Tag Archive for: HoneyPot

You are here: / HoneyPot

Posts

Modern Honey Network (MHN)

The Modern Honey Network (MHN) software, created by the Google Ventures-backed startup ThreatStream, automates much of the process of setting up and monitoring honeypots, as well as gleaning threat intelligence from them. An API allows it to integrate with IDSes, IPSes, application-layer firewalls, SIEM, and other security tools to set up defenses against attacks it detects.

Honeypots — basically lures posing as machines that let organizations gather intelligence and study the behaviors of attackers — long have been a popular and valuable tool for security researchers. There are plenty of open-source honeypot tools available today, but the high maintenance and complexity of deploying and running these lures have made them unrealistic security options for most businesses.

Open-Source Tool Aimed At Propelling Honeypots Into the Mainstream

An interesting article by Kelly Jackson Higgins of Darkreading.com:

Researchers have built a free open-source honeypot software program aimed at propelling the hacker decoys into security weapons for everyday organizations.

The Modern Honey Network (MHN) software, created by the Google Ventures-backed startup ThreatStream, automates much of the process of setting up and monitoring honeypots, as well as gleaning threat intelligence from them. An API allows it to integrate with IDSes, IPSes, application-layer firewalls, SIEM, and other security tools to set up defenses against attacks it detects.

Honeypots — basically lures posing as machines that let organizations gather intelligence and study the behaviors of attackers — long have been a popular and valuable tool for security researchers. There are plenty of open-source honeypot tools available today, but the high maintenance and complexity of deploying and running these lures have made them unrealistic security options for most businesses.

“Honeypots have never truly taken off in the enterprise,” says Greg Martin, CEO of ThreatStream, which provides a software-as-a-service threat intelligence system for large organizations like Northrop Grumman and SAIC. The goal of MHN is to simplify honeypot deployment and ultimately to make these tools a mainstream, inherent part of the security arsenal for companies in various industries.

“You can deploy 29 honeypots with the click of a button” with the open-source tool, Martin says. “With a VMware server, you can do 30 or 40.”

Read the rest here.

The FireEye Malware Protection System (MPS)

The FireEye Malware Protection System (MPS) accurately blocks Modern Malware, such as Trojans, bots, crimeware, and advanced persistent threats, in real-time using an advanced multi-phase analysis engine to capture and confirm zero-day malware and targeted attacks. At the core of each security appliance are the FireEye Malware-VM™ and Malware-Callback™ technologies, which combines inbound and outbound filtering to break the malware infection lifecycle.

KEY TECHNOLOGY FEATURES:

  • Multi-stage inspection and blocking engine that stops known and zero-day attacks while simultaneously eliminating false positives. The multi-stage inspection process unifies virtualization and network security to accurately block Modern Malware that are used to penetrate networks and steal resources and sensitive data
  • Malware-VM analysis utilizes proprietary and trade secret virtualization technology to analyze and confirm true, zero-day malware, such as Trojans, targeted attacks, bots, VM-aware malware, and advanced, persistent threats
  • Malware-Callback filter blocks outbound callbacks based on local malware intelligence from the Malware-VM analysis as well as based on global malware intelligence provided by the MAX Cloud Intelligence network

Newly discovered malware is installed to completion within the FireEye Malware-VM filter so that malware file locations, new registry keys, corrupted DLL’s, etc. are all tracked in addition to outbound, callback destinations. Now, analysis of polymorphic Modern Malware can be reliably automated to create dynamic blocking of inbound zero-day attacks and its outbound transmissions. Local zero-day malware intelligence is dynamically-generated by each Malware-VM filter to provide real-time malware forensics used to protect the local network. This analysis can be shared globally through the MAX Cloud Intelligence network for use by all subscribers to stop data and resource thefts.

Contact them to get an online demo!

[media = 6]