Rapid Reset sorted agency websites into three groups, and one of them had no owner

The week

On October 10, 2023, Google, Cloudflare and Amazon Web Services jointly disclosed a vulnerability in the HTTP/2 protocol, tracked as CVE-2023-44487 and known as Rapid Reset. By opening streams and immediately cancelling them, an attacker could force servers to do large amounts of work with little effort, producing distributed denial-of-service attacks far larger than any the providers had previously seen. The providers said they had mitigated attacks using the technique since late August. Because the flaw lay in how implementations handled a standard protocol feature, it affected many web servers, proxies and load balancers, and vendors released patches and configuration guidance over the following days and weeks. CISA published guidance urging organizations to apply updates and mitigations.

Denial-of-service attacks against government websites were familiar by 2023. Politically motivated groups had knocked state government and airport sites offline for hours in 2022. Rapid Reset changed how much disruption a modest set of attacking machines could cause. The providers who disclosed it had absorbed the attacks before anyone outside knew. The useful question for an agency CIO was therefore narrower than whether the agency was vulnerable. It was which of the agency’s public services sat behind that kind of protection. Every internet-facing service falls into one of three groups, and the groups are exhaustive: services fronted by a large edge provider, services the agency hosts and protects itself, and services nobody can account for. Each group needs a different decision.

Services fronted by a large edge

Agencies that put public websites behind a content delivery network or a cloud load balancer with denial-of-service protection benefited without lifting a finger. The providers patched their own infrastructure and tuned defenses weeks before disclosure. That is the plainest argument for shared infrastructure: capacity and engineering at a scale no single agency can build.

Protection still depends on configuration. If an origin server accepts traffic from anywhere, an attacker who discovers its address can go around the edge entirely, and origin addresses leak through old DNS records, certificate transparency logs and email headers. Three checks matter. Origins should accept connections only from the provider’s published address ranges or through an authenticated tunnel. Rate limits and bot rules should be set per application, because a benefits login page and a static press page need different thresholds. And the agency should have a tested way to reach the provider’s response team during an attack, with the account details and escalation numbers held by the operations center, not by one engineer.

Contracts deserve a look too. Denial-of-service protection may be priced as a premium tier, and some agreements cap mitigation or charge for traffic during an attack. The procurement file should state which tier each critical service is on and what happens to the bill when an attack arrives.

Services the agency hosts itself

Many agency applications are still served from agency data centers, or from cloud virtual machines running the agency’s own web servers and load balancers. These needed patches or configuration changes, and vendors released them at different speeds. Some network appliances needed firmware updates that required maintenance windows. Some older platforms were out of support and received nothing.

Even fully patched, a self-hosted service lacks the capacity to absorb a very large attack. For services residents depend on, such as benefits portals, licensing, tax filing, court records and emergency information, the choice should be explicit. Either the agency fronts the service with an edge provider and accepts the dependency and cost, or it accepts that the service may go down during a large attack. In the second case it plans for that, for example with phone and in-person fallbacks and authority to extend filing deadlines. Both can be reasonable. Making the choice by default is not. The decision, its owner and the date it was last reviewed belong in the system’s security documentation, where an auditor or a new CIO can find it.

Regulated data adds constraints. Services that handle criminal justice information, federal tax information or protected health information may restrict which providers can terminate encrypted traffic and where. Those constraints can usually be met, for instance with a provider authorized under FedRAMP or with configurations that keep decryption inside the agency. They need to be worked out with the security and compliance owners before an incident, because an outage is the wrong time to negotiate a data handling question.

Services nobody can account for

Every internet-wide vulnerability exposes forgotten services. Rapid Reset affected any HTTP/2 endpoint: APIs behind mobile apps, partner integrations, vendor-hosted portals carrying the agency’s name, and microsites for programs that ended years ago. Agencies with a complete inventory of internet-facing services could assess their exposure within a day. Others learned through outages or from outside scanning.

The remedy is an external attack surface inventory, continuously updated, listing domains, certificates, address ranges and applications, with a named owner and an availability tier for each. Federal civilian agencies could draw on CISA’s scanning services, and CISA offered vulnerability scanning to state and local governments as well. Vendor-hosted services belong on the list, because a resident who cannot reach a portal blames the agency whose name is on it. A useful contract clause requires vendors to disclose the protection in front of any service they host for the agency.

The inventory is what makes the first two groups manageable. Without it, an agency cannot say which services are behind the edge, which are self-hosted, or how many sit in neither column. A simple quarterly measure tells leadership whether the third group is shrinking: the number of public endpoints with no named owner.

With hindsight

Rapid Reset was patched widely within weeks. The attack sizes it produced were soon overtaken as attackers built larger botnets from compromised devices, and large providers reported successive records through 2024 and 2025. In August 2025 researchers disclosed a related HTTP/2 weakness, which they called MadeYouReset, showing that the protocol’s stream handling remained a source of denial-of-service risk. Politically motivated campaigns against government sites continued around elections and geopolitical events, mostly causing short disruptions. Public reporting does not allow a systematic comparison of edge-fronted and self-hosted agency services, so we do not claim one. What did not change is the dependence on inventory: each new protocol-level flaw again required agencies to find every endpoint that spoke the affected protocol, and the agencies that could do so quickly were the ones that knew who owned each service.