February 2021
Beginner to intermediate
372 pages
6h 48m
Korean
Content preview from 웹 애플리케이션 보안: 정찰, 공격, 방어 세 단계로 배우는 웹 애플리케이션 보안의 모든 것
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
339
26
장
DoS 방어
DoS
방어
CHAPTER
26
DoS
공격은 시스템 리소스 사용과 관련될 때가 많아 서버 로깅이 견고하지 않을 경우 탐지하
기 어려울 수도 있다. 과거에 발생한
DoS
공격이 정당한 채널(
API
엔드포인트 등 )을 통해 이
뤄졌다면 탐지하기 어려울 수 있다.
그러므로
DoS
유형의 공격을 막으려면 서버에 모든 요청과 응답 소요 시간을 기록하는 완전한
로깅 시스템부터 구축해야 한다. 또한
API
를 통해 호출되는 백업과 같이 백그라운드에서 실행
되며 완료 시 응답을 하지 않는 비동기 작업
job
의 수행을 수동으로 기록해야 한다. 그렇게 하지
않는다면
DoS
취약점(서버 측 )을 익스플로잇하려는 시도를 찾아내는 것은 어렵고도 많은 시
간을 소모하는 일이 된다.
앞서 논의한 바와 같이
DoS
공격은 다음과 같은 결과를 한 가지 이상 염두에 두고 구조화된다.
●
서버 리소스를 소진
●
클라이언트 리소스를 소진
●
요청이 리소스를 사용하지 못함
서버나 클라이언트의 리소스를 소진하는 것은 해당 생태계에 대한 직접적인 지식 없이도 쉽게
익스플로잇할 수 있다.
DoS
위협을 완화하는 계획을 세울 때는 이 세 가지 잠재적 위협을 모두
고려해야 한다.
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.