3

I am developing a system, a main key of which should be security. So i have to consider the weakest places, where it might be broken. Probably, the first ones are brut force and DDOS attacks. I've read a lot of 'best practices' to fight them, and first thing I want to do is to enable some kind of dynamic IP restriction. I thought that such kind of problem is very popular, and that IIS (I am using IIS 7) would have some built-in functionality of blocking malicious request at kernel level, so it would be much faster than writing my own asp.ent modules, or WCF extensions (I am using WCF service as an extra security layer).

The best thing i found was IIS 7 add-on 'dynamic ip restriction"(http://learn.iis.net/page.aspx/548/using-dynamic-ip-restrictions/?FeaturePage=4FA9C136-25BD-4833-853A-99EAAD0754D2), but there is a very annoying missing part of functionality - I can't set the time of ban of IP address, and I don't even know it. I read on internet that on previous version it was enabled, I wonder why they turned it off in new release...

Anyway, maybe someone knows a good solution for this? I would consider an option of writing my own kernel-level module (I'm not sure if in IIS7 integrated mode asp.net managed modules are IIS kernel modules, and what is their lifecycle), but with a possibility to manage it's settings from IIS manager, just like that 'dynamic IP restriction' add-on, but the best option would be a ready product.

BenMorel
  • 34,448
  • 50
  • 182
  • 322
Mark
  • 41
  • 1
  • 3
  • 2
    Since you mentioned you are in the planning/development stage, I figured this might be worth mentioning: If you develop your system to be able to handle line-saturated traffic, you'll never really have to worry about DDoS. If your line is saturated, it doesn't matter how quickly your kernel can drop connections, your line is still saturated, so there's nothing you can do. How practical this is for your situation, only you can say, for we've no information about the network infrastructure you're developing against. – uscere90 Jul 21 '11 at 18:56
  • thank you for mentioning, i didn't consider such a situation yet. it might be important – Mark Jul 21 '11 at 19:31

0 Answers0