- In this lesson, 2.5,
which is the last sub-lesson of lesson two,
we're gonna focus in on deception and disruption.
Now deception and disruption technologies and practices
are used to deceive potential attackers, or adversaries,
with the goal of, one, threat intelligence collection,
and, two, importantly, early breach detection.
To accomplish this task, we're gonna use honey traps.
Honey traps are a deception technique
that allows security defenders
to understand attacker behavior patterns.
Now honey traps will vary
based on design and how we're deploying them,
but here's what they all have in common,
they're intended to look really legitimate
to attract attackers, because that's our goal, right?
They're gonna be non-production systems, right?
We don't want them to really attack
anything we actually have,
but we want to tempt our adversaries, our attackers,
we wanna understand how they might attack us,
and then we wanna be able to apply that knowledge
to early breach detection.
Now there are different types of honey traps,
including honeypots, honeynets,
honeyfiles, and honeytokens.
A honeypot is going to be a decoy system.
Could be a web server, could be a database server,
could be a domain controller, could be an email server,
could be an FTP server.
It's just a decoy system.
I wanna stress, again, it's one we're using as a honeypot.
It's not being used in our production environment.
Now there are two types of honeypots.
There are high-interaction honeypots
and low-interaction honeypots.
A high-interaction honeypot
is really running the application that it says it is.
So if it says that it's a web server,
it's really let's say running IIS or Apache, right?
If it thinks it's a email server,
it's really running, maybe Exchange.
So that would be a high interaction.
A low-interaction honeypot isn't actually running
those applications or providing those services,
but it appears to the attacker
that they are because they're listening
on a particular port.
So we know that there's communication on port 80
for HTTP or for a web server, port 21 for FTP,
and so they're listening on those ports.
And so when the attacker says,
"Let me see what ports are open on that device,"
they might see the HTTP, or HTTPS,
port 80 or 443 is open and they're gonna think,
"Aha, that must be a web server or FTP.
Oh, that must be an FTP server."
Hard to find, but if you can find it,
there is a nice, little low-interaction honeypot
called BackOfficer Friendly.
If you can still find it out there,
it's worth bringing that into your lab.
It's a really fun one.
You can have BackOfficer Friendly listen
on port 80 or 443 for HTTP and HTTPS.
They can listen on FTP, it can listen on Telnet ports.
It can also even do some fake responses.
It's just a fun thing to play
around with in your lab if you can find it.
It's called BOF, BackOfficer Friendly.
Now a honeynet is just multiple linked honeypots
that simulate a network environment.
A honeyfile is a decoy file
located on a network file share,
and they're really designed to tempt access,
then detect access and exfiltration attempts.
So it'll often have a really, really tempting name,
like CEO payroll type of thing so that they can say,
"Oh, I wanna see what that is,"
you know, let's see who's going after it.
And then, lastly, we have a honeytoken.
A honeytoken is a beacon that's actually embedded
into either a document or a database.
It can be embedded in an image, in a directory, in a folder.
But the key about a honeytoken
is that it goes with the attacker,
and it can ultimately be used to tell us
about what the attacker's doing
and maybe even who the attacker is.
So these honeytokens are used to track malicious actors
revealing critical information about their identity,
as well as the methods that they use to exploit a system.
So they can be a really, really effective tool
in identifying our cyber attackers, or our adversaries,
because they can send specific information
back to us about an attacker
that we might not otherwise ever be able to glean or get.
Now honeytokens, as I mentioned a moment ago,
can really be embedded in a variety of locations.
They can be in executable files,
they can be in database records,
they can be in browser cookies,
they can be in images, they can even be in APIs,
application programming interfaces.
Really interesting.
You should read up more about honeytokens.
I think they're a fascinating, fascinating tool.
Now there are some other types of traps
you wanna be familiar with.
There are spam traps,
which are just fake email addresses
that are used to identify and to block spammers.
Now legitimate email is really unlikely
to be sent to the fake address,
so when the email is received, it is most likely spam.
And then, we have DNS sinkholes.
A DNS sinkhole is a DNS server
that is going to respond with false results.
Now DNS sinkholes can be used
to redirect malicious internet traffic
so it can be captured and analyzed by security analysts.
And those sinkholes are most often used
to seize control of a botnet
by interrupting the DNS names of the botnet
that's used by the malware.
And that, my friends, brings us to the end
of deception and disruption.
So let's do a three-second challenge together.
You know how to do these.
You ready to shout 'em out?
Let's do it.
Decoy file located on a network file share.
What is that?
One, two, three.
That's a honeyfile.
These are kind of gimmes, aren't they?
Number two, multiple linked honeypots
that simulate a network environment.
One, two, three.
A honeynet.
Number three, type of honeypot that imitates services.
A type of honeypot that imitates services.
One, two, three.
That's a low-interaction honeypot, right?
It pretends, it's listening.
It's not really offering those services.
Number four, type of honey trap
that incorporates an embedded beacon.
One, two, three.
That's called a honeytoken.
And lastly, number five, the type of trap
that responds with false domain names or URLs.
One, two, three, what do you got?
It's gonna be a DNS sinkhole, good work.
All right, let's go into our security in action case study.
This one's about identifying cyber criminals.
At a staff meeting, your boss noted
that the European Union Agency for Cybersecurity,
or ENISA, has specifically recommended the use of honeypots
and honeytokens to trap or ensnare cyber criminals.
You've been assigned the task of researching
the difference between the two,
honeypots and honeytokens, and reporting back.
So I want you to summarize your research.
You have to report back the difference between the two,
between the honeypot and a honeytoken.
So go ahead, put me on pause,
write down a couple of notes.
What's the difference between the two?
And summarize them,
and then you're gonna report right back on it.
Well, first off, both honeypots and honeynets
are decoy-based tools, right?
So no difference there,
they're both decoy-based tools.
But honeypots are passive network detection systems.
The objective of a honeypot
is to gather attack strategy for analysis.
We're seeing how we might be attacked
so that we can better understand
the attacker's strategy, right?
We might use that to put more controls in place,
maybe deterrent controls, preventative controls,
detective controls, corrective controls.
We also might use it for early breach detection.
Honeytokens are like honeypots
as they're designed to attract our attackers,
but they have the added benefit of being able
to track and capture adversarial activities,
identity, and location,
and there are a whole variety of types of honeytokens.
So think of honeypots as passive,
honeytokens are active
and allow us to really, really get information
about our adversaries, who they are potentially,
how they're doing whatever bad stuff they're doing,
and where they are.
And being able to explain these two,
well, definitely that's security in action.
That brings us to our word cloud.
Not a lot there,
but make sure that you know what all of these terms mean.
All right, see you at the next lesson.