can include: IP, HTTP Header, HTTP Body, or URI strings.
    * Protects from: SQL Injection, Cross-site Scripting (XSS)
    * Size constraints, Geo match.
    * Rate-based rules.
  * Deployable on 
    * ALB (localized rules).
    * API Gateway (rules running at the regional or edge level).
    * CloudFront (rules globally on edge locations)
* AWS Firewall Manager
  * Manages rules **in all accounts of an AWS Organization**.
  * Common set of security rules.
  * WAF rules (ALB, API Gateway, CloudFront)
  * AWS Shiled Advanced (ELB, Elastic IP, CloudFront)
  * Security Groups for EC2 and ENI resources in VPC.
* CloudFront and Route53:
  * Availability protection using global edge network.
  * Combined with AWS Shield, provides DDoS attack mitigation at the edge.
* Be ready to scale: leverage AWS Auto Scaling.
* Separate static resouces (S3 / CloudFront) from dynamic ones (EC2 / ALB).

**Inspection Tools**

* AWS Inspector
  * Vulnerability analysis for unintended network accessibility of your running EC2 instances. (not an AMI scan)
  * AWS Inspector Agent must be installed on OS in EC2 instances for analysis.
  * Define template (rules package, duration, attributes, SNS topics).
  * No custom rules support yet (only AWS managed rules).
  * After the assessment, you get a report with a list of vulnerabilities.