Can we check our company network for botnet infections for free?
Partly, yes. Several national bodies offer free services: in Spain, INCIBE's Antibotnet service checks whether your public IP address appears in reports of infected devices, and national CERTs in other countries pass similar reports on to the owners of affected networks; ask your internet provider whether it forwards them to you. Free checks on your side help too: your firewall's log of blocked outbound connections, DNS logs that show lookups of known malicious domains, and any device that calls the same outside server around the clock. A reputation check tells you that something behind your public address was reported, not which device it was. NetSenX flags command-and-control beaconing per host on every plan, Free included, which points to the device itself.
Read next
Related questions
- What is a compromise assessment, and do we need one?
- A company in our sector was hacked. How do we check whether we are next?
- What should we look for on our network after a partner or peer company is breached?
- We had an incident last year. How do we make sure we would detect it if it happened again?
- Why do companies so often learn about a breach from outsiders?