Is SOFU prepared for a DDoS attack?

Question

I can't recall any official statement on this topic, and I'm really afraid to lose this valuable resource. Is SO prepared to meet a DDoS attack? It's not like there is an actual occasion, but it would be a relief to hear that you thought of this possibility and took adequate countermeasures.

Answer 1

The rate limiting that has been implemented should fend off a good deal of basic crap. The team is obviously on top of their infrastructure as is evidenced by this post on the new Serverfault Blog. Also others on the Stackoverflow blog. The measures in place already should go a fair distance in preventing a DDoS, and with constant monitoring I would expect that an attack would be quickly noticed and addressed. I would wager that their relationship with the Peer1 would be such that they would get some priority assistance in the case that an attack ensues.

Answer 2

I find it hard to believe that someone that has access to more zombies than SO has concurrent users would have any reason to attack SO, and if they have less, I don't think that it would more than tickle the servers.

Of course, they have their resident sysadmin that can jump in at any time.

Answer 3

Is SO prepared to meet a DDoS attack?

The discipline of Risk Management addresses preparedness.

There are two main constraints of Risk Management: impact and probability.

In order to answer your question, we would gauge the impact of a successful attack and the probability of such an attack occurring.

There are several possible responses to risk; each has its strengths and drawbacks, and the best fit depends upon a variety of factors. In order to "be prepare," (the definition of being prepared) one or more responses would be planned based upon the risk(s).

Responses

• Acceptance

  In this case, the response is to do nothing to prevent the risk from occurring. A plan for dealing with the aftermath might be appropriate. This response is appropriate for low-impact risks or low-impact, low- or medium-probability risks. For example, the risk of an airplane falling on one's house has a low probability. If it does occur, it would be high impact. One would accept the risk because the cost of doing anything else (moving into a cave, erecting an anti-aircraft defense shield) is overkill.

• Transfer

  The risk is transfered to another party. A common form of this response is insurance. The probability of getting into an automobile accident is high enough and the impact is significant enough to merit transferring the risk to the insurance company. Another example would be to outsource a portion of a project to a third party and make them contractually obligated to deliver.

• Avoidance

  This response is to eliminate the risk by removing the condition(s) that could lead to the risk being realized. If I have a risk of my backyard grill's propane tank exploding, I simply throw away the tank and the risk is eliminated.

• Mitigation

  This response is a middle ground between avoidance and acceptance. It reduces the risk's probability and/or impact but does not eliminate the risk. An example of this would be to replace one's 1965 junker with a modern vehicle that had seatbelts, a rollcage, crush zones and airbags in order to mitigate the risk of dying in a car crash.

SO Preparedness

Wikipedia lists "5 types of DDOS", but for purposes of this exercise, we'll address only one (syn flood). Obviously a comprehensive analysis would take all risks in to account, as each would have different impact/probability numbers and responses.

In light of this, is SO prepared?

According to @squillman's answer, the team has taken steps to mitigate (and possibly transfer) the impact of A DDOS. What about the probability? Possible responses:

• Avoidance - is there a way to avoid a DDOS completely? Short of cutting the cord, no. As long as users can get in, a botnet can attempt to connect.

• Transfer - is there a way to transfer the risk, so as to avoid the probability? Unlikely. Setting up a honeypot or having the hosting provider take other countermeasures to hide/mask the location of SO would not be feasible.

• Mitigation - making the site less attractive to griefers/flooders/script kiddies would be a form of this response, but undesirable from a usability standpoint. Employing resources to locate and prosecute perpetrators would not be financially/legally feasible.

• Acceptance - accept that one is going to get attacked, but taking steps to reduce the impact is probably the easiest response in SO's case.

Given the above, there are things the SO team could do to reduce the probability of a DDOS attack (besides my contrived examples). They are prepared. They could be more prepared.