Unit 01 of 03
Application Defense
Counting, in the same run, what defenses placed at the request layer at runtime catch, miss, and falsely block: the joint movement of three numbers against the anomaly score threshold of a ready-made rule set, the requests three rate limiting windows cut from legitimate peak load, the attack shape that account and address thresholds each see separately against credential stuffing, the number of applications covered and the endpoints left outside when security headers are managed from the server, and the delay in minutes with which application-level anomaly scoring flags a session that deviates from its baseline, together with the earlier stage at which each item could have been closed.
Published Updated
Lessons
- 01 Web Application Firewall Running a ready-made rule set over a fictional daily request set and writing three counts separately: bad requests blocked, bad requests missed, and legitimate requests falsely blocked; how the three move together when the anomaly score threshold is lowered, what price writing exclusions pays to bring the same three counts back, and how much of the blocked volume could have been closed at a cheaper stage. 13 min read
- 02 Rate Limiting Windows Running the same five-minute load through three different rate limit windows and how the window shape shifts the three counts: the window boundary effect of the fixed window, the request the sliding window cuts from legitimate peak load, the token bucket saving the peak share while also letting the attack peak through, how many bad requests the limit that saves the legitimate peak lets go, and which part of the cut volume could have been closed at an earlier stage. 14 min read
- 03 Credential Stuffing Defense Running account and address thresholds separately over a one-hour login attempt record and separating which threshold stops which attack shape: the account threshold stops brute force and the address threshold stops concentrated-source spraying, while stuffing with a single attempt per account passes both; the gap between the number of attempts blocked and the number of account takeovers prevented, and the lockout of the shared egress address and of the legitimate account being targeted. 13 min read
- 04 Security Headers Coverage Measuring with four separate counts the endpoints, applications, and requests covered by moving security headers out of the application and managing them at the edge: the daily requests carried by browser surface that does not pass through the edge, the cells configured but ineffective on endpoints with no browser surface, the number of legitimate pages a strict content security policy breaks, and the code-stage work needed before the policy can be tightened. 14 min read
- 05 Application-Level Anomaly Detection Running seven sessions scored against a role baseline through a forty-five-minute behavior log and comparing the flagging threshold across four settings: the delay between the minute the deviation began and the minute the flag was raised, the number of records that left during that delay, the score gap between the slowly deviating insider threat session and the legitimate analyst session in the billing period, and how many records earlier the same leak could have been closed at the design stage. 14 min read