Next-Gen Honeypots – welcome to tactical diversion-driven defence
- 14 April, 2016 10:45
Anyone worth their infosec salt knows about honeypots – decoys that are placed within a network so that would be hackers easily find and exfiltrate worthless information. You might have a spreadsheet called “user_accounts.xlsx” sitting in a relatively unprotected fileshare that distracts adversaries from your real crown jewels.
LogRhythm’s Global Vice President of Solutions, Trent Heisler, says tactical diversion-driven defence is “a fancy way of saying what tools and techniques can you use to defend the network using diversion techniques”.
Unlike traditional honeypots, tactical diversion-driven defence is far more sophisticated.
These next-gen honeypots not only draw would-be attackers to a specific payload but keep them engaged so you’re able to learn what tools they are using, what methods they employ and their real goals.
As well traditional honeypots Heisler says it’s about using honey tokens, document bugging and other tools.
Tactical diversion-driven defences aren’t “entry level” tools. They require a degree of operational security maturity.
“If you look at maturity on a scale of zero to four, with zero being blind, to one being minimally compliant, two where you’re checking boxes for compliance to PCI and other mandates, all the way to three which is vigilant and four where you’re completely resilient – the audience that tends to invest in these types of techniques is somewhere at the maturity level of two and a half or above”.
The value of this data is considerable. Once an attack is understood it becomes possible to use that threat intelligence to proactively identify breaches. “There is a wealth of information when you set up these trap-doors,” says Heisler. “You learn about your adversary. The idea isn’t to set up traps just to set up traps. Use that information”.
By understanding the attacker’s tools and behaviour you can then focus your defences on protecting your true “gold nuggets” rather than spreading your security spend and effort thinly across everything.
“This reduces the mean time to detect and how quickly I can respond to an incident,” says Heisler.
For example, you can use the attribution of an attack to feed analytics tools and use it on the production network to create adaptive defences, blacklists and see what executables and user-agent strings are being leveraged.
“I’m creating a dynamic threat intelligence feed on how adversaries are attacking me as a corporation specifically,” he says.
As a flow on, this can be used to initiate orchestration and automation – important tools during an era where infosec skills are in high demand and operations teams are operating under considerable pressure.
As well being able to use these next-gen honeypots to protect production systems, Heisler says you can move to a more offensive cyber-posture.
“You can go as far as setting your document bugs, getting them to come after that and see who they’re sharing these documents with. It might be an insider threat – it’s not just APTs or the external threat”.
“It’s no longer about prevention-centric technologies. We know they’re going to get in. How quickly in the kill chain can we find them and mitigate,” says Heisler.
Participate in this short survey on IT security strategies across the Australian market and go in the draw to WIN a 360Fly camera vailued at $689.
