Firewall, antivirus or honeypot: what protects against what?
No single protection stops every attack. The firewall, antivirus, multi-factor authentication (MFA), backups and a honeypot each work at different stages of an attack. Here we go through what each protection does, what it misses and in which order a small business should get them.
An attack has several stages
A typical attack starts with the attacker getting in, continues with mapping and spreading through the network, and ends with data theft or encryption. Each protection covers one or two of the stages:
- Getting in: multi-factor authentication, updates, firewall and phishing awareness training.
- Running malware on a computer: antivirus or EDR.
- Mapping and spreading through the network: a honeypot detects it, and segmented networks make it harder.
- Stealing data or encrypting: backups let you restore.
The protections compared
| Protection | What it does | What it misses |
|---|---|---|
| Multi-factor authentication | Stops logins with stolen passwords. Microsoft states that it blocks over 99.9 per cent of attacks on accounts. | Attackers who trick the user into approving the login or steal an already logged-in session. |
| Updates | Close known security holes, above all in internet-facing equipment. | Vulnerabilities that are not yet known or fixed. |
| Firewall | Blocks unwanted traffic from outside and can divide the network into segments. | Attacks that come in via email, the browser or stolen logins, which is to say most attacks today. |
| Antivirus and EDR | Detect and stop malware on computers and servers. | Attackers who use ordinary administration tools instead of malware, and devices that lack the protection, for example printers and network equipment. |
| Backups | Let you restore after encryption. | Prevent nothing, and attackers try to delete the copies. At least one copy must be offline or immutable. |
| Training | Reduces the risk of someone clicking on phishing. | Everyone clicks the wrong thing at some point. |
| Honeypot | Raises an alert when someone already inside the network scans or tries to log in. Almost no false alarms. | Stops nothing by itself. Someone has to respond to the alert. |
Antivirus and a honeypot complement each other
Antivirus looks at what is happening on an individual computer and searches for malware. A honeypot looks at the network and reacts to behaviour: someone is looking for targets. Attackers increasingly use ordinary tools that are already built into Windows to avoid triggering antivirus. They still have to map the network, though, and that is visible to a honeypot.
The honeypot also protects where there is no antivirus: an attacker who gets in through a printer, a camera or an old NAS is invisible to the antivirus software on the computers.
The order in which a small business should start
- Multi-factor authentication on email, cloud services and remote access. Often free, and the measure that makes the biggest difference.
- Automatic updates, and replacing equipment that no longer receives updates.
- Backups that cannot be deleted, with a tested restore.
- Antivirus with alerts that someone reads. Microsoft Defender is included in Windows.
- Closed doors in the firewall: no remote desktop directly exposed to the internet, and separate networks for guests and cameras.
- Detection inside the network with a honeypot or tripwires such as Canarytokens.
- Training and a one-page incident plan.
The first three steps often cost next to nothing and remove the most common ways in. Step six is what decides whether you notice an attack that succeeds anyway.
Frequently Asked Questions
Is the router's built-in firewall enough?
It stops unwanted traffic from outside, which is good, but most attacks today come in via email, the browser or stolen passwords. It needs to be complemented with multi-factor authentication, updates and something that detects attackers who are already inside.
Do we need both antivirus and a honeypot?
Yes, they do different things. Antivirus stops malware on the computers, and the honeypot raises an alert when someone maps the network, even if the attacker is not using malware.
What is the difference between antivirus and EDR?
Traditional antivirus searches for known malware. EDR (endpoint detection and response) also tracks behaviour on the computer over time and can isolate a computer during an attack. For small businesses the difference matters less than someone actually reading the alerts.
What should we do first if we have no protection at all?
Turn on multi-factor authentication for email today. It is free in most services and stops the most common way in.