Yaya zaka gina DDoS incident response runbook?

Question

Accepted Answer

DDoS runbook yana juya sakaci zuwa checklist. Mahimmancin niyyarsa: **shirya kafin harin, ba a lokacin harin ba** — akakaunti an shirya, sanannun abokan tamasma, da dasibordindin an gina, saboda haka amsa ce aiwatarwa, ba ƙamsawa ba.

## Shirya a gabani

- Ka mallaki **CDN/scrubbing mai sarrafa aka haɗa ya" (DNS waje ta hanyar sa, yaren "karkashin harin" da zaka iya soke).
- Ka tabbata **baseline dasibordindin da abaké" don traffic, error rate, da cache-hit ratio don anomalies ya fito da sauri.
- Ka rubuta kafar "**WAF rules da rate-limit tiers** da zaka iya daukaka nan take.
- Ka tabbata **jerin abokan tamasma": on-call, CDN/ISP support, leadership, da **status-page** tsarin da jiya.

## Matakai na runbook

1. **Gani da bayyana** — alert ko haɗa anomaly (duba DDoS detection) yana ƙi incident. Ka ba da jiya Incident Commander nan take.
2. **Gani nau'in harin da manufa** — shine shi Layer 3/4 (volumetric) ko Layer 7 (HTTP flood)? Wanne endpoint, IP, ko yankin? Nau'in yana ƙo abubuwan damewa da zaka aiwata.
3. **Haɗa karfi** — kunna CDN "karkashin harin" yaren / scrubbing, **daukaka WAF rules**, da **rage rate limits**. Fara da sauke, fara karfi.
4. **Toshe / null-route tushe** — toshe IP ranges masu laifi ko geo a edge; a ƴuri na ƙarshe, ka nemi ISP ya **null-route** IP da aka tarwa don ceta sauran platform.
5. **Sanarwa** — kai **status page**, sabunta stakeholders, da tabbata timeline. Sanarwar kwatanci ta hana aika na sakaci na ƙamƙami.
6. **Tenga idan aka buƙata** — autoscale ko over-provision origin ƴarjejeniya don ɗaukar traffic da ya ɗao a gida a lokacin da filters suke daukawa.
7. **Post-incident duba** — da zarar ta kasance lafiya, aiwatar blameless retro: abin da ya aiki, wane ra kusan, wane rules don aiki na jiya, da wane gaps don toshe.

```text
DETECT -> IDENTIFY -> ENGAGE (CDN/WAF/rate-limit) -> BLOCK/null-route
       -> COMMUNICATE -> SCALE -> POST-INCIDENT REVIEW
```

## Yaya zaka gani

A ƙarƙashi na hakin gaskiya, latency da adrenaline sune sa mutane ya toshe matakai da sune aiwatar abubuwan masu damewa. Runbook yana ba da sanannun jeri, kayan gida da aka taya, da aiwataccen roles, saboda jama'a tana damewa a mintuna a samuwa a saida da jita a lokacin da sitin ba.
Jiyar mafi mahimmanci a kowane DDoS runbook shine shirye da aka yi a gabani — ba kaka zaka haɗa scrubbing mai sarrafa ko nemo lambar g'ari ta ISP a lokacin da aka yi jiya.