How to implement DDoS protection in GCP
summary
Architecture shows a GKE app fronted by Google Cloud Load Balancer + Cloud CDN, protected by Cloud Armor with threat intelligence and adaptive protection, plus reCAPTCHA Enterprise gating. Demo deploys via Terraform and runs a live attack of 10,000 req/s (claims 30 minutes) while measuring availability; previous real incident hit 20 million requests/min from ~10,000 IPs across 174 countries. Notes practical limits: Cloud Armor attaches only to external HTTP LB, some ingress controllers (NGINX) miss GCP-specific annotations, and rule tuning is time consuming.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 2:15DDoS attacks overview
- 5:22GCP DDoS platforms
- 7:07CDN for attack mitigation
- 8:30Cloud Armor WAF
- 10:17WAF rules and OAS policies
- 12:43Tuning WAF policies
- 14:06Threat intelligence
- 16:59Malicious IPs handling
- 18:01Adaptive protection
- 20:47Rate-based rules
- 21:51reCAPTCHA integration
- 23:56Session validation
- 25:39Rule sets guide
- 29:07Protection modes and costs
- 30:46Live demo
- 31:49Resources & Q&A
related talks
21mFortify the Fort: Think outside the security
49mProtecting API workloads OWASP Top 10
35mComprehensive protection for Infrastructure and Web Apps
45mLive Hacking Cloud Architectures
40mThe new reality of DDOS
44mLive Hacking Cloud Architectures
52mNot all attacks are malicious: DDoS from outside and within
11mAWS On Air ft. Automatic Application Layer DDoS