The Difference Between Sandboxing, Honeypots & Security Deception

Networks, cyberattacks, and the strategies used to stop them are continuously evolving. Security deception is an emerging cyber-defense tactic that allows researchers and information security professionals to observe the behavior of attackers once they've gained access to what they think is a business network.

The term "security deception" only came into wide usage in the last year, so it can be difficult to tell how exactly these solutions are different from other tools that try to trick attackers, such as sandboxing and honeypots. Like these other tactics, security deception fools attackers and malicious applications into revealing themselves so that researchers can devise effective defenses against them, but it relies more on automation and scale, and requires less expertise to set up and manage. Each of these technologies has unique requirements and ideal use cases. To understand what those are, we'll need to look at each of them in more detail.

Sandboxing
The need for the analysis of network traffic and programs has existed almost since the dawn of networks and third-party programs. Sandboxing, introduced in the 1970s for testing artificial intelligence applications, allows malware to install and run in an enclosed environment, where researchers can monitor their actions to identify potential risks and countermeasures. Today, effective sandboxing is most often performed on dedicated virtual machines on a virtual host. This allows for malware to be safely tested against multiple different OS versions on machines that are segregated from the network. Security researchers use sandboxing when analyzing malware and many advanced anti-malware products use it to determine whether or not suspicious files are truly malicious based on their behavior. These kinds of anti-malware solutions are becoming more important because so much of modern malware is obfuscated to avoid signature-based antivirus.

Most businesses aren't capable of performing malware analysis with same level of sophistication and expertise as a dedicated researcher or vendor. Smaller businesses typically benefit the most from deploying sandboxing as service from a provider that already has implementations in place that can automate the whole process.

Honeypots
Honeypots and honeynets are deliberately vulnerable systems meant to draw the attention of attackers. Honeypots are single hosts that entice attackers to attempt to steal valuable data or further scope out the target network. The idea behind honey nets, which began to circulate in 1999, is to understand the process and strategy of attackers. Honeynets are made up of multiple honeypots, often configured to emulate an actual network — complete with a file server, a web server, etc. — so that attackers believe they've successfully infiltrated a network. Instead, they're actually in an isolated environment, under a microscope.

Honeypots let researchers watch how real threat actors behave, while sandboxing reveals only how malware behaves. Security researchers and analysts commonly use honeypots and honeynets for this exact purpose. Researchers as well as IT and security pros concerned with defense can use this information to improve their organization's security by noting new attack methods and implementing new defenses to match. Honeynets will also waste attackers' time and can get them to give up the attack in frustration. This is most useful for government organizations and financial institutions that are targeted by hackers often, but any business of medium size or larger will benefit from a honeynet. Small and medium-sized businesses (SMBs) may benefit as well, depending on their business model and security situation, but most SMBs today don't have a security expert capable of setting up or maintaining a honeypot.

Cyber Deception
The core idea of cyber deception was first discussed in 1989 by Gene Spafford of Purdue University. Some argue that it more or less refers to modern, dynamic honeypots and honeynets and, fundamentally, they are correct. Security deception is a new term and so the definition hasn't yet been set in stone, but in general it refers to a range of more-advanced honeypot and honeynet products that offer more automation for both detection and the implementation of defenses based on the data they gather.

It's important to note that there are different levels to deception technologies. Some are little more than a honeypot, while others mimic full-blown networks that include real data and devices. Benefits include the ability to spoof and analyze different types of traffic, provide fake access to accounts and files, and the ability to more closely imitate an internal network. Some security deception products can be deployed automatically, keep attackers busy in loops of access for more information, and give users more detailed and realistic responses to attackers. When a security deception product works as intended, hackers will truly believe they've infiltrated a restricted network and are gathering critical data. It's true, they'll be accessing data, but it will only be information you intend for them to see.

Security deception is still in its infancy, so as with most new security technologies, its initial use case is as a niche tool for large enterprises that will gradually move down market. At present, these tools are particularly relevant for high-profile targets such as government facilities, financial institutions, and research firms. Organizations still need a security analyst to parse the data from security deception tools, so smaller companies without specialized security staff typically wouldn't be able to tap into the benefits. That said, SMBs can benefit from contracting with security vendors that offer analysis and protection as a service.

All these security technologies have their role in the prevention and analysis landscape. At a high level, sandboxing involves installing and allowing malware to run for behavioral observation, while honeypots and nets focus on the analysis of threat actors conducting reconnaissance on an infiltrated network, and security deception is the more recent conception of advanced intrusion detection and prevention. Deception technologies offer more realistic honeynets that are easier to deploy and provide more information to users, but they come with higher budgetary and expertise requirements that typically restrict their use to large enterprises ... at least for the moment.

Related Content: