“I know people with zero-value sites who have experienced hundreds of attacks on some days. Why there is no functional defense against this type of thing baffles me.”
I agree. I’m an IT worker and have my personal lab accessible from the internet and it is amazing how often somebody tries to beat down the virtual door. I’ve noticed quite an uptick in the last month or so. I hope those that manage the nations infrastructure are paying attention.
I’ve worked Security Operations Centers (SOCs) for various networks.
Attacks are so numerous that you have to prioritize which ones you are going to fight, and which you ignore.
And it doesn’t help that a LOT of the attacks and footprinting are automated and botnet-based. So take down the attacking IP, and in minutes, it continues where it left off from a very different IP address. . .
I simply do not understand why there is no form of dynamic encryption that would utilize a Heddy-Lamar type “frequency-hopping” form of encoding-decoding that would completely foil any means of CRC check from a non-authorized source. Nor do I understand why a static password is a feature of any site that needs top-grade security. By the time your site sitting therem handling thousands of probes with no complaint whatsoever and no attempt to reverse flood such efforts, this is just waiting around for someone to beat down your door.