The Reign of Botnets

6Defense and Response Strategy

Effective detection methods must be tightly coupled with adequate response strategies. This chapter provides best practices for efficiently handling bot and fraud activity.

Developing a Defense Strategy

The detection methods (IP intelligence, device intelligence, proof of work, email intelligence, headless browser detection, etc.) must be adapted to the use case (credential stuffing, account opening abuse, web scraping, etc.). However, the detection methods must be coupled with strong response strategies to efficiently mitigate the activity detected. Procedures must also be in place to operationalize the solution, analyze the activity regularly using the methodology described in Chapter 5, “Assessing Detection Accuracy,” and adjust the detection and mitigation strategy to obtain the best result. A good detection and mitigation strategy and strong operational procedures that explain what is to be protected, for what purpose, and how often the bot activity and setup should be assessed define your defense strategy.

The strength of the defense strategy and the discipline of the web security team executing it is key to the endeavor's success. This is not a race. This is a marathon, so be prepared to consistently follow the defense strategy in the long run and never let your guard down. The adversary will always exploit any possible weaknesses of ...