Ensure DDoS protection is Active on IBM Cloud Internet Services

보통레벨 1수동 검토ibmcloud

설명

Proxied true TTL 30 Fallback Pool 9f3fa92d0c7c59d96b179450aff0fc8e Default Pools 9f3fa92d0c7c59d96b179450aff0fc8e Region Pools Session Affinity none Session Affinity TTL 0 Session Affinity Attributes Samesite Auto Secure Auto Drain Duration 0 Steering Policy off Available Pools 0/1 - DNS Records ibmcloud cis dns-record-update <DOMAIN_ID> <DNS_RECORD_ID> --proxied true Updating DNS Record '98d434c268fd613ac28937176a8b86b5' in domain '681c5cf97f44e5da2f66924f5a4db5b2' for service instance 'WAF Epoch June 12th' ... OK ID 98d434c268fd613ac28937176a8b86b5 Created On 2024-12-13 23:37:25.43331 +0000 UTC Modified On 2024-12-13 23:37:35.834688 +0000 UTC Name advanced-cert-test.batflare.com Type A Content 1.2.3.4 Domain ID Domain Name Proxied true TTL 1 A distributed denial of service (DDoS) attack is a malicious attempt to disrupt normal traffic of a server, service, or network by overwhelming...

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

The different types of mechanisms to audit if DDoS is enabled are as follows: Using Console: 1. Log in to IBM Cloud at https://cloud.ibm.com. 2. Click Menu icon, Resource list 3. Select the Cloud Internet Service Instance 4. Click on Reliability on the Left Navigation panel. 5. Click on the Global Load Balancers tab. 6. Verify each GLB indicates that proxy is enabled by the green toggle. 7. Click on the DNS tab. 8. Verify each DNS record indicates that proxy is enabled by the green toggle. Using CLI: Run the following ibmcloud cli command and review the value of the proxied property to verify it is set to true for any global load balancers. This ensures that the traffic is inspected by the proxy and detect and layer 7 DDoS attacks. ic cis glbs <DOMAIN_ID> --output JSON | jq '.[] | {Name: .name, Proxied: .proxied}' { "Name": "tt.advanced-cert-test.batflare.com", "Proxied": true } Run the following ibmcloud cli command and review the value of the proxied property to verify it is set to true for any DNS records that are proxiable (that can be proxied). This ensures that the traffic is inspected by the proxy and detect and layer 7 DDoS attacks. ic cis dns-records <DOMAIN_ID> --outpu...

조치 방법

조치 방식: 가이드 또는 인프라 패치

The different types of mechanisms to set if DDoS is enabled are as follows: Using Console: 1. Log in to IBM Cloud at https://cloud.ibm.com. 2. Click Menu icon, Resource list 3. Select the Cloud Internet Service Instance 4. Click on Reliability on the Left Navigation panel. 5. Click on the Global Load Balancers tab. 6. Change the toggle for the Proxied column to green. 7. Click on the DNS tab. 8. Change the toggle for Proxy column for the relevant DNS records to green. Using CLI: 1. Run the following ibmcloud cli commands to set the value of the proxied property to true - Global Load Balancer ibmcloud cis glb-update <DNS Domain Id> <DNS GLB ID> --json '{ "name": "tt.advanced-cert-test.batflare.com", "fallback_pool": "9f3fa92d0c7c59d96b179450aff0fc8e", "default_pools": ["9f3fa92d0c7c59d96b179450aff0fc8e"], "proxied": true }' Updating GLB '8d9b09da038741ca319fa3ec0262bb19' in domain '681c5cf97f44e5da2f66924f5a4db5b2' for service instance 'WAF Epoch June 12th' ... OK ID 8d9b09da038741ca319fa3ec0262bb19 Name tt.advanced-cert-test.batflare.com Created On 0001-01-01 00:00:00 +0000 UTC Modified On 2025-08-19 18:58:47.038104 +0000 UTC

속성

운영 체제: 모두
태그: cloudibmcloud
참고 자료: CIS IBM Cloud Foundations Benchmark v2.0.0 - 6.1.3 Ensure DDoS protection is Active on IBM Cloud Internet Services