Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update WAF rules #1573

Merged
merged 18 commits into from
Nov 1, 2023
Merged

Update WAF rules #1573

merged 18 commits into from
Nov 1, 2023

Conversation

markdboyd
Copy link
Contributor

@markdboyd markdboyd commented Oct 26, 2023 •
edited
Loading

Related to https://github.com/cloud-gov/private/issues/866

Changes proposed in this pull request:

  • Reorganized WAF rules to ensure BLOCK rules always come before rate limit rules
  • Added WAF rule to block traffic by malicious JA3 fingerprints identified here: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a. This rule is set to count, not block requests
  • Added WAF rule to rate limit traffic that is not from Cloudfront by source IP with a challenge
  • Added WAF rule to rate limit traffic that is from Cloudfront by forwarded IP with a challenge

These changes were already made manually on the production WAF to mitigate ongoing DDoS incidents, so this PR is just translating those changes into Terraform to make them permanent and consistent across environments

security considerations

These changes should drastically reduce our platform's exposure to DDoS attacks and likely reduce our vulnerability to probing/sniffing attacks

@markdboyd markdboyd requested a review from a team October 26, 2023 22:01
@markdboyd markdboyd marked this pull request as draft October 27, 2023 16:03
@markdboyd markdboyd marked this pull request as ready for review October 31, 2023 18:59
JasonTheMain
JasonTheMain approved these changes Oct 31, 2023
View reviewed changes
Copy link
Contributor

@JasonTheMain JasonTheMain left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:Looks good to me

@markdboyd markdboyd merged commit fe0e347 into main Nov 1, 2023
2 checks passed
@markdboyd markdboyd deleted the update-waf-rules branch November 1, 2023 14:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@JasonTheMain JasonTheMain JasonTheMain approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@markdboyd @JasonTheMain