Endpoint

8/27/2018
10:30 AM
Marc Laliberte
Marc Laliberte
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

The Difference Between Sandboxing, Honeypots & Security Deception

A deep dive into the unique requirements and ideal use cases of three important prevention and analysis technologies.

Networks, cyberattacks, and the strategies used to stop them are continuously evolving. Security deception is an emerging cyber-defense tactic that allows researchers and information security professionals to observe the behavior of attackers once they've gained access to what they think is a business network.

The term "security deception" only came into wide usage in the last year, so it can be difficult to tell how exactly these solutions are different from other tools that try to trick attackers, such as sandboxing and honeypots. Like these other tactics, security deception fools attackers and malicious applications into revealing themselves so that researchers can devise effective defenses against them, but it relies more on automation and scale, and requires less expertise to set up and manage. Each of these technologies has unique requirements and ideal use cases. To understand what those are, we'll need to look at each of them in more detail.

Sandboxing
The need for the analysis of network traffic and programs has existed almost since the dawn of networks and third-party programs. Sandboxing, introduced in the 1970s for testing artificial intelligence applications, allows malware to install and run in an enclosed environment, where researchers can monitor their actions to identify potential risks and countermeasures. Today, effective sandboxing is most often performed on dedicated virtual machines on a virtual host. This allows for malware to be safely tested against multiple different OS versions on machines that are segregated from the network. Security researchers use sandboxing when analyzing malware and many advanced anti-malware products use it to determine whether or not suspicious files are truly malicious based on their behavior. These kinds of anti-malware solutions are becoming more important because so much of modern malware is obfuscated to avoid signature-based antivirus.

Most businesses aren't capable of performing malware analysis with same level of sophistication and expertise as a dedicated researcher or vendor. Smaller businesses typically benefit the most from deploying sandboxing as service from a provider that already has implementations in place that can automate the whole process.

Honeypots
Honeypots and honeynets are deliberately vulnerable systems meant to draw the attention of attackers. Honeypots are single hosts that entice attackers to attempt to steal valuable data or further scope out the target network. The idea behind honey nets, which began to circulate in 1999, is to understand the process and strategy of attackers. Honeynets are made up of multiple honeypots, often configured to emulate an actual network — complete with a file server, a web server, etc. — so that attackers believe they've successfully infiltrated a network. Instead, they're actually in an isolated environment, under a microscope.

Honeypots let researchers watch how real threat actors behave, while sandboxing reveals only how malware behaves. Security researchers and analysts commonly use honeypots and honeynets for this exact purpose. Researchers as well as IT and security pros concerned with defense can use this information to improve their organization's security by noting new attack methods and implementing new defenses to match. Honeynets will also waste attackers' time and can get them to give up the attack in frustration. This is most useful for government organizations and financial institutions that are targeted by hackers often, but any business of medium size or larger will benefit from a honeynet. Small and medium-sized businesses (SMBs) may benefit as well, depending on their business model and security situation, but most SMBs today don't have a security expert capable of setting up or maintaining a honeypot.

Cyber Deception
The core idea of cyber deception was first discussed in 1989 by Gene Spafford of Purdue University. Some argue that it more or less refers to modern, dynamic honeypots and honeynets and, fundamentally, they are correct. Security deception is a new term and so the definition hasn't yet been set in stone, but in general it refers to a range of more-advanced honeypot and honeynet products that offer more automation for both detection and the implementation of defenses based on the data they gather.

It's important to note that there are different levels to deception technologies. Some are little more than a honeypot, while others mimic full-blown networks that include real data and devices. Benefits include the ability to spoof and analyze different types of traffic, provide fake access to accounts and files, and the ability to more closely imitate an internal network. Some security deception products can be deployed automatically, keep attackers busy in loops of access for more information, and give users more detailed and realistic responses to attackers. When a security deception product works as intended, hackers will truly believe they've infiltrated a restricted network and are gathering critical data. It's true, they'll be accessing data, but it will only be information you intend for them to see.

Security deception is still in its infancy, so as with most new security technologies, its initial use case is as a niche tool for large enterprises that will gradually move down market. At present, these tools are particularly relevant for high-profile targets such as government facilities, financial institutions, and research firms. Organizations still need a security analyst to parse the data from security deception tools, so smaller companies without specialized security staff typically wouldn't be able to tap into the benefits. That said, SMBs can benefit from contracting with security vendors that offer analysis and protection as a service.

All these security technologies have their role in the prevention and analysis landscape. At a high level, sandboxing involves installing and allowing malware to run for behavioral observation, while honeypots and nets focus on the analysis of threat actors conducting reconnaissance on an infiltrated network, and security deception is the more recent conception of advanced intrusion detection and prevention. Deception technologies offer more realistic honeynets that are easier to deploy and provide more information to users, but they come with higher budgetary and expertise requirements that typically restrict their use to large enterprises ... at least for the moment.

Related Content:

Marc Laliberte is an information security threat analyst at WatchGuard Technologies. Specializing in network security technologies, Marc's industry experience allows him to conduct meaningful information security research and educate audiences on the latest cybersecurity ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Microsoft President: Governments Must Cooperate on Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/8/2018
5 Reasons Why Threat Intelligence Doesn't Work
Jonathan Zhang, CEO/Founder of WhoisXML API and TIP,  11/7/2018
Why Password Management and Security Strategies Fall Short
Steve Zurier, Freelance Writer,  11/7/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Online Malware and Threats: A Profile of Today's Security Posture
Online Malware and Threats: A Profile of Today's Security Posture
This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-2491
PUBLISHED: 2018-11-13
When opening a deep link URL in SAP Fiori Client with log level set to "Debug", the client application logs the URL to the log file. If this URL contains malicious JavaScript code it can eventually run inside the built-in log viewer of the application in case user opens the viewer and taps...
CVE-2018-2473
PUBLISHED: 2018-11-13
SAP BusinessObjects Business Intelligence Platform Server, versions 4.1 and 4.2, when using Web Intelligence Richclient 3 tiers mode gateway allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.
CVE-2018-2476
PUBLISHED: 2018-11-13
Due to insufficient URL Validation in forums in SAP NetWeaver versions 7.30, 7.31, 7.40, an attacker can redirect users to a malicious site.
CVE-2018-2477
PUBLISHED: 2018-11-13
Knowledge Management (XMLForms) in SAP NetWeaver, versions 7.30, 7.31, 7.40 and 7.50 does not sufficiently validate an XML document accepted from an untrusted source.
CVE-2018-2478
PUBLISHED: 2018-11-13
An attacker can use specially crafted inputs to execute commands on the host of a TREX / BWA installation, SAP Basis, versions: 7.0 to 7.02, 7.10 to 7.11, 7.30, 7.31, 7.40 and 7.50 to 7.53. Not all commands are possible, only those that can be executed by the <sid>adm user. The commands execut...