BotnetMania: Symptom or Disease?

The rise to power of the botnets has forced many security professionals to find innovative ways to combat the threat that these menacing botnets pose to organizations, businesses, and the whole internet ecosystem. However, most if not all of the solutions being brought forward are technical and are not addressing the true cause. In fact, I would argue that botnets are not even the problem; they are a symptom of a disease that has plagued our society for far too long: organized crime.

The mob exists for a single reason: to make huge monetary gains through illict means. Over time as societal needs shift so too do the gangsters' tactics. Case in point, during the prohibition era, the most common tactic was the smuggling of alcohol. Fast-forward today and it's obvious that there is no money to be had in smuggled booze. Wherever the biggest and fastest buck can be made that's where you'll find them.

The main point is that the cat-and-mouse game that is playing out with botnets be fought not only with technical security defence tactics but that the underlying problem be corrected. As with any other disease, you need to treat the cause not the symptoms. While we as information security professionals need to focus our energies on keeping the botnet symptoms under control it is important not to lose sight of what's causing these symptoms to occur in the first place.

In addition to using "good" technology to combat the symptoms there needs to be international collaboration (and cooperation) on the law enforcement front. A people problem needs a people solution. The best way to undermine the physical criminal networks is through good old fashioned police-detective work; only then will we start to gain control of the perpetual situation.

While we may eventually stumble upon a technical fix that solves the botnet problem; the "bad" guys will merely change tactical gears and try to exploit something else for monetary gain. So the problem really isn't gone, it's just changed appearance.

Technology alone never solves a problem (it is simply a tool that is used by people and processes). At its core, botnets are just one of the tactics employed by organized crime syndicates to achieve their strategic goals. Pure and simple, ridding the world of organized crime has always been a people problem and therefore "good" people need to be part of the solution. We likely will win the botnet battle but like all the past battles with the mob, they will follow the money onto the next battlefield and the raging war will continue indefinitely.