Operating the Ory Network
summary
Ory Network faces a 670 million request DDoS over 75 minutes from over 200 source IPs and ~75 JA3 fingerprints, mitigated by Cloudflare plus rapid deployment of Cloudflare + custom WAF rules that raise blocking within ten minutes and restore service two minutes after rule activation. Regular probes exploit custom flow extensions trying to reach internal cluster resources, prompting scheduled pentests with Cure53. Production runs across three datacenters (two US, one EU) with Cockroach replication, telemetry-driven upgrades, proactive patching and documented rate limits.
AI-written summary · about
chapters (9)
- 0:00Introduction and speaker setup
- 1:08Operating the Ory Network
- 1:49DDoS attack on November 1st
- 6:27Sneaky attempts to exploit backdoors
- 8:33Daily malicious traffic patterns
- 9:57Building a more secure Ory Network
- 12:08Future security improvements
- 13:32Vulnerability management and updates
- 14:36Compliance and monitoring
related talks
25m Introducing the Ory Network
24mSecuring the digital world
40mThe new reality of DDOS
52mNot all attacks are malicious: DDoS from outside and within
52mInvestigating DDOS - Architecture Actors and Attribution
19mDavids Slingshot: Leveraging Ory
35mHow We Organize Large-Scale DDoS Exercises in the Netherlands
51mWhat We’ve Learned From Billions of Security Reports