Guidance Following Pen Test Issue ProblemA pen test performed on a production instance resulted in observed service degradation, indicating insufficient rate limiting protections and/or resources to prevent resource exhaustion from repeated unauthenticated requests. The test, conducted without whitelisting, privileged access, or valid credentials, demonstrated vulnerability to external attackers with sufficient time and automation capability. Release ALL Cause Root CauseThe application and supporting infrastructure lacked sufficient rate limiting protections and/or resources to handle repeated unauthenticated requests, as demonstrated during the pen test. This created vulnerability to resource exhaustion by external attackers. Resolution Steps to Resolve1. Implement robust rate limiting and request throttling controls across externally accessible services to restrict excessive requests from individual IP addresses and automated tooling patterns.2. Configure Web Application Firewall (WAF) rules to detect and prevent enumeration activity.3. Apply adaptive rate limiting based on source IP, request frequency, and endpoint sensitivity.4. Deploy automated blocking or challenge mechanisms (e.g., CAPTCHA, timeout mechanisms) for suspicious activity.5. Establish process controls to swiftly identify the source of potential disruptions.6. Align logging and alert thresholds with Denial-of-Service early warning indicators.7. Refer to ServiceNow's guidelines for rate limiting, including planning throughput based on instance size, using semaphores for concurrent transactions, and monitoring semaphore usage.