BKNS Infrastructure Security
Always-on inline Anti-DDoS blocking attacks up to 100 Gbps and managed WAF — defence-in-depth for Vietnamese businesses.
BKNS commitments
100 Gbps mitigation
Vietnam scrubbing center
WAF OWASP Top 10
Managed · custom rules
Scrubbing in Vietnam
Vietnam-based scrubbing center
Benefits
Why choose BKNS?
Anti-DDoS L3–L7 inline
Blocks volumetric (ICMP, UDP, SYN flood), protocol (NTP/DNS amplification) and application-layer attacks (HTTP flood, bot, credential stuffing). Capacity up to 100 Gbps.
Managed WAF — OWASP Top 10
Blocks SQL injection, XSS, RFI, SSRF and the remaining 7 OWASP Top 10 classes. Managed rule set updated automatically for new CVEs. Custom rules per application. Included from Shield L, or available as an add-on for S/M plans.
DDoS forensics & RCA
After each P1 incident: report on attack origin, vector, traffic patterns and mitigation timeline. Logs are retained for investigation. Available for insurance claims or regulatory reporting.
Incident response
Emergency hotline 24/7 including weekends and public holidays.
Why does infrastructure need defence-in-depth?
A network firewall alone cannot stop modern attacks. Three reasons:
L7 attacks bypass conventional firewalls: HTTP flood, credential stuffing and bot scraping all use protocol-valid traffic — a firewall cannot distinguish without behavioural analysis.
Volumetric attacks saturate uplinks before reaching the firewall: a volumetric flood fills the ISP uplink, leaving the downstream firewall unable to receive traffic. Upstream scrubbing is required.
Multi-vector campaigns run simultaneously: attackers typically combine L3 flood + L7 bot + credential stuffing in a single campaign. Each layer requires a different defensive tool.
BKNS security stack
Layer 1 — Network edge: BGP anycast absorbs flood before it reaches infrastructure. L3/L4 filters: SYN cookie, IP rate-limiting, geo/ASN blocking.
Layer 2 — Scrubbing center: Located in Vietnam, 100 Gbps total capacity. Protocol checks (UDP amp, NTP reflection), L7 challenge (JS, CAPTCHA, proof-of-work), ML behaviour fingerprinting.
Layer 3 — WAF application layer: OWASP Top 10 managed rule set, custom application rules, virtual patching for newly disclosed CVEs before a hotfix is available.
Layer 4 — Visibility: Telegram + email alerts, scrubbing logs, RCA after every P1.
Incident response process
Preliminary report: attack origin, vector, drop rate, impact on origin.
Full RCA: detailed analysis, rule improvement recommendations, forensic log retention.
Want a security assessment of your current infrastructure?
BKNS technical team reviews your current setup and recommends a stack appropriate for your scale and budget. No consulting fee.