Attackers en masse

It is all about combating the full bot threat life cycle, says Patrick Walsh

Internet use brings risk. Computers risk infection, data is at risk of theft, employees risk having their identities stolen, and the business involved risks paying for resources misused by hackers, spam and unproductive website browsing.

The typical malware attack involves bots and tends to start with an email. Tricks of social engineering tempt the recipient to click on an internet link that will expose them to exploits and infect their computer with bots.

This year, the government of Georgia's public websites were completely shut down by a distributed denial of service attack that used a bot herd to overwhelm the servers.

Bots are also frequently used to send spam.

Nearly every security company claims to prevent bots and to some extent they can. But the threat must be stopped at all stages of the cycle, using a combination of security technologies.

Step one is to block emails being sent by bot herders. A spam filtering solution that can drop all traffic from known bots, accurately detect unwanted emails and block phish is required.

Top solutions will also examine the URLs inside every received email and reject any that link to fraudulent or malicious websites.

Businesses also need a web filter with real-time updates to block malicious, phishing, and other web sites that pose a security threat. The average phishing site lasts less than 24 hours and does most of its damage in the first 90 minutes.

A good intrusion prevention system is needed to detect an exploit and block access to the site immediately.

An exploit typically funnels a virus from the internet on to the client computer. A gateway anti-virus solution capable of unpacking nested compressed files will assist here, although it should also be noted that security appliances without hard drives cannot find viruses inside nested files.

Finally, security protection that can detect a bot infestation must be deployed on the local network, identifying laptops and other devices that may have contracted a virus, despite the gateway precautions.

According to a June report by the international Organisation for Economic Co-operation and Development (OECD), there are criminals lurking behind one in every four computers. Attackers are constantly tweaking their strategy for best effect.

While there is no sure-fire way to stop botnets, measures that take a multi-faceted approach are the only way to take back control of the internet.

Patrick Walsh is director of product management and marketing at eSoft