rtance of tightly controlling the network where the honeypots are deployed, including monitoring and controlling both incoming and outgoing traffic.
Additionally, the report cautioned to ensure that legitimate traffic does not end up on the honeypot, as that may trigger false positives.
Honeypots – Part of Every CERTs Toolkit
Overall, ENISA strongly suggests that honeypots should be an essential part of any CERT’s toolkit.
“Correctly deployed, honeypots offer considerable benefits for CERTs; malicious activity in a CERT’s constituency can be tracked to provide early warning of malware infections, new exploits, vulnerabilities and malware behavior, as well as give an opportunity to learn about attacker tactics,” said Professor Udo Helmbrecht, Executive Director of ENISA in a statement.
As part of its continued research and analysis on honeypots, the ENISA is asking CERTs to actively take part in the communities identified in the study, and provide feedback to its researchers involved in development of honeypots and related technologies.
“It has to be stressed that CERTs can also have great influence on how these technologies evolve and how they can be customized to simplify their usage, thus allowing them to be adopted on a greater scale," the report concluded.
A final note of importance that the ENISA mentioned, are the legal and ethical issues that could potentially exist with a honeypot deployment. "A study of these issues is outside the scope of this study. Nevertheless, we encourage CERTs to consult on the potential legal implications of usage of honeypots in their country/constituency with a legal counsel.”
The full 183-page report is a worthy read and can be downloaded here in PDF format.