As today’s enterprises do their best to stay ahead of cybercriminals and malicious attacks, keeping up with new security tools and strategies for security is essential. Among the set of techniques traditionally employed, deception methods have played a prominent role, often involving the deployment of decoys or traps to mislead attackers. However, traditional deception techniques often lead to deployment and operational complexity, higher risk exposure, and slower identification of threats.

An efficient and safer alternative to traditional deception methods is the honeytoken. Honeytokens aid in the rapid detection of malicious activities, and they can often serve as an early warning system for your security team.

In this post, we’ll walk through how honeytokens work, providing best practices for implementing honeytokens and choosing them from among your arsenal of other security tools.

Honeytokens defined

Honeytokens are digital resources that are purposely designed to be attractive to an attacker, but signify unauthorized use. They do not serve any real purpose within your systems. However, when they are used, they trigger an alert of potentially unauthorized access.

Honeytokens can come in many forms, including:

• Documents: Files made to look like they contain sensitive information (such as financial data or intellectual property) that trigger an alert when they are opened.
• Database records: Dummy records in a database with apparent value (such as customer information, business data, or employee credentials) that indicate intrusion if they are accessed.
• Credentials: Fake usernames, email addresses, and passwords that can be strategically placed in applications or configuration files, signaling possible malicious activity when they are used.
• Tokens: Access tokens or API keys that signal possible malicious activity when they are used.

The primary goal of a honeytoken is to detect unauthorized access to or use of resources. That detection, coupled with an alerting mechanism, can enable quick incident response.

Honeytokens versus honeypots

Honeytokens may seem similar to honeypots, but they have significant differences. A honeypot is a decoy system set up to attract cyber attackers. A honeypot mimics a real system — such as a server, application, or network — but it contains apparent vulnerabilities that are closely monitored by a security team. As malicious actors interact with a honeypot, the security team is able to observe and understand their attack techniques. Based on those insights, a security team can prepare countermeasures.

Unlike honeypots, honeytokens are simple pieces of data that serve to entice attackers. Placed within a dataset or a system, the only legitimate function of a honeytoken is to signal unauthorized access, alerting a security team to a potential breach. In addition to aiding in the early detection of malicious activity, honeytokens help security teams better understand attack vectors and patterns within their systems. By luring adversaries and analyzing their attack paths, an organization is better informed to establish adversary actions and enforce policies which will strengthen their security posture.

How honeytokens work

Honeytokens work by taking advantage of an attacker’s curiosity and desire to access valuable resources. Appearing as legitimate and valuable assets, honeytokens look enticing. Even though attackers assume that they have discovered something valuable, they have instead triggered a trap that alerts the security team.

For honeytokens to be used effectively, an organization ought to focus on strategic deployment, detection, and response.

Honeytoken deployment

The strategic placement of honeytokens in applications, systems, or networks is meant to mimic authentic resources that would be attractive to attackers. As a first step in deployment, an organization identifies high-risk or high-value assets that may be targeted by attackers. These might be databases containing sensitive customer information or folders on a server that contain supposed intellectual property.

Once potential targets have been identified, the honeytokens are placed alongside real assets, or they are embedded within applications or systems. For example, document honeytokens may have file names and content similar to genuine sensitive documents, or real-looking (but fake) credentials may be inserted into configuration files.

The careful placement of honeytokens ensures that they blend in with legitimate resources, increasing the likelihood that an attacker will interact with them.

Honeytoken detection

The use of honeytokens is only effective if they trigger alerts when accessed or used. Because honeytokens are only meant to be accessed by unauthorized users, any activity involving a honeytoken is considered suspicious. This means that a detection and alert system will not have any false positives. Intrusion detection systems (IDS) or security information and event management (SIEM) tools can be configured to track honeytoken usage and generate alerts.

Incident response

When a honeytoken has been triggered, the security team can execute its incident response plan. This process may include gathering information about the attacker (such as their IP address), retracing their access patterns, and then determining the extent of their access within the organization’s systems. In addition, the security team can lock down any adjacent (and potentially breached) resources.

While the primary goal of the honeytoken is to provide rapid detection of an intrusion, a security team can still gather valuable intelligence that will help to harden the organization’s overall security posture.

Best practices for implementing honeytokens

When implementing honeytokens, consider the following best practices:

Choose the right type of honeytoken

Determine the types of honeytokens which would be most relevant to your organization’s assets and potential threats. For example, if your organization faces a higher risk of unauthorized database access, then the use of database record honeytokens — dummy records with apparent value — would be prudent. Focus on the highest priority threats first, and select honeytokens that would help detect malicious activity in those areas.

Ensure proper honeytoken placement

Honeytokens should be placed in locations that are likely targets for attackers. The goal of strategic placement is to make it difficult for attackers to differentiate between real assets and fake ones. This may involve placing honeytokens alongside real identities, data or resources.

Integrate honeytokens with existing security infrastructure

Because detection is integral to the effectiveness of honeytokens, organizations should integrate detection of honeytoken usage with their existing security tools and infrastructure. Organizations that have a cybersecurity partner should leverage tools like identity protection (IDP) to include monitoring and alerting of honeytoken access.

Regularly update and maintain honeytokens

Establish a plan for the periodic review and update of honeytokens. This ensures that they remain effective and relevant. By changing the content of honeytoken documents, credentials, and tokens, an organization keeps its honeytokens in line with current security practices and organizational changes. Honeytokens should be properly documented by the security team. Also, an organization should be aware that honeytoken access might also come from internal sources such as employees. These should not be ignored, as they might indicate malicious behavior on the part of the employee or that an adversary has used valid employee credentials to gain access.

Conclusion

Among the tools used by security teams in modern cybersecurity, honeytokens are becoming more common. They serve as a strong alternative to traditional deception techniques, as they are lightweight, easy to maintain, and can immediately provide information about malicious activity. When deployed strategically, honeytokens can bring early detection of an intrusion. Coupled with an organization’s existing security tools, honeytokens can prove to be an invaluable asset in the security team’s toolbelt.

Honeytoken capabilities in Falcon Identity Protection

CrowdStrike Falcon^® Identity Protection offers an advanced honeytoken capability to enhance security defenses. Users can create honeytoken accounts (based on our recommendations) to act as lures for potential attackers. Any interaction with these honeytokens triggers a detailed alert. Security teams receive detailed insights into the path of attack and the techniques used by attackers. When working with Microsoft Active Directory (AD), users of CrowdStrike Falcon® Identity Protection can flag accounts as honeytokens in AD without requiring additional configurations or resources, and also have tight controls in place for these honeytoken accounts with built in enforcement policies — making it safer for organizations to take calculated risks.