We have in place new security measures that not only defends against DDoS, but also learns from the attacks.

This will reduce a lot of false positive ip bans and keep the good traffic flowing without interruption.

There is vicious internet attack tools on the net that gets used all the time to try to extort money or agenda’s out of companies and we need to team together to help stop the cyber attacks.

Now I originally was only using Config Server Firewall LFD and AI to analyze logs, and was sharing the public block list to everyone that wanted to use it to help cut down on attack traffic, but that just wasn’t reliable when it came to taking action in a timely manner.

Now we have deployed CrowdSec Security to go alongside our setup.

Hackers constantly collaborate together, on a world scale. Each IP they control are anonymity tokens to hide their hacktivities. Our only chance is to stand as a crowd and act in a coordinated way, as they do. When you, Sysadmins, Devops & Secops join forces, you outnumber them and can burn their IPs one by one, crippling this precious anonymity.

CrowdSec is an open-source and collaborative EDR.
Analyze behaviors, respond to attacks & share signals across the community.

1. Parse logs
   Acquire data from any source (syslog, cloudtrails, SIEM, etc.)
2. Set up your own intrusion detection system
   Apply behavior scenarios to identify cyberthreats
3. Automate your security
   Define the type of remediation you want to apply and where
4. Leverage the community’s IP blacklist
   Share and benefit from a crowdsourced and curated cyber threat intelligence system

The massively multiplayer firewall