427 Botnet fm qxd

www.syngress.com
446
Chapter 12 • Responding to Botnets
427_Botnet_12.qxd 1/9/07 3:08 PM Page 446

---

■
Institutional Hardening
■
Legal Actions
■
Law Enforcement and Prosecution
■
Legislation or Regulation
Summary
We’ve covered a number of the preceding categories in this book, but not all.
To successfully attack the problem of botnets, we need to have smart people
breaking this problem in to manageable pieces.The preceding outline can
begin to guide our efforts to apply resources to many aspects of this scourge.
It is hard to decide where to begin.There are so many opportunities to
chose from that will make a difference in your organization.The important
thing is that each of us picks something and begins. Most importantly, commu-
nicate with others about what is going on at your site.Tell each other about
what works and what doesn’t in terms of processes and tools. If you have time
and skill, get involved in the wider fight. Consider reporting your problems or
discoveries to various relevant sites like dshield.org, the shadowserver site, the
botnet digest, or one of the ISACs we mentioned previously.
There is that famous alleged old Chinese curse, “may you live in inter-
esting times.”These are interesting times. On the other hand, there is an
opportunity here for those concerned about the problem to find ways to
band together. We think that this is a potentially very fruitful area simply
because useful exchanges about botnets have had limited circulation in the
past.There is hope there simply because books like this one may get people
to work together to address these problems.
We sincerely believe that security and networking professionals of all
walks need to band together and work harder (or smarter) to deal with the
botnet threat Some of the techniques presented in this book (including, for
example, the sandbox work in Chapter 10 or ourmon in Chapters 6 through
9) suggest new tools that can help. Basic security measures based on tradi-
tional rules like isolation and separation of privilege (and good password prac-
tice) will help, too. Serious consideration needs to be given to the problems of
large-scale Windows administration in enterprises, and the problem of
Windows on an end-user desk hooked up via a DSL connection.The single
biggest gap in our ability to address the botnet threat is the lack of the ability