427 Botnet fm qxd

www.syngress.com
430
Chapter 12 • Responding to Botnets
427_Botnet_12.qxd 1/9/07 3:08 PM Page 430

---

■
Ensure local accounts, particularly those with administrator privileges,
have strong passwords.
■
Install a host firewall. Windows XP has one, so use it even if you do
not intend to manage the ruleset.The firewall log provides valuable
information for botnet detection and analysis. If you are in an enter-
prise setting, the Windows firewall can be turned on by group policy.
If you are an individual, the firewall can be turned on in the 
Control
Panel 
||
Windows Firewall
menu item. On the 
General
tab, click
the 
On
option button. In addition, click on the 
Advanced
tab. In
the section labeled 
Security Logging
, click on 
Settings
. On the
Log Settings
page, check the boxes 
Log dropped packets
and
Log successful connections
.
Zone alarm has a nifty product (with a free version) that alerts
you in an active way if programs on your Windows host try to con-
tact the network or the network tries to contact you. Enterprise fire-
walls are necessary, but in the modern mobile world, you may be at a
coffee shop and your organization might not have configured your
laptop so that all outbound traffic travels via VPN to the enterprise
firewall before going to the Internet.Thus, without a host firewall
there would be nothing between you and the Internet. Or, you
might be at the office and the host “next to you” on the same IP
subnet is sick and decides to attack you. Every ordinary operating
system has a firewall capability at this point. People need to learn to
use them.
■
Ensure that your security log is on and that it records both Successful
and Unsuccessful login attempts. In your local security policy, under