427 Botnet fm qxd

What Is to Be Done?
We mentioned before that known practices apply. Security professionals and
network engineers need to do what needs to be done to make their networks
more secure. Management needs to support this effort with training, time, and
cash. Business, Academia, and IT professionals need to communicate about
these problems and look for approaches that deal with the problem, not just
“market share.” In this section, we briefly mention some rules that should be
obvious but perhaps are not. We also talk a bit about how to more aggres-
sively pursue the botnets and botnet herders.
www.syngress.com
Responding to Botnets • Chapter 12
429
427_Botnet_12.qxd 1/9/07 3:08 PM Page 429

---

Effective Practices 
So, what are some effective practices? There are so many ideas in the previous
chapters that we don’t have the room to list them all. However, we do want
to briefly list some ideas we think are fundamental.
Practices for Individual Computer Users
Here are several effective practices for individual computer users to consider.
■
If it’s spam, delete it and don’t respond to it. Don’t buy their product.
If no one bought products from spam, there would be no spam
problem.
■
With e-mail or Web surfing, be careful.You should not execute
unknown e-mail attachments, because you may be installing malware
on your box.Think before you download. If a confinement mecha-
nism exists for doing a download, use it. It seems like it would be a
wonderful idea to have virtual machines for download and test-instal-
lation of programs, and then be able to throw out the virtual machine
if it goes south.Think of the problems your Mom could avoid if her
e-mail product only executed attachments in a virtual machine
instead of on the real-world computer.
■
Many exploits in recent times have been aimed at Internet Explorer.
If you use IE, be careful with it.You should strongly consider
installing another browser and using it (Firefox). Outlook is also on
the short list of programs that have been infected far too many times.
Consider using another e-mail client (note that you can use a Web
browser as an e-mail client with some ISPs). Alternatively, use
Thunderbird at www.mozilla.com/en-US/thunderbird/.
■
Be careful about downloading and executing programs from the Web.
Another case where virtual systems would be useful if they could be
easy to use. Perhaps the download option of the Web browser could
offer it as an option “Open Virtual” instead of just Open or Save.
■
Make sure your system has auto-updates on.You have to stay
patched.This applies to Microsoft in particular.