by Clint Sand, Director of Security Strategy & Advisory
Generally we see most breaches are sourced from 3 distinct groups. Malicious Insiders, Well-meaning Insiders, and Malicious Outsiders. Each source, and their unique motivators, should ideally be emulated in a testing process to ensure the results match real-world conditions. Honeypots are useful for understanding the behavior of a Malicious Outsider and to some extent, the Malicious Insider. They are like attacker surveillance cameras. Organizations often leverage honeypots to learn about attacker behavior, deflect attacks to lower valued targets, and discover the new zero day vulnerabilities attackers are exploiting in a system.
However, if you look at the attack phases of a typical Advanced Persistent Threat, a good majority of the high-profile breaches are the result of spear phishing. Well-meaning end users have become the most effective targets for attackers looking to penetrate your environment. Why...