As we know, millions of Australians have not been able to lodge their Census online as the ABS Census site is offline.
We have been reviewing the nature of this outage and it appears the ABS took precautions against the volume of traffic it was expecting. But did it do enough?
Short for denial-of-service attack, a type of attack on a network that is designed to bring the network to its knees by flooding it with useless traffic.
While not useless, traffic from the many real users (census lodgers) hitting the ABS site could also appear to be a DoS attack. However, that may not be what happened in this instance given the ABS states the traffic originated from overseas. The question remains, could or should the ABS have been able to prevent such an attack?
They have their application architecture set up to split across what appears to be around 10 isolated units within the hosting infrastructure.
The site has been flooded with network level requests.
The graph above, showing extended time to execute an SSL connection indicates packets are not getting through. While most tests conducted did not generate any connection, this one which has, indicates network type congestion.
The system was not build for graceful degradation. There is not even an “outage page” being served at present – Could the ABS repoint the DNS to alternate infrastructure and serve some level of friendly outage page now?
Modern hosting infrastructure prevents these types of network layer attacks. Did the government procurement system prevent the ABS from having access to these global organisations or settle for a government endorsed supplier?