1.2 Deception & Disruption

Question 1

Honeypots

Answer 1

A way to attract the bad guys to your system and keep them involved and see their techniques to attack.

The attacker is usually a machine.

Honeypots are virtual worlds that attract attackers.

Many different options. Most are available to download.

Constant battle to discern the real from the fake.

Question 2

Honeynets

Answer 2

A larger infrastructure with servers, workstations, routers, switches, and firewalls. More than a single device.

Honeynets. Build a larger deception network with one or more honeypots.

More than one source of information.

Question 3

Honeyfiles

Answer 3

Create fake information for attackers. Fake and shiny.

Honeyfiles. Bait for the honeynet (passwords.txt). Add many honeyfiles to file shares.

An alert is sent if the file is accessed. A virtual bear trap.

Question 4

Honeytokens

Answer 4

Track the malicious actors. Add some traceable data to the honeypot. If the data is stolen, You’ll know where is came from.

API credentials. Does not actually provide access. Notifications are sent when used.

Fake email addresses. Add it to a contact list. Monitor the internet to see who posts it.

Other honeytoken examples. Database records, browser cookies, web page pixels.