Denial of Service Attack (CAPTCHA) in SharePoint 2013 FBA site

Question

I am working on a SharePoint 2013 (on premise) application where I have implemented Forms Based Authentication (FBA) wherein usernames and passwords are saved (in encrypted format) in SQL membership database. On the login page, there are only two fields - username and password.

I just want to understand that how an attacker over the internet can launch an automated attack against the application as CAPTCHA has not been implemented in ‘User Registration’ page. This can cause a denial of service to genuine users of `the application. This has been highlighted in the application vulnerability and penetration testing and I need to respond for this vulnerability.

Although my response would be - CAPTCHA is generally implemented for public facing sites over the Internet. This application is an Intranet based which is implemented on top of SharePoint 2013 which do not provides any CAPTCHA functionality OOTB.

Quick help would be highly appreciable!

Answer 1

Denial of Service (DDoS) attacks:

These attacks are aimed at overwhelming an Intranet with data requests, which makes it inoperable.

To protect against DDoS attacks, IT professionals should utilize such tools as firewalls, and load balancers to control the volume of traffic reaching your intranet.

You could refer to the following articles to configure Network Load Balancing for SharePoint 2013:

• How to Display Network Load Balancing Manager in Windows Server 2008
• SETTING UP NETWORK LOAD BALANCER (NLB) IN A SHAREPOINT FARM:Adding the Network Load Balance feature to Windows 2012 Server

More information about protect SharePoint Internal Websites, please refer to "How to Protect Internal Websites from Security Threats".