Dark Reading

About 3 to 5 percent of all systems in an enterprise are infected with bot-related malware -- even within organizations running up-to-date antimalware tools, according to new data from Damballa.

Antivirus software immediately discovered only 53 percent of malware samples, according to data gathered by Damballa in a six-month study that used McAfee Scan Engine v5.3.00 to scan more than 200,000 malware samples. Another 32 percent were found later on, and 15 percent were not detected at all. The average delay in detection and remediation was 54 days.

"The window of catch-up is 54 days...that's a long delay," says Bill Guerry, vice president of product management for Damballa. "So if you're relying on AV, it's able to detect a little over half of malware immediately."

Damballa says the malware gap with today's antivirus products is a contributing factor to the enterprise bot problem. "One of our clients said it's not unusual for them to see 100 new [botnet] compromises in a day [in its environment]," Guerry says.

In conjunction with its study, Damballa today also rolled out its first hardware product, the Failsafe 3.0 appliance, which detects targeted, bot-driven attacks. Damballa traditionally has offered a "cloud" bot detection and protection service, focusing on botnet command and control infrastructure to detect malicious activity within an organization.

Failsafe 3.0 includes a management console and will ship this month, with pricing starting at $100,000 for 10,000 nodes. It's aimed at organizations that prefer to keep their botnet-detection "locally in the cloud," Guerry says. "This is sensitive information to these clients," he says.

Damballa has also built a prototype, host-based botnet-remediation tool that it hopes to release this year. The so-called Remediator will let organizations handle remediation on a host-by-host basis. "It's not an AV agent running all the time...you can load and remove it," Guerry says.

Steve Linowes, CEO at Damballa, says the goal of Remediator is not to replace AV tools, but to assist the help desk. "Companies we work with have defined processes in place already to handle incidents like this," he says. "They have help desk support and processes for remediating their compromised assets. Our desire is to fit into those processes they have in place."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message