Issue Details
Denial of Service
Aliases: None
Explanation
In OWASP 2003, A9 Denial of Service combines related risk themes across Denial of Service, Availability and Resilience. Denial of service weaknesses let attackers exhaust application resources and degrade service for real users. Availability and resilience issues allow attackers or faults to make the application unstable or unavailable. These weaknesses are often exploited as a chain: attackers start with weak input or trust boundaries, pivot through authorization or session gaps, and then move toward data exposure, integrity loss, or service disruption. Operationally, this can increase incident frequency, enlarge blast radius, and raise both remediation cost and compliance exposure when controls are missing or inconsistently enforced across services.
Remedy
For OWASP 2003 A9 Denial of Service, apply defense in depth across design, implementation, deployment, and operations rather than relying on a single control. Priority controls include: Implement rate limiting, request size limits, queue controls, and autoscaling plus alerting for abnormal traffic. Add resource limits, graceful degradation, retries with backoff, and resilience testing for high-load failure scenarios. Treat mitigation as a continuous program: define security requirements up front, enforce them in CI/CD gates, and verify effectiveness with threat modeling, code review, automated testing, and recurring penetration testing. Add monitoring and incident-response readiness so misconfigurations, abuse patterns, and control regressions are detected early and corrected before they become repeatable attack paths.
| Year | Rank | Category |
|---|---|---|
| 2003 | #9 | A9 - Denial of Service |
| 2004 | #9 | A9 - Denial of Service |