Botnets \u2013 networks of compromised computers and connected devices used as a platform for launching cyberattacks \u2013 are complex structures, making them difficult targets for law enforcement. According to Tom Grasso, supervisory special agent with the FBI\u2019s Cyber Division, the only way to effectively dismantle a botnet operation is through cooperation with the private sector and citizens.<\/p>\n\n\n\n
\u201cI\u2019m not going to tell you [the FBI] is the savior of the internet,\u201d Grasso said during a briefing at the 2017 Black Hat convention in Las Vegas. \u201cWe\u2019re not. You all are \u2013 we all are, actually, is what it comes down to.\u201d<\/p>\n\n\n\n
Grasso explained the bureau\u2019s three-pronged approach to defeating botnets, which include neutralizing the threat actors, disabling the underlying infrastructure through active operations and mitigating the effects of malicious activity by sharing indicators of compromise across relevant sectors.<\/p>\n\n\n\n
\u201cWe do more than just arrest the bad guys,\u201d Grasso said. \u201cThe tools we have in law enforcement for identifying criminals and taking them out of action \u2013 that\u2019s important \u2013 but there\u2019s other things that we can do, as well.\u201d<\/p>\n\n\n\n
Neutralize<\/b><\/p>\n\n\n\n
The more traditional law enforcement approach: Identify the bad guy and take them down.<\/p>\n\n\n\n
\u201cFind the people that are operating these things, take them off the playing field so they can\u2019t continue to do the damage that they do,\u201d Grasso said.<\/p>\n\n\n\n
Mitigation<\/b><\/p>\n\n\n\n
In every instance, the FBI wants to limit the amount of damage these actors and perpetrate. Most of those mitigation efforts center on sharing information with industry and relevant sectors.<\/p>\n\n\n\n
\u201cWe can share intelligence with the private sector, and maybe the private sector can do mitigation and develop a technical solution,\u201d he said.<\/p>\n\n\n\n
If researchers in the private sector \u2013 whether in industry or independent \u2013 discover patches or technical solutions that make the attack vectors moot, \u201cThey\u2019ve effectively defeated it and it\u2019s not necessary for us to come in and do our thing from the law enforcement side.\u201d<\/p>\n\n\n\n
Technical Operation<\/b><\/p>\n\n\n\n
\u201cThe last thing we can do, is kind of the sexy thing that everyone likes to talk about, which is a botnet takedown,\u201d Grasso said. \u201cSometimes we can, by working with our private sector partners, do some kind of technical operation, some type of intervention where we go and take this threat away from the criminals and direct it somewhere safe, and then work on mitigation.\u201d<\/p>\n\n\n\n
The key to all of this, Grasso explained, is cooperation with the private sector.<\/p>\n\n\n\n
According to Tom Grasso, supervisory special agent with the FBI\u2019s Cyber Division, the only way to effectively dismantle a botnet operation is through cooperation with the private sector and citizens.<\/p>\n","protected":false},"author":7,"featured_media":75510,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":{"8":{"categories":[],"primary_category":""}}},"categories":[106,13,32],"tags":[],"coauthors":[2464],"class_list":["post-24989","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-daily-brief","category-industry","category-newsletters"],"acf":{"subheadline":"","legacy_arc_id":"RARDAZPXIJEAFNU7Z6UCUT5NMU","arc_canonical_url":"\/civilian\/fbi-doj\/2017\/07\/26\/fbis-3-pronged-approach-to-defeating-botnets-black-hat-2017\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n