June 2, 2016
Joe Franscella

The Importance of Forming a Modern Honeypot Network

<p>There are many reasons why it is important for your enterprise to invest the time and resources into building and to manage a honeypot using the Modern Honey Network (MHN). Hosting data on a network is a great responsibility. Stolen data cannot be returned to its owners like a stolen watch. Once compromised, you cannot take back stolen ideas or private information. Individuals and large corporations alike are obligated to <a href="https://www.anomali.com/blog/the-impact-of-global-threat-assessment">practice due diligence to protect their networks</a>. The people named in your records have trusted you with their identities and your company must protect its secrets to stay competitive.</p><p>You need to leverage the Modern Honey Network to collect data about threats in order to be aware of what your vulnerabilities are and to learn who is seeking to access your data and network. You must have time to respond, preferably during the criminal’s research phase or immediately upon a malware attack. Managing your honeypot requires a skilled user to install updates, facilitate data logging, perform integration with other applications, etc. Information about best practices is freely available. Low or high interaction environments can be set up on MNH servers. Many experts set up multiple instances of an MHN on other open source technologies – a Linux computer which is running Ubuntu is popular. Why reinvent the wheel when you can choose among options more fungible than developing your own honeypot from the ground up?</p><p>Open-source is a class of freeware usually created to serve a glaring need for technology solutions. This means open-source software is free to download and its source code made public so that others can study its workings and make their own innovations. The licensing allows for the creator or sponsoring organization to retain ownership and oversee user developments. Users can discuss modifications and collaborate to innovate new features. The underlying principle is that discovery comes quicker when fostered by cooperative sharing. Using open-source software carries with it an inherent expense for hosting plus labor costs for its ongoing management, but the program itself is free and <a href="https://www.anomali.com/blog/deploying-managing-and-leveraging-honeypots-in-the-enterprise-using-open-so">instructions for using the Modern Honey Network</a> are readily available. In some cases, you may need additional training for your staff or to hire consultants to get you started. Regardless, open-source software delivers access to a system that may have otherwise been unfeasible.</p><p>MHN is user friendly and can perform many functions automatically. The web-based interface is designed for usability and can be accessed via a browser, so you can use it without installing an application. Relying on centralized data and the innovation of the Modern Honey Network takes the guesswork out of updating your honeypot.</p><p>It is important to contribute data to the MHN. It improves security for everyone. When lots of different enterprises use and learn from their own threat intelligence, they collect valuable information. A <a href="https://corpgov.law.harvard.edu/2016/03/03/federal-guidance-on-the-cybersecurity-information-sharing-act-of-2015/" target="_blank">government initiative called CISA</a> (the Cybersecurity Information Sharing Act of 2015) encourages sharing collected data about threats and responsive tactics to a hub of knowledge via an anonymous means. This legislation was passed in the spirit of community working together to protect people and <a href="https://www.ftc.gov/news-events/press-releases/2015/08/ftc-awards-25000-top-cash-prize-contest-winning-mobile-app-blocks" target="_blank">promote the greater good</a>. Sharing data about suspicious traffic to a common entity such a cloud-based databank allows for a community of cooperation to form. Not only does sharing threat intelligence to the cloud build the library of profiles of known offenders; sharing and discussing the tactics different minds conceive contributes to a culture of innovation.</p><p>Using an intrusion detection system is comparable to having a security system for your home. Your data is valuable and protection for it must be proportional. It is very feasible for your company to apply Modern Honey Network technology on a scale appropriate for your network.</p><p>Are you thinking about building a threat intelligence program and need to know where to start? Download our free whitepaper and get a step by step approach on how to create a successful program.</p><p><span class="hs-cta-wrapper" id="hs-cta-wrapper-f68f0b2e-fb62-48eb-acd6-8b2ad6455083"><span class="hs-cta-node hs-cta-f68f0b2e-fb62-48eb-acd6-8b2ad6455083" data-hs-drop="true" id="hs-cta-f68f0b2e-fb62-48eb-acd6-8b2ad6455083" style="visibility: visible; display: block; text-align: center;"><a class="cta_button" cta_dest_link="{page_3451}" href="https://cta-service-cms2.hubspot.com/ctas/v2/public/cs/c/?cta_guid=0a81b108-0c35-466f-8ccb-36ff661bc040&amp;placement_guid=f68f0b2e-fb62-48eb-acd6-8b2ad6455083&amp;portal_id=458120&amp;redirect_url=APefjpH5ErbKBf4jIQtqHg-p9L12FoeRYvKZVkTAirzzZoCRQeoUCpffIqbsqee7wTPvkMPYD1L3ZwzPGb2wWyFnYhenvvuEbc6wIPaSeQvG_RdljvDnUep3XmBm-xFCm6t_KOzrEpqt29c7DM0cEm8mUjRu6CejCIh7h4ZmKDYIC5IRmCnu3exorzKR6c6QflyND56foZbAbSKbjTMZxWoaJc_u72sT0hbMZhwdyf9EBs7c3fe9aCM6pACNos0Y5bqsBuq6wv5Hdg_v48VAjKCnDJTVB0zxO9v0GQF3AkG9l0CyZVBNIg9-PYmk3QQLQLu55JMGRFGR1r78iTPq1SmL5XZcB9WMDQ&amp;hsutk=2767d93d6471d657e0c9f660e4b58ef8&amp;utm_referrer=https%3A%2F%2Fblog.anomali.com%2Fthe-importance-of-forming-a-modern-honeypot-network&amp;canon=https%3A%2F%2Fblog.anomali.com%2Fthe-importance-of-forming-a-modern-honeypot-network&amp;pageId=4314214580&amp;__hstc=41179005.2767d93d6471d657e0c9f660e4b58ef8.1456736058655.1478831861868.1478887113345.180&amp;__hssc=41179005.7.1478887113345&amp;__hsfp=1335165674" id="cta_button_458120_0a81b108-0c35-466f-8ccb-36ff661bc040" style="margin: 20px auto;" target="_blank" title="View It Here">View It Here </a> </span> <script charset="utf-8" src="https://js.hscta.net/cta/current.js"></script> <script type="text/javascript">hbspt.cta.load(458120, 'f68f0b2e-fb62-48eb-acd6-8b2ad6455083', {});</script> </span></p>

Get the Latest Anomali Updates and Cybersecurity News – Straight To Your Inbox

Become a subscriber to the Anomali Newsletter
Receive a monthly summary of our latest threat intelligence content, research, news, events, and more.