Sustained web attacks against Malaysia’s financial sector are a useful reminder that cyber defence is not only about stopping a single malicious request or blocking one IP address. When attacks continue over time, the real test becomes whether the organisation can absorb the pressure, maintain visibility and keep critical services operating.
That is why the discussion in Sustained Web Attacks Target Malaysia’s Financial Sector matters. The key issue is not just that internet-facing systems are being attacked. It is that repeated hostile traffic can expose weaknesses in capacity, application design, monitoring, third-party dependencies and operational response.
A web application may have a WAF. A network may have DDoS protection. Security teams may have SIEM alerts and threat intelligence. All of those controls are important.
But sustained attacks force a different question.
What happens when those controls are under pressure for hours or days?
Can the application still serve legitimate users? Can security teams distinguish real attacks from background noise? Can operations identify where degradation is happening? Can controls be adjusted quickly without creating new business disruption?
This is where resilience becomes as important as prevention.
The same principle appears in If a Security Scan Can Take Down Your System, What Will a Real Attacker Do?. A system that becomes unstable under controlled abnormal traffic may have a deeper resilience weakness, even if the immediate trigger is a scanner or security test.
It also connects with the broader architectural principle in Good Security Architecture Assumes Every Control Will Eventually Fail. If one defensive layer becomes saturated, bypassed or unavailable, other controls and recovery mechanisms should continue protecting the business.
That is the bigger lesson from sustained attacks.
The objective is not simply to prove that the firewall, WAF or DDoS service is working.
It is to prove that the business can continue operating while those controls are being tested by a real adversary.
Because eventually, the question is no longer:
“Did we block the attack?”
It becomes:
“Can the organisation still function while the attack continues?”