At the BSides Augusta 2016 conference, I presented the economic challenges of defensive security and how honeypots can be used for cost effective network security monitoring.
3. Agenda
Security Economics
Traditional Honeypots
NSM Honeypots
Honeypot Applications
“Why honeypots are a cost effective strategy for
enhancing your network security monitoring
strategy.”
4.
5. Economics of Security
“If you want to understand the world of nature,
master physics. If you want to understand the
world of man, master economics.” - Taufiq
Rashid
High
Demand for
Security
Expertise
Low Supply
of Security
Practitioners
Expertise
Services
Software
9. Seminal Work
Large Orgs and Defense
Many Academic Papers
The Honeynet Project
Honeyd Software
10. Traditional Honeypots
Designed to be
attacked
Intentionally vulnerable
Primarily used for
specific research
Originally useful for
learning about
attackers
Useful for tracking
scanning and
proliferation of worms
12. Hold Your Horses!
1. Honeypots take a
lot of time to
maintain.
2. Honeypots
introduce
tremendous risk.
3. Attackers can use
honeypots as a
foothold.
4. Honeypots are
only for the most
mature
13.
14. NSM Honeypots
Premise:
Nobody should ever talk
to a honeypot
Attributes:
1. Placed inside the
network
2. Mimic existing systems
3. Low interaction
4. Extensive logging and
alerting
5. Goal oriented
21. Protect the Systems
Mimic Reality
Capture
Interaction
Generate an
Alert
Protect: Windows Systems using RDP
1. Deploy an RDP Honeypot [Tom’s,
OpenCanary]
2. Capture any connection attempt
3. Generate an alert to your SIEM/SOC
22. Protect the Data
Mimic Reality
Capture
Interaction
Generate an
Alert
Protect: HR data in spreadsheets
1. Deploy a HoneyDoc
2. Embed web bug that phones home
3. Configure OS file access monitoring
4. Generate an alerts when doc phones home,
or when file is accessed.
23. Protect the Users
Mimic Reality
Capture
Interaction
Generate an
Alert
Protect: Service account credentials
1. Create limited access honeyusers [DCEPT]
2. Detect cleartext credentials in memory
3. Generate an alert to your SIEM/SOC
24.
25.
26. The Challenge
Analysts…
...start looking for implementation opportunities.
Managers…
...ensure this technique is part of your analysts
toolbelt.
Vendors…
...develop affordable honeypot-based solutions.
Open Source Contributors…
...drive innovation in this space.
Security is only affordable for:
Military/Gov
Financial
Post-Breach Orgs
Economics of security are heavily tilted towards the attacker. As long as this remains, we continue to lose and lose ground.
This is why most new tech fails. We’ve had electric cars forever, they are just too expensive to operate, maintain, and charge.
We can go to space, but not affordably, yet.
TIME CHECK – 15 MINUTES
TIME CHECK – 20 MINUTES
If you get an alert from a honeypot, it’s worth investigating.
If someone hits your sign, the honeypot, they might hit your bridge, the sensitive system.
A great NSM strategy is like a great cheeseburger.