DoS Defense and Mitigation

When to Use

Apply this skill when:

• Designing a new service and want to evaluate its attack surface and choose cost-effective layered defenses
• Auditing an existing system's DoS posture before a launch or after an incident
• Responding to an active traffic anomaly — including determining whether it is an attack or a legitimate surge
• Clients are caught in retry loops that compound a server outage into a denial of service
• Building or reviewing an automated DoS mitigation system (detection + response pipeline)
• Deciding how to respond to an attack without teaching the attacker how your defenses work

The core economic model: A DoS attack is a supply-and-demand imbalance. The adversary drives demand above your supply capacity. Simply absorbing all attacks by overprovisioning is rarely the most cost-effective approach. Instead, eliminate as much attack traffic as possible at each successive layer, so the expensive inner layers only have to handle what the cheap outer layers could not stop.

Dependency note: This skill builds on load shedding, throttling, and graceful degradation concepts from resilience-and-blast-radius-design. If those mechanisms are not yet defined for the system under review, complete that skill first.