Brussels, 23/11/2012 (Agence Europe) - The European Union's cyber-security agency ENISA has published a report analysing in depth 30 digital traps - or honeypots - in order to proactively detect cyber-attacks. The study reveals barriers to understanding basic honeypot concepts and presents recommendations on the best techniques to use.
“Correctly deployed, honeypots offer considerable benefits for CERTs (computer emergency response teams): malicious activity in a CERT's constituency can be tracked to provide early warning of malware infections, new exploits, vulnerabilities and malware behaviour, as well as give an opportunity to learn about attacker tactics”, said the executive director of ENISA, Udo Helmbrecht. In Helmbrecht's view, CERTs in Europe could better defend their infrastructures by opting for honeypots more.
The growing number of cyber attacks and their complexity demand better early warning capabilities for CERTs. Honeypots lure attackers by mimicking a real computing resource (for example, a service, an application, a system or data). Any entity connecting to a honeypot is then considered as a suspect and its activity is monitored to detect malicious activity. This report is a follow-up to a recent ENISA study on detection of network security incidents. The study concluded that honeypots were recognised by all CERTs as an effective way of gathering information on hacker behaviour, but that their use for detecting and investigating the attacks was still not as widespread as might be expected due to barriers to their deployment. In this new study, ENISA presents practical deployment strategies and new critical issues for CERTs. It studied 30 different honeypot categories, which it tested and evaluated. The result shows that there are some shortcomings and obstacles to the deployment of these traps - the difficulty of usage, a lack of documentation, a lack of software stability, a lack of development support, little standardisation, a requirement for highly skilled people, and problems of understanding basic honeypot concepts. The study also presents a classification and explores the future of honeypots. (IL/transl.fl)