About IBM Cloud Internet Services

TLS

Protect your site and control your Transport Layer Security (TLS) settings. Manage the certificates used to secure traffic to your site.

Origin

Manage the TLS certificates that encrypt traffic between your origin server and your users.

Rate limiting

Use rate limiting rules to protect your site or API from malicious traffic by blocking client IP addresses that match a URL pattern or exceed a defined threshold.

Traffic scrubbing

CIS offers 248 Tbps of global network edge capacity and can mitigate DDoS attacks that have extremely high packet and HTTP request rates.

When a DDoS attack occurs, CIS doesn't use scrubbing centers; the activity is analyzed on the edge, which helps to mitigate DDoS attacks closest to the source.

Traffic that is identified as being "dirty" or part of an attack is not included in the billing. Customers are being billed for protected traffic, which consists of clean traffic that is forwarded to the origin and responses that are returned from the edge to the client.

Web Application Firewall (WAF)

WAF is implemented through multiple rule sets: OWASP, CIS, and Exposed Credentials Check.

IP firewall

IBM Cloud Internet Services offers several tools for controlling your traffic so that you protect your domains, URLs, and directories against volumes of traffic, certain groups of requesters, and particular requesting IPs.

Firewall rules

Create rules that examine incoming HTTP traffic against a set of filters to block, challenge, log, or allow matching requests.

In general, firewall rules are designed for properties that are exposed in OSI Layer-7 (HTTP), such as request headers and body content characteristics. Therefore, firewall rules apply to HTTP/HTTPS Range apps.

Events

View events that are triggered by an active web application firewall rule. For each event, you can change the triggered action based on the requesting IP address, or the requesting region as a whole.

Range

Extend the power of CIS DDoS, TLS, and IP firewall to your web servers and your TCP-based services by using Range applications, keeping them online and secure.

Advanced security

Advanced security settings include the following features, which you can change, enable, or disable.

• Browser integrity check - The browser integrity check looks for HTTP headers that are commonly abused by spammers. It denies traffic with those headers access to your page. It also blocks or challenges visitors that do not have a user agent, or who add a nonstandard user agent. This tactic is commonly used by abuse bots, crawlers, or APIs.
• Challenge passage - Controls how long a visitor that passed a challenge (or JavaScript challenge) gains access to your site before they are challenged again. This challenge is based on the visitor's IP, and therefore does not apply to challenges presented by WAF rules because they are based on an action that the user performs on your site.
• Security level - Sets the security level of your website to determine which visitors receive a challenge page.
• Always use HTTPS - Redirects all visitors to the HTTPS version.
• Email obfuscation - Prevents spam from harvesters and bots that try to access email addresses on your pages.
• Automatic HTTPS rewrites - Helps fix mixed content by changing http to https for all resources (or links) on your website that can be served with HTTPS.
• Opportunistic encryption - Allows browsers to benefit from the improved performance of HTTP/2 by informing them that your site is available over an encrypted connection.
• Universal SSL - Activates universal SSL certificates from your zone to the edge.
• True client IP header - Sends the user's IP address in the True-Client-IP header.

Security standards and platform

• TLS (SHA2 and SHA1)
• IPv4 and IPv6
• HTTP/2

Network attacks and mitigation

Generally, attacks fall into two categories:

On-demand anti-DDoS

IBM Cloud Internet Services ingests traffic by returning a CIS IP address on the DNS lookup for a domain, instead of the actual record for the origin server’s IP address. This allows CIS to ingest, single-pass inspect, and re-encrypt data before sending it to the origin server destination. CIS can also act in DNS-only mode, returning the actual DNS record without obfuscating the IP, which disables DDoS and the other functions of CIS. To enable CIS protections, switch the "proxy" slider next to each DNS record to on; to disable protections, switch to off.

Unlimited DDoS mitigation

DDoS mitigation is typically an expensive service that can grow in cost when under attack. Unlimited DDoS mitigation is included with CIS at no additional cost.

Mitigate Layer 7 attacks (configuration)

Though DDoS is enabled by default in CIS, you can further configure Layer 7 security by:

• Configuring WAF rule set sensitivity and response behavior
• Adding rate limiting
• Adding firewall rules

Use these features to customize Layer 7 mitigation of both volumetric and non-volumetric attacks.

Mitigate non volumetric attacks

CIS WAF contains rule sets to mitigate non-volumetric attacks, including cross-site forgery, cross-site-scripting (XSS), file inclusion, and SQL injection. For additional information about WAF, see Web Application Firewall concepts.

Cost protection

CIS does not meter or bill for traffic that is blocked as part of DDoS mitigation, firewall, or rate limiting. Only requests that are passed through the CIS network to the origin destination incur charges or usage.

CIS also helps keep egress bandwidth charges from your origin under control by only passing along good requests that the origin needs to respond to. All CIS plans offer unlimited and unmetered mitigation of DDoS attacks. You are never charged for attack traffic. There’s no penalty for spikes due to attack traffic, so there's no chargeback by the customer.

Global load balancing features

The global load balancing service distributes your traffic across multiple servers with a combination of origin pools, health checks, and a load balancer. Global load balancing has the following features:

• Proxy and non-proxy options for load balancing
• Origin pools and health checks

DNS features

DNS within CIS has the following features:

• DNS management - Manage your DNS records, control proxying, and enable DNS security.
• DNSSEC - DNS security cryptographically signs a zone to ensure that the DNS records provided to the user are the same as the DNS records published on the DNS server.

gRPC protocol support

The gRPC protocol builds efficient APIs with smaller payloads, which reduces bandwidth requirements, decreases latency, and increases the implementation time. CIS supports gRPC protocol for any proxied gRPC endpoints. To enable or disable gRPC support, navigate to the Reliability section, select the Advanced tab, and toggle the gRPC switch.

The following requirements must be met before you use gRPC:

• The gRPC endpoint must listen on port 443
• The gRPC endpoint must support TLS and HTTP/2
• HTTP/2 must be advertised over Application-Layer Protocol Negotiation (ALPN)
• The content-type header of gRPC requests must use application/grpc or application/grpc+<message type>

Caching

Control how CIS manages your cached assets.

Page rules

Fine-tune your cache behavior and create content optimization.

Routing

Eliminate excess latency by analyzing and optimizing routing decisions across the global internet using real-time network connections.

Advanced performance

Apply Brotli compression and restrict upload sizes in the advanced performance section.