Trying to figure out the general attitude towards Deception/Honeypots as production level ready systems to glean information about attackers?
I'm personally convinced of the value they could bring when deployed appropriately and leveraged intelligently, i.e used to answer specific questions about potential attackers and their methods.
What's your take?
@cstromblad @martinboller I definitely believe that one of the biggest problems resides in orgs thinking theyâre not a target. With that said, something I think have a big impact on the decision making is having the actual infrastructure and capability to handle things like honeypots etc. because thereâs no use in deploying these active countermeasures if you donât have the resources, personnel or competence to know what to do with it.
I think Mikko Hyppönen sums it up pretty good in his latest book when asked why a company spends so much money on security. He responded with something in line with âwell your conference room looks really nice and tidy, maybe you can save some money laying off all janitors and cleanersâ.
Security is like that insurance you donât want to pay for because your apartment has never had a water leak or youâve never been in a car accident.
@singe the idea is very much the same as intelligence led Threat Hunting. Hunting without a purpose is really nothing more than expecting to find evil because you want to.
Hypothesis driven hunting should translate equally well to Deception and Threat Intelligence. What question do you want answered? If you made an assumption about where initial access might occur, deception/Honeypots should ideally be placed close to these assumptions.
Hypothesis driven deception I guess you could say.
That's what I'm thinking. Will be exploring the idea/concept with a few customers to see what to make of it. I'll report back when the time is ripe :-)
@Magnus oh totally, I'm all for internal deployment. Externally it makes sense in certain cases if you have a strong case for eliminating FP and can do focused collection for very specific questions.
But the real value probably comes from deployment "inside" of a network. Question remains how it would play out in a zero trust network model...
@cstromblad @emmalbriant I personally love them. They are almost always actionable detections like:
* teach your admins that âlemme try to loginâ is not a great troubleshooting step for unidentified systems
* real baddies doing real baddie things
* scanners you didnât know you had running internally. Whoâs doing that, and why?
And they really help your security team get real experience with network segmentation. If baddies land on X can they reach my honeypot? It puts you into actionable learning mode so often.
Martin Boller
Christoffer S.
Puggmeister
Dominic White
Secrur3_ET
magnusstubman
Seth Hanford đĄ