Edge Security

The Perimeter Relocation

 old model: firewall at datacenter edge; attacks reach your door
 new model: security AT the CDN edge — attacks absorbed/dropped
            300 cities away from origin

 [attacker bots] ──► [EDGES: filter/absorb/challenge]
                          │ only clean traffic
                          ▼
                     [origin: allowlisted to CDN IPs]

 origins become invisible to the raw internet.
 scanning, DDoS, and exploits hit distributed armor instead.

Layer 1: DDoS Absorption

 attack classes and where they die:

 VOLUMETRIC (L3/L4):  1-100+ Tbps floods
                      → edges absorb via aggregate capacity +
                        anycast spreading across hundreds of POPs;
                        no single point feels the full wave

 PROTOCOL (SYN floods, amplification):
                      → edge TCP stacks syn-cookie, rate-limit,
                        drop spoofed traffic before app layer

 APPLICATION (L7):    HTTP floods against expensive endpoints
                      → WAF rules + rate limits + bot scoring;
                        hardest class — needs intelligence not just pipes

 the structural advantage: defender capacity is measured in
 TERABITS; even massive botnets can't saturate it all simultaneously.

Layer 2: WAF at the Edge

 Web Application Firewall inspects requests before origin:

 managed rule sets:
   OWASP top-10 patterns (SQLi, XSS, path traversal)
   known-exploit signatures updated platform-wide within hours
 
 custom rules:
   block /admin except office IPs
   geo-block regions you don't serve
   require header Honeypot-X on API writes (secret canary)

 modes: log-only first (tune without breaking), then block.
 running unknown rules in block mode = self-inflicted outage risk.

Layer 3: Bot Management

 bots are most traffic on many sites — some fine (Google),
 some hostile (scrapers, credential stuffing, sneaker bots):

 signals combined for scoring:
 - TLS/browser fingerprints (real Chrome vs scripted client)
 - behavioral analysis (mouse paths, request rhythm)
 - IP reputation + ASN intelligence
 - challenge escalation: JS check → CAPTCHA → block

 credential-stuffing defense shape:
   login endpoint + velocity checks per account/IP/device +
   breached-password screening. edge enforcement makes it global-day-one.

Layer 4: Zero-Trust Access for Your Own Stuff

 the same edge protects INTERNAL tools:

 admin.app.com ──► edge Access layer:
                    identity check (SSO/OTP/device posture)
                    → THEN origin reachable
 
 replaces VPN-for-admin-panel with per-app identity-aware proxy:
 - no network-level trust; every app authenticates
 - logs who accessed what, when
 - origin stays locked to CDN ranges entirely

Operational Discipline

Practice	Why
Origin allowlist to CDN IPs	Bypass-proofing the whole model
Log-only mode before blocking rules	Rule changes break real users
Security headers AT the edge	HSTS/CSP set once, globally
Rate limits per endpoint cost	Expensive endpoints get tighter caps
Regular WAF rule review	Apps evolve; rules rot

Interview Framing

“Protect a login endpoint from credential stuffing” scored stack: edge rate limiting (velocity per IP AND per account), bot scoring with challenge escalation, breached-password checks at origin, MFA as backstop — each placed at its correct layer (edge vs app). Framing “the edge is now the perimeter” while noting origin allowlisting as what MAKES it true shows architectural completeness.