Last updated: May 1, 2026
A CDN started as a content-acceleration play in the 1990s. By 2026 it is also the DDoS shield, the WAF, the bot-mitigation layer, and increasingly the identity-aware proxy in front of your origin. This module walks the architecture, the categories of DDoS attacks, the modern provider landscape, and how an Indian enterprise should size its DDoS posture under DPDP, RBI, SEBI, and IRDAI scrutiny.
CDN architecture — anycast, edge caching, and the origin shield
A CDN runs hundreds of edge data centres globally. Anycast announces the same IP from every edge location; BGP routes each user to the topologically closest one. The user-facing IP is the CDN’s; the origin (your real server) is hidden.
Edge cachingstatic content (CSS, JS, images, video) is cached at edges with TTLs set by HTTP cache headers. Dynamic content (HTML, API responses) increasingly cacheable at the edge too via cache-keys and stale-while-revalidate.
Origin shielda single intermediate cache between edges and origin reduces origin load when a popular asset is requested across many edges.
Implications for securityyour origin IP must remain confidential — direct connections bypass the CDN. Egress IPs of the CDN must be allow-listed at origin (Cloudflare publishes IP ranges; AWS CloudFront publishes ranges; etc.). Cert pinning between CDN and origin (mTLS via Cloudflare’s “Authenticated Origin Pulls”) makes CDN-bypass infeasible for an attacker.
Custom team training + practitioner advisory
Beyond the free academy — we run private workshops, vCISO advisory, and red-team exercises tailored to your stack. For Indian SMBs scaling past their first hire.