Piye carane mbangun DDoS incident response runbook?

Question

Accepted Answer

Runbook DDoS ngubah panik dadi checklist. Prinsip intiné: **nyiapake sadurunge serangan, ora sak durunge serangan** — akun wis disiapake, kontakmu wis dingerteni, lan dashboard wis dibangun, saéngga respon baé eksekusi, ora improvvisasi.

## Nyiapake luwih awal

- Duwe **CDN/scrubbing provider wis diintegrasikake** (DNS dipundhak sak dheweke, mode "under attack" sing bisa dibanting).
- Jaga **baseline dashboard lan alert** kanggo traffic, error rate, lan cache-hit ratio supaya anomali katon cepet.
- Tulis luwih awal **WAF rules lan rate-limit tier** sing bisa dikencengake langsung.
- Njaga **daftar kontak**: on-call, CDN/ISP support, leadership, lan **status-page** template sing siap.

## Langkah-langkah runbook

1. **Deteksi lan nyatakake** — alert utawa anomali sing kucekhaken (lih DDoS detection) malungsurakne insiden. Tetapake incident commander langsung.
2. **Identikasikaké jenis serangan lan target** — apa Layer 3/4 (volumetrik) utawa Layer 7 (HTTP flood)? Endpoint, IP, utawa region mana? Jenis bakal ngarahake kontrol mana sing dingakakne.
3. **Libatake pertahanan** — nduweni CDN "under attack" mode / scrubbing, **kencengake WAF rules**, lan **turunake rate limits**. Mulai saka kontrol paling murah lan paling luwes.
4. **Blokir / null-route sumber** — blokir jajaran IP utawa geo sing salah ing pinggir; minangka papan terakhir, takon ISP supaya **null-route** IP target kanggo nyukupi sisane platform.
5. **Komunikasikake** — posting menyang **status page**, nganyari stakeholder, lan njaga timeline. Komunikasi sing jelas nyegah krisis kapindho saka kabingungan.
6. **Scale yen perlu** — autoscale utawa overprovision kapasitas asli kanggo nyerap traffic sing tembus nalika filter dikencengake.
7. **Tinjauan pasca-insiden** — sawise stabil, dolan retro tanpa salah: apa sing bisa, apa sing alon, peraturan mana sing diadekake tetap, lan celah apa sing arep nutup.

```text
DETECT -> IDENTIFY -> ENGAGE (CDN/WAF/rate-limit) -> BLOCK/null-route
       -> COMMUNICATE -> SCALE -> POST-INCIDENT REVIEW
```

## Apa dadi penting

Sabenere serangan, latency lan adrenalin biyen wong skip langkah lan nindakake bab-bab sing luwih parah. Runbook menehi urutan sing dikenal, alat sing wis dibangun, lan peran sing jelas, saéngga tim bisa nyukupi ing menit tinimbang debat pilihan nalika situs tuku. Baris paling berharga ing napa wae DDoS runbook yaiku persiapan sing rampung sadurunge — ora bisa integrasikake scrubbing provider utawa golek nomer darurat ISP nalika bisaa disedoti.