Blog | G5 Cyber Security

Honeypot Security: WAF Reverse Proxy Benefits

G5 Cyber Security

TL;DR

Putting a Web Application Firewall (WAF) in front of your web-based honeypots adds a vital layer of security. It blocks attacks before they reach the honeypot, reduces noise from automated scanners, and helps you gather more focused intelligence on real threats. It also protects your infrastructure if the honeypot is compromised.

Why Use a WAF with Honeypots?

Web-based honeypots are designed to attract attackers. However, this means they’re constantly bombarded with automated scans and simple attacks. A WAF acts as a shield, filtering out unwanted traffic so you can focus on genuine malicious activity.

Setting Up Your WAF Reverse Proxy

  1. Choose a WAF: Several options are available, both open-source (e.g., ModSecurity with OWASP Core Rule Set) and commercial (e.g., Cloudflare, Imperva). Consider your budget, technical expertise, and desired features.
    • Open Source: Requires more configuration but offers greater control.
    • Commercial: Easier to set up and manage, often with advanced features.
  2. Deployment Mode: You can deploy a WAF in reverse proxy or transparent mode.
    • Reverse Proxy: All traffic goes *through* the WAF before reaching the honeypot. This is generally recommended for better control and visibility.
    • Transparent Mode: The WAF intercepts traffic without changing its source/destination IP addresses. This can be more complex to configure but avoids modifying your network topology as much.
  3. Configure Basic Rules: Start with rules that block common attack patterns and known bad bots.
    • SQL Injection Protection: Block attempts to inject malicious SQL code.
    • Cross-Site Scripting (XSS) Protection: Prevent attackers from injecting harmful scripts into your honeypot’s pages.
    • Bot Detection: Identify and block automated scanners and crawlers. 
      # Example ModSecurity rule to block known bad user agents
SecRule REQUEST_HEADERS "User-Agent" "(badbot1|badbot2)" "id:900000,phase:2,t:lowercase,deny,status:403,log,msg:'Blocked Bad Bot'"
  4. Whitelisting: Allow legitimate traffic to reach the honeypot. This is crucial for avoiding false positives.
    • Carefully identify and whitelist your own IP addresses or networks used for monitoring and administration.
    • If using a commercial WAF, they often have features to automatically learn acceptable traffic patterns.
  5. Logging & Monitoring: Configure the WAF to log all blocked requests and suspicious activity.
    • Regularly review these logs to identify new attack patterns and refine your rules.
    • Integrate WAF logs with a Security Information and Event Management (SIEM) system for centralized analysis.

Benefits in Detail

  1. Reduced Noise: A WAF filters out automated scans, reducing the volume of irrelevant traffic to your honeypot.
  2. Improved Intelligence Gathering: By blocking common attacks, you can focus on analyzing more sophisticated threats that bypass the WAF.
  3. Infrastructure Protection: If an attacker manages to compromise the honeypot (despite the WAF), the WAF can limit their ability to access other systems on your network. This is especially important if the honeypot has any outbound connectivity.
  4. Early Attack Detection: The WAF can detect and block attacks before they reach the honeypot, providing early warning of potential threats targeting your infrastructure.
  5. Detailed Logging: WAF logs provide valuable information about attack attempts, including source IP addresses, requested URLs, and malicious payloads. This data can be used to improve your overall cyber security posture.

Important Considerations

Exit mobile version