Introducing HoneyPoint Security Server!

I have been hinting that something big was coming for a few weeks now, and it is finally time to talk about it.

The big news is the release of MSI’s first enterprise security product – HoneyPoint.

HoneyPoint is designed as a direct response to the pain that I have been hearing about from network security folks for several years now. That pain is the general failure of network-based Intrusion Detection and Intrusion Prevention systems (IDS/IPS) to live up to the hype that surrounds them. Over the years, the idea of IDS has grown from a simple system of matching packets against a few signatures to a much larger beast.

Today’s IDS and IPS systems are broken. Most depend on signatures (be that against network packets or system & application logs). They compare the current traffic or events against that signature base and make a decision about the malicious intent of the traffic or events they are seeing. This was a great idea, to be sure, but it has largely failed to reach the promises vendors have been making for nearly a decade. There are simply too many signatures, too many nuances of traffic, networks have become too complex for effective IDS management and there is too much noise on modern networks for the signature-based approach to remain fully viable.

Now, before every IDS/IPS vendor in the world calls to tell me about their latest technology or technique to auto-tune, establish relevant baselines or use traffic patterns instead of signatures, I want to simply say this. Great! Good for you. But, I am not interested in hearing much about it. The current idea of IDS/IPS simply does not work. It is broken. Period.

Another reason why I say that is this – I have spent the last year talking directly with IDS/IPS users and hearing about their pain. They are spending way too much time tuning, updating and managing their IDS/IPS solutions. Even those that outsource their management, say they still spend way too much time working on false positive events or tracing issues that turn out to be nothing or worst of all, fighting against bot-nets, client side exploits, zero-day issues and other items that their detection systems failed to identify or stop. To put it simply, as one person did for me, they are “spending more time on managing the IDS than they are on responding to the 10K and more alerts it gives them each day.” To add insult to injury, of these 10K alerts – the majority of them turn out to be false positives.

Since threats are evolving and pushing into the organization at a much deeper level than the perimeter, and every trade magazine and security visionary is telling security teams to switch to enclave computing and begin to take an asset-centric approach to security, that is exactly what security professionals are doing. The problem is, they are finding that traditional IDS/IPS solutions are really not meeting the needs of securing the internal network in a meaningful way.

Thus, the paradigm shift that is HoneyPoint. The idea is an old one. The implementation is new. The idea of honeypots goes back a long way. They are essentially based upon the idea that if you create artifical systems or services on your network, an attacker will not know if what they see is real. The idea is that in order to determine what is real, they will have to probe and attack all of the visible targets. In doing so, they will, in more cases than not, probe a honeypot – thus alerting security folks to their presence. Obviously, the more honeypots, the higher the likelihood of their being probed instead of a real system.

This is the basis for HoneyPoint. We use it to make our systems offer services across the network that appear to be vanilla and homogenous. Imagine a big 10×10 grid of light sockets. If you had a light bulb and were asked to screw it into some of the sockets in the board, but some of the sockets were real and would light the bulb, while others would set off an alarm – how would you go about identifying which ones were real and which were alarms? You might carefully examine them, but if they all look similiar, the only way to know would be to try them.

That is exactly what we do with HoneyPoint. We dialate ports across our systems with similiar appearing services, and then wait for attackers to try and figure out which ones are real and which ones are HoneyPoints. Just by doing what attackers do – that is, probing the network and services they find – they fall into our trap and alert us to their presence. Once identified, they can be quickly isolated and shut down by network security staff.

The most beautiful part of all of this is the lack of false positives and signatures. Since the services offered by the HoneyPoints are not real, there is absolutely no reason at all for anyone to be using them. That means that ALL TRANSACTIONS WITH A HONEYPOINT ARE REAL EVENTS. Since the HoneyPoints key in on the idea that a transaction has occurred, and not what it was; they have no need for signatures (thus, no need to update and tune them). They simply capture the traffic they see, identify the source and alert the console of the event. Simple. Easy. No muss, no fuss – no additional management. The alerts from the console system can then be handled by the security team as an incident.

Alerts can be delivered via email, SMS (with a gateway), syslog or Windows Event logs. The console and HoneyPoints run on Win32, Linux/UNIX and OS X. Given their flexability, they can emulate thousands of services ranging from complex HTTP applications to RFC compliant implementations of your chosen mail platform. The variations are as flexible and endless as your imagination.

The HoneyPoint solution is built upon the idea of “deploy and forget.” HoneyPoints need only be installed and configured one time (leaving more time for vacations). They then operate as services or daemons (depending on OS) and simply wait for attackers to probe them. They have miniscule file sizes and memory demands, meaning you can run thousands on an average workstation size system with little impact, should you so desire. We suggest that you deploy them across your enterprise on your existing systems. No new hardware is needed.

Take a few minutes and visit the HoneyPoint web site at: http://www.microsolved.com/honeypoint for more information. Take it for a spin by filling out the form and get your FREE 90 day trial.

I think you will quickly come to understand why we are so excited and why security teams from many of our customers are telling us we have changed the way they think about securing thier environments!

Thanks for reading and for being patient while we brought HoneyPoint to life. I think once you use it, you’ll agree – it was well worth it!

Moving…

MSI is pleased to annouce that we will be moving soon to our new offices. We intend to do so in the next couple of weeks. The new building is located on the West side of Columbus and is a major upgrade for us in terms of space and useability.

Stay tuned for announcements on the new address, but the phone numbers and web presence will remain the same – of course.

Thanks for your patience the last few weeks and in the coming days while we prepare for and execute the transition. Blog entries have been and will likely be slower while we pursue the move.

Thanks to everyone who has helped make this possible and who has worked with us to prepare!

Where Have I Been?

I have been getting a few emails asking why I have been so quiet and where the podcast is.

The podcast has been delayed a bit, sorry for that. I am working on it. Maybe within a week or two I will have it ready and then can get an idea on how often we will do them.

In the meantime, I have been so quiet because I am working on a pretty major project. Stay tuned in the coming weeks for a large announcement from us about a very cool new software product we are about to release. I am very excited, and I think you will be too.

In the meantime, Neil and Troy have been carrying the blog traffic, and I have been continuing to write over at security.itworld.com. Check out my article this week for some insight into why I think IDS/IPS solutions are failing us.

Stay tuned, I promise it will be very interesting…

Dodge phishing attacks and spam

ANTI-SPAM

– Run a consolidated email filtering solution at your email gateway, and use a good AV product.
– If you don’t know who sent it, especially if you are not in the TO: or CC: part, delete it.
– If the subject looks mangled so it could get by perimeter spam sensors, delete it.
– Have a good email policy in your business or organization, and also for your family at home.
– Don’t open email attachments unless you are prepared to infect your computer with a virus.
– Never ever open unsolicited MS Word or MS Excel or any other MS Office document.
– Never make a purchase from an unsolicited email, or give out your credit card numbers.
– Use a disposable email address when signing up for websites to avoid unsolicited email.
– Don’t click the unsubscribe link, which can add your email address to more spam lists.
– Avoid using the preview functionality of your email client software to avoid inadvertent infection.
– Don’t post your email address on every single message board you visit like some people do.
– When mass mailing, use BCC (blind carbon copy) to conceal recipients from one another.

ANTI-PHISHING

– Phishers make a fake site that looks like the real website to collect private information.
– Never respond to emails that request personal financial information or identity information.
– Banks or e-commerce companies generally personalize emails, while phishers do not.
– Visit bank sites by typing https://www.bank.com to have a securely encrypted connection.
– No matter how well you think you know someone from the internet, you don’t know them at all.
– Vigilently keep good track of your finances and credit report to check for suspicious activity.
– If you’re unsure of a link, search for the URL in a search engine to check its legitimacy.
– Use the latest version of your favorite Internet browser and allow script only on sites you trust.
– Keep your computer patched with all of the latest updates from your operating system vendor.
– If you think your bank has emailed you, call don’t click. Especially if it seems very urgent.
    Ask a customer service representative for help on the phone.
– If your financial institution calls you: hang up, call them back. Always initiate the call.
– Phishers often send false but sensational messages to socially engineer you:
      (“urgent – your account details may have been stolen”)

Following these steps cannot keep you 100% safe but it will reduce your risk against attack.