No one knows for sure how many bots are out there, but Mi5 Networks has discovered them in approximately 65 percent of the enterprises and 100 percent of the universities we've worked with this year. What's amazing to watch is the amount of activity even one bot can generate. It's not unusual for a single bot to perform more than 1 million IP scans and hundreds of thousands of spam-related communications in a single day. In one network of more than 8,000 PCs, for example, we found 145 bots in the first month, but those bots performed more than 136 million IP scans during that time.

Bot Detection and Prevention Best Practices
The amount of C&C traffic crossing the firewall is intentionally kept very low, allowing bots to avoid detection from traditional intrusion protection systems and other security measures. Although some ISPs and security monitoring services can tell if significant spam or DDoS traffic is coming from an IP address space within an organization, they can't definitively confirm whether machines within the corporate network are infected, nor which machines are generating the traffic. What's required to pinpoint hijacked machines inside the firewall is the ability to monitor internal network traffic in addition to the data coming in and going out of the enterprise. This visibility exposes how botnets spread internally, send out spam, launch DDoS attacks and so on. Ideally, a security system will also block communication out of the network from infected machines and even automatically dispatch cleanup agents.

Like most security issues, there isn't a single magic bullet to stop bots, but the first step is to implement a layered defense (desktop + gateways) that limits the number of bot infections. Beyond that, enterprises need early warning systems that can detect infected PCs inside their network and block those machines from communicating sensitive data back out.

According to recent research by Gartner, the Web perimeter remains the biggest unprotected border within most organizations' networks today. Although most enterprises have URL filtering in place, fewer than 15 percent have adequate protection from Web-based malware. Gartner predicts that by the end of 2007, 75 percent of enterprises will be infected with undetected, financially motivated, targeted malware that have evaded their traditional perimeter and host defenses.

Doug Camplejohn is founder and CEO of Mi5 Networks, a vendor of Web security gateways.