Availability and Denial-of-Service Engineering — A Module

What this is. The "A" in CIA, treated as a first-class security discipline: the DoS/DDoS taxonomy (volumetric, protocol, application-layer), amplification/reflection, the mitigation stack (rate limiting, SYN cookies, anycast + scrubbing, CDN/WAF, autoscaling, load shedding), and the algorithms that bound load (token bucket, leaky bucket, sliding window). Availability failures are security failures — an attacker who can't read your data but can take you offline has still won.

Why it's its own module. Other phases mention "DoS" as a STRIDE letter or a rate-limit bullet, but never build the engineering of staying up under hostile load: how the attack classes differ, why each needs a different mitigation layer, and how a rate limiter actually works. This is core for any platform/SRE-adjacent security role.

Prerequisites. Phase 02 (network/HTTP), Phase 06/07 (isolation, cloud, egress). Everything is offline — the labs reason over attack-traffic descriptors and simulate a rate limiter deterministically. No traffic is generated; DoS testing against systems you don't own is illegal (Phase 00).

Learning Objectives

By the end you can, without notes:

1. Classify a DoS attack by layer (volumetric / protocol / application) and vector (SYN flood, UDP/DNS/NTP amplification, HTTP flood, Slowloris) and explain why each is cheap for the attacker.
2. Explain amplification/reflection and the amplification factor that makes small attackers huge.
3. Map each attack class to the right mitigation layer (you can't rate-limit your way out of a 400 Gbps volumetric flood; you can't anycast your way out of an app-layer logic bomb).
4. Implement and reason about rate-limiting algorithms — token bucket, leaky bucket, sliding window — including burst behavior and per-key isolation.
5. Explain load shedding, autoscaling-as-a-DoS-amplifier (denial of wallet), backpressure, and graceful degradation.
6. Distinguish DoS the security event from capacity/availability engineering and where they meet.

The availability lens (read the WARMUP)

VOLUMETRIC (L3/4)   overwhelm bandwidth/PPS        -> upstream: anycast + scrubbing + CDN
PROTOCOL  (L3/4)    exhaust connection state        -> SYN cookies, conn limits, stateless edges
APPLICATION (L7)    exhaust CPU/DB/threads cheaply   -> rate limiting, WAF, caching, load shedding
                    (Slowloris, expensive queries, denial of wallet)

See WARMUP.md for the full from-zero treatment.

Labs

Pure Python (stdlib + pytest), lab.py/solution.py/test_lab.py/README.md each.

cd lab-02-rate-limiter-simulator
LAB_MODULE=solution pytest -q
pytest -q

Safety

Offline; the labs classify attack descriptors and simulate a rate limiter over a synthetic request log. No traffic generation, no testing against systems you don't own (Phase 00).