Sandia supercharges the honeypot

Sandia National Laboratory is working with Splunk to sharpen its virtual cybersecurity sandbox environment and evaluate how it might be used in both the federal government and industry to blunt attacks.

HADES -- short for High-Fidelity Adaptive Deception & Emulation System -- is a supercharged "honeypot" system that attracts would-be cyber attackers by creating an entire virtual environment and tricks the intruders into sticking around so their actions can be monitored. The project won a 2018 Government Innovation Award.

Sandia, a National Nuclear Security Administration research and development lab, develops, engineers and tests non-nuclear parts of nuclear weapons. The lab's IT infrastructure is a magnet for cyber bad actors. The lab has been working with Splunk's Enterprise system to widen and deepen the program's ecosystem, said Vincent Urias, distinguished member of the technical staff at Sandia.

HADES is ultimately aimed at "changing the conversation with the adversary," Urias told FCW. That shift is particularly important as threat information is being commoditized by security companies that crunch their own threat intelligence, he said. The system offers the ability to develop unique streams of threat intelligence by observing actual attackers and developing responses at machine speed.

Current cybersecurity practices, such as post-attack forensics and assuming compromise "are not the entire story" for federal and industry IT security managers, he said. HADES can fill in details in the here and now, such as what tools are being used, what time the attack infiltrated the network, where it got in and other details that can be hard to pin down afterwards.

First deployed in 2017, HADES has grown to develop better and better data analytic capabilities, Urias said. "The hopes are to help cross-sectional .gov and commercial networks."