ForeScout pitches honeypot technology as IPS

A few vendors that wanted to be tested didn’t meet our criteria, but ForeScout’s ActiveScout caught our attention.

While we found 11 vendors that met our criteria for in-line network-based intrusion-protection systems, yet more vendors still wanted to be tested even though their products, though interesting, don’t quite fit the bill.

One that caught our attention was ForeScout Technologies’ ActiveScout. In our experience with the product – we had it up an running in front of our production network for several months in early 2003 – we found ActiveScout to be a kind of honeypot that can be used to efficiently identify and block traffic from the automatic attack tools that most amateur hackers use.

ActiveScout sits in the network on a monitoring port, typically outside the corporate firewall. ActiveScout has no real services and protects no real systems. Instead, it simulates a variety of applications that could be interesting to attackers. The theory is that anyone who connects to one of these simulated applications is up to no good. At that point, ActiveScout uses its monitoring capabilities to attempt to reset any TCP connections from the attacker and reprogram the corporate firewall to block traffic. ActiveScout can take this a step further by feeding back “poison” information to the attacker, such as a particular NETBIOS name. If connection attempts show up from other sources with this poison information in hand, ActiveScout will block traffic from those sources as well.

The benefit to ForeScout’s approach is pretty clear: no false positives. Because you’re not looking for a signature or any other protocol anomaly, you don’t have to worry about misdetecting potential attacks. It’s behavioral: Anyone touching that box must be bad and stopped.

What ForeScout doesn’t advertise is the flip side of no false positives: Lots of false negatives. Only someone who actually does reconnaissance using this model will get caught. If the bad guys already know where the Web server is – maybe they looked it up in the DNS – ActiveScout won’t do anything about the attack, successful or not.

Nevertheless, the great majority of Internet attacks, what we called “background radiation,” use a pattern that is susceptible to the kind of technology ForeScout brings to the table. This is why some of the IPS tools we looked at (from NetScreen and EcoNet.com) include honeypot features as well, although not with ActiveScout’s level of sophistication.

ForeScout’s approach eliminates a lot of fairly irrelevant information that would otherwise fill up intrusion-detection system, firewall and IPS logs. Because one major problem in enterprise security deployments is the overwhelming difficulty of dealing with thousands or hundreds of thousands of events each day, anything that reduces the size of these logs is a great assistance. Of course, network managers have to balance the value of a tool such as ActiveScout with the cost of deploying and managing yet another network security element.

ActiveScout complements, rather than competes with, the IPS products we tested. While ActiveScout might not deter serious attackers, it can help protect you against configuration errors and sloppy mistakes. Used properly, it will quiet down the background radiation of the Internet.