Botnet attack is where group of devices are infected by malware th.docx

Botnet attack is where group of devices are infected by malware
that lets the hacker to manipulate these devices which are
connected internally by internet within an organization. Botnet
attack can destroy personal and enterprise identity. Initially
botnet will attack an individual and eventually an organization.
Botnet will gain access to an individual system and build its
chain to strengthen the network like infecting more systems,
electronic devices and network devices. These devices
eventually will be controlled by the hacker. These devices are
now called as bot. These army of bots will help botnet to
achieve hackers’ goal such as data theft. Few potential threats
are data breach. The organization can lose its confidential data
related to organization, organization policies, employee,
customers and organizations business strategy. As we know how
important and confidential the data is for an organization. This
article says that in 2014 few companies (like Microsoft and
Symantec) has identified 19 botnet groups which controlled
more than trillions of bots (Shirazi, 2015). Various
organizations spent millions of dollars to build secure and safe
environment. But using these bots, botnet can still break the
security to gain access to the data. This can cause huge damage
to an organization economically and destroy its reputation.
Reference:
Shirazi, R. (2015). Botnet takedown initiatives: A taxonomy and
performance model. Technology Innovation Management
Review, 5(1), 15-20. Retrieved from
https://search.proquest.com/docview/1676102254?accountid=10
378

14 hours ago
Karishma Paleja
Threats of Botnet Attack
COLLAPSE
Top of Form
In present world scenario Botnets can be responsible for a lot
of damage which can be constrained by remotely by an
assailant. Disavowals can be installed utilizing botnets for
sending Spam or Phishing messages. furthermore they can be
deployed for major identity theft or different maltreatment of
traded off machines(Thorsten and Niels, 2007). A bot is
introduced on a framework after a trade off and with a remote
control component it very well may be worked remotely by an
assailant by giving some self-assertive orders subsequently
overseeing the casualty's framework (Thorsten and Niels, 2007).
Five elements that include botnet assault: botnet administrator,
botnet controller, assortment of bots, botnet programming drop,
botnet target (Edward, 2012).
The above is the base for an assassin used to frame a system of
commercial machines engaged to control framework along these
lines an assassin can control enormous number of machines
utilizing bots simultaneously.A botnet is framed in way to
consolidate few more bots and with an effective intrusion,
strategic framework can be constrained by an attacker and
portrayal of bots can be characterized with three properties: a
remote control office, execution of a few orders and spreading
instrument for additional engendering (Thorsten and Niels,
2007).
Looking into the insights effecting the each trait, governing a
bot remotely is achieved by mindfully incorporating the focal
IRC server for discipline and control. In case of concealed tasks
they use DNS burrow rather of IRC convention. DDoS and
updates are two sorts of orders for SYN and UDP flooding and
spreading instrument resembles worm where a bot examines the
entire system ranges for vulnerabilities and proliferates
themselves (Thorsten and Niels, 2007).

References:
Thorsten Holz & Niels Provos. (2015). Virtual Honeypots:
Botnet Tracking to Intrusion Detection. Addison-Wesley
Professional,2007
Edward G.Amoroso.
Bottom of Form
11
Copyright © 2012, Elsevier Inc.
All Rights Reserved
Chapter 1
Introduction
Cyber Attacks
Protecting National Infrastructure, 1st ed.
2
• National infrastructure
– Refers to the complex, underlying delivery and support
systems for all large-scale services considered absolutely
essential to a nation
• Conventional approach to cyber security not enough

• New approach needed
– Combining best elements of existing security techniques
with challenges that face complex, large-scale national
services
All rights Reserved
C
h
a
p
te
r 1
–
In
tro
d
u
c
tio
n
Introduction
3

All rights Reserved
C
h
a
p
te
r 1
–
In
tro
d
u
c
tio
n
Fig. 1.1 – National infrastructure
cyber and physical attacks
4
All rights Reserved
C
h

a
p
te
r 1
–
In
tro
d
u
c
tio
n
Fig. 1.2 – Differences between
small- and large-scale cyber security
5
All rights Reserved
C
h
a
p
te
r 1
–

In
tro
d
u
c
tio
n• Three types of malicious adversaries
– External adversary
– Internal adversary
– Supplier adversary
National Cyber Threats,
Vulnerabilities, and Attacks
6
All rights Reserved
C
h
a
p
te
r 1
–

In
tro
d
u
c
tio
n
Fig. 1.3 – Adversaries and
exploitation points in national
infrastructure
7
All rights Reserved
C
h
a
p
te
r 1
–
In
tro
d

u
c
tio
n• Three exploitation points
– Remote access
– System administration and normal usage
– Supply chain
8
All rights Reserved
C
h
a
p
te
r 1
–
In
tro
d
u

c
tio
n• Infrastructure threatened by most common security
concerns:
– Confidentiality
– Integrity
– Availability
– Theft
9
All rights Reserved
C
h
a
p
te
r 1
–
In
tro

d
u
c
tio
n
Botnet Threat
• What is a botnet attack?
– The remote collection of compromised end-user machines
(usually broadband-connected PCs) is used to attack a
target.
– Sources of attack are scattered and difficult to identify
– Five entities that comprise botnet attack: botnet operator,
botnet controller, collection of bots, botnot software drop,
botnet target
10
All rights Reserved
C
h
a
p
te

r 1
–
In
tro
d
u
c
tio
n
• Five entities that comprise botnet attack:
– Botnet operator
– Botnet controller
– Collection of bots
– Botnot software drop
– Botnet target
• Distributed denial of service (DDOS) attack: bots
create “cyber traffic jam”
Botnet Threat
11

All rights Reserved
C
h
a
p
te
r 1
–
In
tro
d
u
c
tio
n
Fig. 1.4 – Sample DDOS attack from a
botnet
12
National Cyber Security
Methodology Components
All rights Reserved
C

h
a
p
te
r 1
–
In
tro
d
u
c
tio
n• Ten basic design and operation principles:
– Deception – Discretion
– Separation – Collection
– Diversity – Correlation
– Commonality – Awareness
– Depth – Response
13
• Deliberately introducing misleading functionality or
misinformation for the purpose of tricking an
adversary
– Computer scientists call this functionality a honey pot

• Deception enables forensic analysis of intruder
activity
• The acknowledged use of deception may be a
deterrent to intruders (every vulnerability may
actually be a trap)
All rights Reserved
C
h
a
p
te
r 1
–
In
tro
d
u
c
tio
n
Deception
14

All rights Reserved
C
h
a
p
te
r 1
–
In
tro
d
u
c
tio
n
Fig. 1.5 – Components of an interface
with deception
15
• Separation involves enforced access policy
restrictions on users and resources in a computing
environment
• Most companies use enterprise firewalls, which are

complemented by the following:
– Authentication and identity management
– Logical access controls
– LAN controls
– Firewalls
All rights Reserved
C
h
a
p
te
r 1
–
In
tro
d
u
c
tio
n
Separation

16
Fig. 1.6 – Firewall enhancements for
national infrastructure
All rights Reserved
C
h
a
p
te
r 1
–
In
tro
d
u
c
tio
n
17
• Diversity is the principle of using technology and
systems that are intentionally different in substantive
ways.

• Diversity hard to implement
– A single software vendor tends to dominate the PC
operating system business landscape
– Diversity conflicts with organizational goals of simplifying
supplier and vendor relationships
All rights Reserved
C
h
a
p
te
r 1
–
In
tro
d
u
c
tio
n
Diversity

18
All rights Reserved
C
h
a
p
te
r 1
–
In
tro
d
u
c
tio
n
Fig. 1.7 – Introducing diversity to
national infrastructure
19
• Consistency involves uniform attention to security
best practices across national infrastructure
components

• Greatest challenge involves auditing
• A national standard is needed
All rights Reserved
C
h
a
p
te
r 1
–
In
tro
d
u
c
tio
n
Commonality
20
• Depth involves using multiple security layers to
protect national infrastructure assets

• Defense layers are maximized by using a combination
of functional and procedural controls
All rights Reserved
C
h
a
p
te
r 1
–
In
tro
d
u
c
tio
n
Depth
21
All rights Reserved

C
h
a
p
te
r 1
–
In
tro
d
u
c
tio
n
security through defense in depth
22
• Discretion involves individuals and groups making
good decisions to obscure sensitive information
about national infrastructure
• This is not the same as “security through obscurity”
All rights Reserved

C
h
a
p
te
r 1
–
In
tro
d
u
c
tio
n
Discretion
23
• Collection involves automated gathering of system-
related information about national infrastructure to
enable security analysis
• Data is processed by a security information
management system.
• Operational challenges
– What type of information should be collected?
– How much information should be collected?

a
p
te
r 1
–
In
tro
d
u
c
tio
n
Fig. 1.9 – Collecting national
infrastructure-related security
information
25
• Correlation involves a specific type of analysis that
can be performed on factors related to national
infrastructure protection
– This type of comparison-oriented analysis is indispensable
• Past initiatives included real-time correlation of data
at fusion center
– Difficult to implement

h
a
p
te
r 1
–
In
tro
d
u
c
tio
n
27
• Awareness involves an organization understanding
the differences between observed and normal status
in national infrastructure
• Most agree on the need for awareness, but how can
awareness be achieved?
All rights Reserved
C
h
a

tro
d
u
c
tio
n
Fig. 1.11 – Real-time situation
awareness process flow
29
• Response involves the assurance that processes are
in place to react to any security-related indicator
– Indicators should flow from the awareness layer
• Current practice in smaller corporate environments
of reducing “false positives” by waiting to confirm
disaster is not acceptable for national infrastructure
All rights Reserved
C
h
a
p
te
r 1
–

u
c
tio
n
Implementing the Principles
Nationally

Botnet attack is where group of devices are infected by malware th.docx

Recommended

Recommended

More Related Content

Similar to Botnet attack is where group of devices are infected by malware th.docx

Similar to Botnet attack is where group of devices are infected by malware th.docx (20)

More from jackiewalcutt

More from jackiewalcutt (20)

Recently uploaded

Recently uploaded (20)

Botnet attack is where group of devices are infected by malware th.docx