Lecturer: In this lesson,
we're going to talk about the importance of load balancers.
Now load balancers,
which are also known as a content switch,
are used to distribute the incoming requests
across a number of servers
inside of a server form or a cloud infrastructure.
If you're running a large website or service,
you cannot do all of that on a single server.
For example, I have several hundred thousand students
at this point,
taking my courses and watching my videos.
There is no way a single server can handle that much load.
So we have to distribute it
across a lot of different servers
all over the world.
But when a student wants to visit my website,
they don't have to choose a specific server.
Instead, they just go to diontraining.com
and our load balancer and content switch
redirects that request to the next available server
to be able to process it.
In fact, we have tons of different servers
sitting all over the world
to handle all of those different requests.
The exact same thing happens with Netflix
or Hulu or Facebook or Amazon,
but on a much larger scale.
All these large websites have to use a load balancer,
otherwise a single server
would simply crash under the load
and they would suffer
a self-imposed Denial of Service Attack
because of their website's popularity.
Now a load balancer essentially acts
as a traffic cop
by sitting in front of your servers
and routing the client's request to the servers
who are most available to fulfill those requests
at any given time.
this maximizes the speed to responding to the user
and it more efficiently uses
all of your existing capacity for your servers
for all of your user requests.
The reason a load balancer is so important,
is that it is one of the key things we can do
to help defend against a Denial of Service Attack
or a Distributed Denial of Service Attack.
Now, what is a Denial of Service Attack?
Well, a Denial of Service Attack
involves a continual flooding of victim systems
with requests for services,
causing the system to run out of memory
and eventually crash.
Now most modern systems
can't be taken down by a single machine though.
So instead, attackers use a DDoS
or Distributed Denial of Service Attack.
In a Distributed Denial of Service Attack,
instead of a single attacker targeting a server,
there are hundreds or even thousands of machines
simultaneously launching that attack on the server,
to force it offline.
In March of 2018, for example,
GitHub was hit by the largest DDoS to date,
where tens of thousands of unique endpoints
conducted a coordinated attack
to hit that server with a spike in traffic
that measured 1.35 terabits per second.
This forced the site offline for all of five minutes.
But the real question is,
how can we survive one of these attacks
and prevent it from taking down our organization's servers?
Well, we just need to look at Amazon
for some of the best practices.
You see, in February of 2020,
Amazon was hit by the largest DDoS to date,
even larger than GitHub.
And there was a coordinated attack
to hit that server with a spike in traffic
that measured 2.3 terabits per second,
but due to the good security architecture they have
and their ability to scale up resources
to sustain that attack,
they suffered no downtime during the attack,
even though it was 70% larger
than the one that took down GitHub.
Now, the first technique they used
is known as blackholing or sinkholing.
This is a technique
that identifies any attacking IP addresses
and routes all their traffic
to a non-existent server through a null interface,
effectively stopping the attack.
Unfortunately, the attackers can always move to a new IP
and restart the attack again.
So it won't prevent a DDoS forever,
but it will buy you some time
as you work on other mitigations.
IPSs, or Intrusion Prevention Systems,
can also be used to identify
and respond to Denial of Service Attacks.
This may work well for small scale attacks
against your network,
but it's not going to have enough processing power
to handle a truly large scale attack,
like the one Amazon was targeted with.
Now one of the most effective methods is
to use elastic cloud infrastructure,
because it allows you to scale up on demand as needed,
so you can ride out the attack.
The issue with this strategy though,
is that most service providers
will charge you based on capacity
and resources that you're using.
So as you scale up,
this causes us to receive a much larger bill
from our cloud service provider
and this can be something
that we're not getting any return on investment for,
because all that traffic wasn't generating any revenue
for our organization,
it was all just part of the attack.
That said, at least you're remaining online
to serve your paying customers.
So it just becomes a matter of
if you can afford to last longer
than the DDoS attack can keep going on.