{"id":96260,"date":"2020-10-09T19:42:45","date_gmt":"2020-10-09T17:42:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/honeypot-vs-deception-na-primere-xello"},"modified":"2020-10-09T19:42:45","modified_gmt":"2020-10-09T17:42:45","slug":"honeypot-vs-deception-na-primere-xello","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/honeypot-vs-deception-na-primere-xello","title":{"rendered":"Honeypot vs Deception using Xello as an example","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Honeypot<\/p>\n

There are already several articles on Habr about Honeypot and Deception technologies (1 article<\/a><\/noindex>, 2 articles<\/a><\/noindex>). However, we still encounter a lack of understanding regarding the differences between these classes of protection tools. To clarify this, our colleagues from Xello Deception<\/a><\/noindex> (the first Russian developer of Deception platforms<\/a><\/noindex>) decided to describe in detail the distinctions, advantages, and architectural features of these solutions.<\/p>\n

Let's understand what «honeypots» and «deceptions» are:<\/h2>\n

«Deception technologies» emerged in the market of information security systems relatively recently. However, some experts still consider Security Deception to be just a more advanced version of «honeypots». <\/p>\n

In this article, we will highlight both the similarities and fundamental differences between these two solutions. In the first part, we will describe \u201choneypots,\u201d how this technology has developed, and what its advantages and disadvantages are. In the second part, we will focus on the principles of operation for creating a distributed deception infrastructure (Distributed Deception Platform \u2014 DDP). <\/p>\n

The basic principle underlying honeypots is the creation of traps for hackers. The earliest Deception solutions were developed based on this same principle. However, modern DDPs significantly surpass honeypots in both functionality and effectiveness. Deception platforms include traps, lures, applications, data, databases, and Active Directory. Modern DDPs can provide extensive capabilities for threat detection, attack analysis, and automated responses. <\/p>\n

Thus, Deception represents techniques that simulate a company's IT infrastructure and mislead hackers. As a result, such platforms can halt attacks before they cause significant damage to the company's assets. Honeypots, of course, do not offer such a wide range of functionality or level of automation, making their application require higher qualifications from information security department staff.<\/p>\n

1. Honeypots, Honeynets, and Sandboxing: what are they and how are they applied<\/h2>\n

For the first time, the term «honeypots» was used in 1989 in Clifford Stoll's book «The Cuckoo\u2019s Egg», which describes events related to tracking a hacker at the Lawrence Berkeley National Laboratory (USA). In practice, this idea was realized in 1999 by Lance Spitzner, an information security specialist at Sun Microsystems, who founded the research project «Honeynet Project». The first honeypots were very resource-intensive, complex to set up and maintain. <\/p>\n

Let\u2019s take a closer look at what honeypots <\/strong>and honeynets<\/strong>. Honeypots are standalone hosts designed to lure attackers into infiltrating a company's network and attempting to steal valuable data, as well as to expand the network's attack vector. A honeypot (literally translated as \"barrel of honey\") is a specialized server equipped with a variety of network services and protocols, such as HTTP, FTP, etc. (see Fig. 1).<\/p>\n

\"Honeypot<\/p>\n

If we combine several honeypots <\/strong>into a network, we get a more effective system of honeynet<\/strong>, which emulates the corporate network of a company (web server, file server, and other network components). This solution allows understanding the strategies employed by attackers and misleading them. A typical honeynet usually operates parallel to the operational network and completely independently of it. Such a \"network\" can be published online via a separate channel, and a separate range of IP addresses can also be allocated for it (see Fig. 2).<\/p>\n

\"Honeypot<\/p>\n

The purpose of using a honeynet is to show the hacker that they have allegedly penetrated the corporate network of the organization, while in reality, the attacker is in an \"isolated environment\" and under close observation by information security specialists (see Fig. 3).<\/p>\n

\"Honeypot<\/p>\n

It is also important to mention a tool calledsandbox<\/strong>\", which allows attackers to install and run malicious programs in an isolated environment where IT specialists can track their actions to identify potential risks and take necessary countermeasures. Currently, sandboxing is typically implemented on dedicated virtual machines on a virtual host. However, it should be noted that sandboxing only shows how dangerous and malicious programs behave, while a honeynet helps specialists analyze the behavior of \"dangerous actors.\" sandbox<\/strong>), which allows attackers to install and run malicious programs in an isolated environment where IT specialists can monitor their actions to identify potential risks and implement necessary countermeasures. Currently, sandboxing is typically implemented on dedicated virtual machines on a virtual host. However, it should be noted that sandboxing only shows how dangerous and malicious programs behave, while a honeynet helps specialists analyze the behaviors of \u201cdangerous players.\u201d <\/p>\n

The clear benefit of honeynets is that they mislead attackers, wasting their strength, resources, and time. As a result, instead of real targets, they attack decoys and can cease their attack on the network, achieving nothing. Honeynet technologies are most commonly used in government institutions and large corporations, as these entities are often targets of major cyberattacks. However, small and medium-sized businesses (SMBs) also need effective tools to prevent cybersecurity incidents, although using honeynets in the SMB sector is not straightforward due to a lack of qualified personnel for such complex work.<\/p>\n

Limitations of Honeypots and Honeynets<\/u><\/strong><\/p>\n

Why are honeypots and honeynets not the best solutions for countering attacks today? It should be noted that attacks are becoming more extensive, technically complex, and capable of inflicting serious damage on an organization\u2019s IT infrastructure. Cybercrime has emerged at an entirely different level, representing highly organized shadow business structures equipped with all necessary resources. Additionally, the 'human factor' (errors in software and hardware configuration, insider actions, etc.) must be considered, making the use of only technology to prevent attacks insufficient at this point. <\/p>\n

Below are the main limitations and drawbacks of honeypots (honeynets):<\/p>\n

    \n
  1. \n

    Honeypots were initially designed to identify threats that are outside the corporate network, focusing more on analyzing the behavior of attackers rather than on rapid threat response. <\/p>\n<\/li>\n

  2. \n

    Attackers have generally learned to recognize emulated systems and avoid honeypots. <\/p>\n<\/li>\n

  3. \n

    Honeynets (honeypots) have an extremely low level of interactivity and interaction with other security systems, making it difficult to obtain detailed information about attacks and attackers when using honeypots, and thus respond effectively and quickly to cybersecurity incidents. Moreover, cybersecurity specialists receive a high number of false alerts about threats. <\/p>\n<\/li>\n

  4. \n

    In some cases, hackers may use a compromised honeypot as a starting point to continue their attack on the organization's network. <\/p>\n<\/li>\n

  5. \n

    Honeypots often face scalability issues, high operational load, and system configuration challenges (they require highly skilled specialists and lack user-friendly management interfaces, etc.). There are significant difficulties in deploying honeypots in specialized environments such as IoT, POS, and cloud systems.<\/p>\n<\/li>\n<\/ol>\n

    2. Deception technology: benefits and core principles of operation<\/h2>\n

    After examining all the advantages and disadvantages of honeypots, we conclude that a completely new approach to incident response in cybersecurity is necessary to develop a quick and adequate response to attacker actions. Such a solution lies in technologies. Cyber deception (Security deception)<\/strong>. <\/p>\n

    The terminology «Cyber deception», «Security deception», «Deception technology», «Distributed Deception Platform» (DDP) is relatively new and has emerged not so long ago. In fact, all these terms refer to the use of «deception technologies» or «IT infrastructure imitation and misinformation techniques against attackers». The simplest Deception solutions are an evolution of the honeypot concept, but at a more technologically advanced level that implies greater automation in threat detection and response. However, there are already serious DDP-class solutions on the market that offer ease of deployment and scaling, as well as a significant arsenal of traps and lures for attackers. For example, Deception allows for the emulation of IT infrastructure objects such as databases, workstations, routers, switches, ATMs, servers, SCADA, medical equipment, and IoT. <\/p>\n

    How does the «Distributed Deception Platform» work? After deploying the DDP, the IT infrastructure of the organization will be structured as if it consists of two layers: the first layer is the real infrastructure of the company, and the second is the «emulated» environment, consisting of traps (decoys, traps) and lures (lures) that are placed on real physical devices within the network (see Fig. 4).<\/p>\n

    \"Honeypot<\/p>\n

    For instance, an attacker may discover fake databases with 'confidential documents,' along with counterfeit credentials of supposedly 'privileged users' \u2014 all of these are decoy targets that can attract intruders, diverting their attention from the company's true information assets (see Fig. 5).<\/p>\n

    \"Honeypot<\/p>\n

    DDP is a newcomer in the cybersecurity product market, having been around for only a few years and currently accessible only to the corporate sector. However, small and medium businesses will soon also be able to benefit from Deception by renting DDP from specialized providers 'as a service.' This option is even more convenient as there's no need for in-house highly skilled staff.<\/p>\n

    Below are the main advantages of Deception technology:<\/p>\n