Botnet

What it means

A botnet is a network of computers, phones, routers or cameras infected with malware that an attacker controls remotely without the owners knowing. The individual devices, called bots, carry out commands from a control server.

Botnets are used to send spam and phishing, launch DDoS attacks that overwhelm websites, try stolen passwords in credential stuffing or mine cryptocurrency on other people's devices.

Devices with outdated software and default passwords, such as cheap cameras or routers, are the most vulnerable. Owners often notice nothing except a slower internet connection.

How it works in practice

Company devices in a botnet are a risk to the company and to others. The internet provider may cut off the connection, and the company's IP address may land on spam blacklists so that its emails stop reaching customers.

Protection includes regular patch management, changing default passwords, putting internet-of-things devices on a separate network and tools such as EDR that detect suspicious behaviour.

If a company is the target of a botnet DDoS attack, CDN and DDoS protection services help. A serious attack on an operator of an essential service also triggers incident reporting duties.

What to watch out for

Small business owners often underestimate devices such as printers, cameras or smart thermostats. These are frequently the weakest link because they are forgotten when updates are done.

When investigating an incident, remember the GDPR: if an attacker gained access to personal data through a botnet, it may be a personal data breach that must be reported within 72 hours.