Title: Honey Pots, Honey Nets and Padded Cell Systems
Course: IN 2001 Principle of Information Assurance > Section: Module 7: Chapter Seven

Honeypots, Honeynets and Padded Cell Systems
1. Honey pots are decoy systems designed to lure potential attackers away from critical systems.
2. By encouraging attacks against these bait systems, the defender may lure them away from actual targets and perhaps detect their presence and then block access.
3. This approach has the risk of perhaps luring attackers into the defender’s network.
4. Honey nets are a collection of honey pots that connect several honey pot systems on a subnet. Honey pots are designed to:
  - Divert an attacker from accessing critical systems
  - Collect information about the attacker’s activity
  - Encourage the attacker to stay on the system long enough for administrators to document the event and, perhaps, respond
5. A padded cell is a honey pot that has been protected so that that it cannot be easily compromised.
6. In addition to attracting attackers with tempting data, a padded cell operates in tandem with a traditional IDS.  When the IDS detects attackers, it seamlessly transfers them to a special simulated environment where they can cause no harm—the nature of this host environment is what gives the approach its name, padded cell.
7. Advantages of honeypots, honeynets and padded cell systems
  - Attackers can be diverted to targets that they cannot damage
  - Administrators have time to decide how to respond to an attacker
  - Attackers’ actions can be easily and more extensively monitored and the records can be used to refine threat models and improve system protections
  - Honey pots may be effective at catching insiders who are snooping around a network
8. Disadvantages of honeypots, honeynets and padded cell systems.
  - The legal implications of using such devices are not well defined
  - Honey pots and padded cells have not yet been shown to be generally useful security technologies
  - An expert attacker, once diverted into a decoy system, may become angry and launch a more hostile attack against an organization’s systems
  - Administrators and security managers will need a high level of expertise to use these systems

Trap and Trace Systems
1. Trap and trace systems use a combination of techniques to detect an intrusion and to trace incidents back to their sources.
2. The trap usually consists of a honey pot or padded cell and an alarm.
3. While the intruders are distracted, or trapped, by what they perceive to be successful intrusions, the system notifies the administrator of their presence.
4. The trace feature is a process by which the organization attempts to determine the identity of someone who is discovered in unauthorized areas of the network or system.
5. If the individual is outside the security perimeter of the organization, then numerous legal issues arise.
  - There are legal drawbacks to trap and trace.
  - The trap portion frequently involves the use of honey pots or honey nets
  - When using honey pots and honey nets, administrators should be careful not to cross the line between enticement and entrapment
6. Enticement is the process of attracting attention to a system by placing tantalizing bits of information in key locations.
7. Entrapment is the action of luring an individual into committing a crime to get a conviction.
8. Enticement is legal and ethical, whereas entrapment is not.

Active Intrusion Prevention
1. Some organizations implement active countermeasures to stop attacks.
2. One tool that provides active intrusion prevention is known as LaBrea.  LaBrea works by taking up the unused IP address space within a network.
3. If an address is not currently being used by a real computer or network device, LaBrea will pretend to be a computer at that IP address and allow the attacker to complete the connection request, known as the three-way handshake.
4. Once the handshake is complete, LaBrea will change the TCP sliding window size down to a low number to hold the TCP connection from the attacker open for many hours, days or even months.
5. Holding the connection open but inactive greatly slows down network-based worms and other attacks.
6. It allows the LaBrea system time then to notify the system and network administrators about the anomalous behavior on the network.