Best Practice Detail

13-8-8913

Service Providers should maintain methods to detect likely bot/malware infection of customer equipment. Detection methods will vary widely due to a range of factors. Detection methods, tools, and processes may include but are not limited to: external feedback, observation of network conditions and traffic such as bandwidth and/or traffic pattern analysis, signatures, behavior techniques, and forensic monitoring of customers on a more detailed level.

Status: Rollover New

References/Comments: More information can be found at: http://teamcymru.org http://shadowserver.org http://abuse.ch http://cbl.abuseat.org Note that the Best Practices in this grouping are primarily aimed at ISPs that provide service to consumer end-users on residential broadband networks, but may be applicable to other users and networks as well.

Historical events:

• Service Providers
• Internet/Data
• Cyber Security
• Intrusion Detection
• CSRIC VII: Rollover New In CSRIC VII