Throttling, also known as rate limiting, is a primary mitigation technique against denial-of-service (DoS) threats. It works by controlling the rate at which an application, API, or service processes incoming requests from a specific source within a given timeframe. By imposing a limit, throttling prevents any single user or system from overwhelming the service with an excessive volume of requests. This ensures that the system's resources, such as CPU, memory, and bandwidth, are not exhausted, thereby maintaining availability for legitimate users and effectively countering the flooding nature of DoS attacks.

A. Digital signatures are cryptographic mechanisms used to verify the authenticity, integrity, and non-repudiation of data, not to prevent resource exhaustion from high-volume traffic.

B. Protect secrets is a principle focused on safeguarding confidential information like API keys or passwords to prevent unauthorized access, which is unrelated to managing service availability.

C. Timestamps are used to record when an event occurred, primarily to prevent replay attacks by ensuring a message is current, but they do not limit the rate of requests.

1. OWASP Foundation. (2023). API Security Top 10 2023, API4:2023 - Unrestricted Resource Consumption. OWASP. Retrieved from https://owasp.org/API-Security/editions/2023/en/0xapi4-unrestricted-resource-consumption/

Reference Detail: In the section on "How to Prevent," the document explicitly states: "Implement rate limiting based on the client's address and authenticated identity... This is the first line of defense against brute-force, and DoS attacks." This directly identifies rate limiting (throttling) as a defense against DoS.

2. National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations (Special Publication 800-53, Revision 5).

Reference Detail: In Appendix F, Security Control Catalog, under control SC-5 (Denial of Service Protection), the discussion section suggests employing "traffic-shaping mechanisms by managing bandwidth and prioritizing or limiting traffic." Throttling is a form of traffic shaping used to limit traffic.

3. Pfleeger, C. P., Pfleeger, S. L., & Margulies, J. (2015). Security in Computing (5th ed.). Pearson Education.

Reference Detail: Chapter 6, "Networks," in the section discussing Denial of Service Attacks, describes countermeasures. It explains that network and system administrators can "throttle packets," which involves limiting the incoming traffic rate from a particular source to mitigate the effects of a flood attack.