Compromised insider honey pots using reverse honey tokens
According to one embodiment, a method for setting a trap to detect that an intruder has compromised a client end station (CES) in an attempt to gain unauthorized access to enterprise data provided by a server is described. The method includes causing a honey token to be placed on the CES secluded within a configuration repository, wherein the honey token is metadata and/or instructions indicating how applications can seemingly access the enterprise data but that is actually invalid, and the honey token is placed on the CES and not on the server. The method also includes causing attribute values to be installed on a security gateway for a security rule causing the security gateway to monitor network traffic for attempted use of the honey token, and to generate an alert when a set of one or more packets that include the honey token are received.
1. A method in a module implemented by one or more electronic devices for setting a trap to detect a compromise of a client end station by an intruder, the method comprising:
causing, by the module, a honey token to be located on the client end station secluded within a browser local storage, wherein the browser local storage is used by a web browser and has stored therein either a cookie, a proprietary storage format data element, or a username and password, wherein the honey token includes information that appears to permit the web browser to access enterprise data provided by a server executing on a server end station but does not actually allow access to the enterprise data, wherein the honey token is a reverse honey token in that it exists on the client end station and not on the server, and wherein said causing the honey token to be located on the client end station comprises causing instructions to be transmitted to the client end station based on a type of the client end station which, when executed by the client end station, place the honey token within the browser local storage; and
causing, by the module, a set of one or more attribute values to be installed on a security gateway coupled between the client end station and the server, wherein the set of attribute values are to be utilized for a security rule that causes the security gateway to,
monitor network traffic for a use of the honey token attempting to gain access to the enterprise data provided by the server, and
generate an alert when a set of one or more packets that include the honey token are received.
2. The method of claim 1 , wherein the security rule further causes the security gateway to:
block the set of packets from reaching the server by not forwarding the set of packets toward the server.
3. The method of claim 1 , wherein said type of the client end station is based upon an operating system of the client end station.
4. The method of claim 1 , further comprising:
causing one or more different honey tokens, based upon a time schedule, to be placed on the client end station; and
causing, responsive to receiving the set of packets that include the honey token, an estimated time that the client end station was compromised to be presented to a user, wherein the estimated time is determined based upon the honey token and the time schedule.
5. The method of claim 1 , wherein the server end station and the security gateway operate within a local area network (LAN) and wherein the client end station connects to the LAN through the Internet.
6. The method of claim 1 , wherein the honey token includes the username and password.
7. The method of claim 1 , wherein the honey token comprises a cookie value of a Hypertext Transfer Protocol (HTTP) cookie, and wherein the honey token further comprises a Uniform Resource Locator (URL).
8. A system for setting a trap to detect a compromise of a client end station by an intruder, the system comprising:
a module implemented by one or more electronic devices that,
causes a honey token to be located on the client end station secluded within a browser local storage, wherein the browser local storage is used by a web browser and has stored therein either a cookie, a proprietary storage format data element, or a username and password, wherein the honey token includes information that appears to permit the web browser to access enterprise data provided by a server executing on a server end station but does not actually allow access to the enterprise data, wherein the honey token is a reverse honey token in that it exists on the client end station and not on the server, and wherein the module, to cause the honey token to be located on the client end station, causes instructions to be transmitted to the client end station based on a type of the client end station which, when executed by the client end station, place the honey token within the browser local storage, and
causes a set of one or more attribute values to be installed on a security gateway to cause the security gateway to utilize a security rule to detect an attempted use of the honey token to gain access to the enterprise data provided by the server; and
the security gateway implemented in an electronic device and coupled between the client end station and the server that,
monitors network traffic, using the security rule and the set of attribute values, for the use of the honey token, and
generates an alert when a set of one or more packets that include the honey token are received.
9. The system of claim 8 , wherein the security rule further causes the security gateway to:
block the set of packets from reaching the server by not forwarding the set of packets toward the server.
10. The system of claim 8 , wherein the type of the client end station is based upon an operating system of the client end station.
11. The system of claim 8 , wherein the module is further configured to:
cause one or more different honey tokens, based upon a time schedule, to be placed on the client end station; and
cause, responsive to receiving the set of packets that include the honey token, an estimated time that the client end station was compromised to be presented to a user, wherein the estimated time is determined based upon the honey token and the time schedule.
12. The system of claim 8 , wherein the server end station and the security gateway operate within a local area network (LAN) and wherein the client end station connects to the LAN through the Internet.
13. The system of claim 8 , wherein the honey token includes the username and password.
14. The system of claim 8 , wherein the honey token comprises a cookie value of a Hypertext Transfer Protocol (HTTP) cookie, and wherein the honey token further comprises a Uniform Resource Locator (URL).
15. A non-transitory computer-readable storage medium comprising instructions which, when executed by one or more processors of a device, cause the device to perform operations for setting a trap to detect a compromise of a client end station by an intruder, wherein the operations comprise:
causing a honey token to be located on the client end station secluded within a browser local storage, wherein the browser local storage is used by a web browser and has stored therein either a cookie, a proprietary storage format data element, or a username and password, wherein the honey token includes information that appears to permit the web browser to access enterprise data provided by a server executing on a server end station but does not actually allow access to the enterprise data, wherein the honey token is a reverse honey token in that it exists on the client end station and not on the server, and wherein said causing the honey token to be located on the client end station comprises causing instructions to be transmitted to the client end station based on a type of the client end station which, when executed by the client end station, place the honey token within the browser local storage; and
causing a set of one or more attribute values to be installed on a security gateway coupled between the client end station and the server, wherein the set of attribute values are to be utilized for a security rule that causes the security gateway to,
monitor network traffic for a use of the honey token attempting to gain access to the enterprise data provided by the server, and
generate an alert when a set of one or more packets that include the honey token are received.
16. The non-transitory computer-readable storage medium of claim 15 , wherein the security rule further causes the security gateway to:
block the set of packets from reaching the server by not forwarding the set of packets toward the server.
17. The non-transitory computer-readable storage medium of claim 15 , wherein said type of the client end station is based upon an operating system of the client end station.
18. The non-transitory computer-readable storage medium of claim 15 , wherein the operations further comprise:
causing one or more different honey tokens, based upon a time schedule, to be placed on the client end station; and
causing, responsive to receiving the set of packets that include the honey token, an estimated time that the client end station was compromised to be presented to a user, wherein the estimated time is determined based upon the honey token and the time schedule.
19. The non-transitory computer-readable storage medium of claim 15 , wherein the server end station and the security gateway operate within a local area network (LAN) and wherein the client end station connects to the LAN through the Internet.
20. The non-transitory computer-readable storage medium of claim 15 , wherein the honey token includes the username and password.
21. The non-transitory computer-readable storage medium of claim 15 , wherein the honey token comprises a cookie value of a Hypertext Transfer Protocol (HTTP) cookie, and wherein the honey token further comprises a Uniform Resource Locator (URL).