Government and industry could help prevent dangerous botnet attacks simply by using tools that already exist, according to a draft report headed to the White House.<\/p>\n\n\n\n
Instead, IT officials often ignore those tools because they\u2019re too expensive, too difficult or for other reasons, a recent report from the National Telecommunications and Information Administration said.<\/p>\n\n\n\n
\u201cThe tools, processes and practices required to significantly enhance the resilience of the internet and communications ecosystem are widely available, if imperfect, and are routinely applied in selected market sectors,\u201d the report said.<\/p>\n\n\n\n
\u201cHowever, they are not part of common practices for product development and deployment in many other sectors for a variety of reasons, including (but not limited to) lack of awareness, cost avoidance, insufficient technical expertise, and lack of market incentives.\u201d<\/p>\n\n\n\n
Botnets are responsible for a variety of hacking campaigns, including perpetuating Distributed Denial of Service attacks, which hit a particular network or device with so much traffic that the system is unable to work under the strain. One such program, known as Mirai, was responsible for the massive October 2016 Dyn DDoS attack, which shut down major websites such as Twitter and Netflix. The hackers took advantage of vulnerable, internet-connected DVR boxes, which had only minimal manufacturer security, and turned them into \u201cbots.\u201d<\/p>\n\n\n\n
\u201cThis attack also highlighted the growing insecurities in \u2014 and threats from \u2014 consumer-grade [internet of things] devices. As a new technology, IoT devices are often built and deployed without important security features and practices in place,\u201d the report said.<\/p>\n\n\n\n
The report noted that the proliferation of internet of things devices that are either entirely unsecured, using pirated software or no longer supported by their developer increases the danger of botnets.<\/p>\n\n\n\n
\u201cOften, devices were not designed with security in mind. Developers are either unaware of good security design practices, assume that the device will be inaccessible (e.g., on a local network air gapped from the Internet), or want to avoid security solutions that impose additional cost or increase time to market. The resulting design choices, such as hard-coded administrative passwords, create inherently insecure devices,\u201d the report said.<\/p>\n\n\n\n
\u201cInsecure devices are not a result of limitations in the underlying technology. Applied properly, the current best practices are fairly effective, if imperfect, and result in devices that are reasonably secure upon delivery, and include tools to maintain that level of security throughout the device\u2019s life cycle.\u201d<\/p>\n\n\n\n
The report established six goals for improving defense against botnets:<\/p>\n\n\n\n
\u201cNo single actor or sector is responsible for single-handedly addressing these risks, and no single entity can simply say that these risks are all someone else\u2019s problem,\u201d the report said.<\/p>\n\n\n\n
\u201cWhile the information technology and communications sectors do actively work to understand security risks, sectors often are unable to coordinate well with other sectors. Even though some entities coordinate domestically or regionally, there are few global mechanisms to share information about threats, solutions and their adoption and efficacy.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"
The tools and best practices for preventing botnet attacks already exist, says a recent National Telecommunications and Information Administration draft report to the president. Governments and industries worldwide just need to take advantage of them.<\/p>\n","protected":false},"author":7,"featured_media":48524,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":14,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[31,14,33],"tags":[],"coauthors":[2853],"class_list":["post-16650","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-home","category-it-networks","category-newsletters"],"acf":{"subheadline":"","legacy_arc_id":"F5JYY6VSG5ARNDI5A6XBLEUXYI","arc_canonical_url":"\/industry\/2018\/01\/08\/the-botnet-solution-everybody-already-knows-about\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n