No Availability Protection on Revenue-Critical Services
Business-critical services with no rate limiting, no DDoS mitigation, and no capacity isolation.
- Remediation SLA
- 48 hours
- Tier
- 1 · Critical
- Domain
- Processing
- Escalation
- CISO and executive sponsor notified at 48 hours
What this finding is
A service whose unavailability directly interrupts revenue or safety operates without rate limiting, upstream DDoS mitigation, or isolation between tenants and workloads. The finding covers both volumetric exposure and application-layer exhaustion — expensive endpoints, unbounded queries, and authentication paths that can be driven to saturation cheaply.
Why it is Tier 1
Availability is a security property, and denial of service is used both as an end in itself and as a distraction concurrent with intrusion. Application-layer attacks are the practical concern for most organisations: a single unauthenticated endpoint performing an expensive query can be saturated from one host, without the volumetric traffic that upstream providers detect. Tier 1 applies only where interruption has immediate business consequence.
Most common misclassification
How to detect it
- 1Identify unauthenticated endpoints that trigger disproportionate work — search, report generation, export, and file processing are the usual candidates.
- 2Confirm whether rate limiting exists per-identity and per-address, and whether it is enforced at the edge or only in application code that the attacker's traffic already reached.
- 3Verify DDoS mitigation is actually engaged for the specific hostname, rather than merely available on the account.
- 4Load-test authentication and password-reset paths, which are frequently unprotected and expensive.
How to remediate it
Steps are ordered. The first step is the one that reduces exposure fastest, which is not always the one that closes the finding.
- 1Apply edge rate limiting keyed on both source address and authenticated identity, with the limits tuned from observed legitimate traffic.
- 2Enable upstream DDoS protection for revenue-critical hostnames and confirm the traffic path traverses it.
- 3Bound expensive operations — enforce query timeouts, result-set caps, and pagination — so that a single request cannot consume unbounded resources.
- 4Isolate critical workloads from best-effort ones so that saturation in one does not starve the other.
- 5Add a queue or async execution model for genuinely expensive operations rather than serving them synchronously.
How to verify the fix
A controlled load test against the identified endpoints triggers rate limiting before service degradation, and the limiting is observed at the edge rather than in application logs alone.
Mappings
Compliance mappings
- NIST CSF 2.0PR.IR-04 — adequate resource capacity
- ISO/IEC 27001:2022A.8.6 — capacity management
- SOC 2A1.1 — availability commitments