Guest Network and Honeypot Exclusion Overview

Guest network and honeypot exclusions remove specific IP addresses from the Bitsight rating after you attest to them. A guest network exclusion keeps findings visible in the platform but removes them from the rating. A honeypot exclusion removes the honeypot assets and their findings from the platform. Each exclusion lasts one year and can be renewed.

Before you begin

• You must be signed in to Bitsight to open the attestation form.
• Have the list of IP addresses for each guest network or honeypot you want to exclude. Honeypots can also be identified by domain.
• Have the attestation form signed by a C-level official (such as a chief executive or chief information officer), a Director of IT, or a similar role.

Guest Network Exclusions

How do I find guest networks in the platform?

• Ratings Tree: Any entity with a Guest Network Exclusion is indicated (with the node expanded) with a Yes in the Guest Network Exclusion field.
• Findings Table: Identify findings in the Findings Table related to excluded guest networks by using the Impacts Risk Vector Grade filter with No: Guest Network Exclusion selected.

Instructions for Self-Attesting Guest Networks for Exclusion

1. Enter the IP addresses that serve as exit points into the attestation form. You must be signed in to open the form.
2. Have a C-level official, Director of IT or similar role sign the form.
3. Send the form to Bitsight Support.

What happens to findings on excluded guest networks?

Findings on excluded guest networks still appear in the Findings Table. These findings do not affect your rating. Continue to review these findings, and remediate and mitigate any issues or threats that come from the guest network.

Guest Network Validation

There is a validation process to ensure that the observed events on these IP addresses align with typical guest network behavior. Validation occurs on a case by case basis and considers feedback and additional context.

Criteria:

• There haven't been any open port events detected in these networks in the past 3 months.
• There is no evidence of domain hosting associated with these networks in the past 3 weeks.
• These networks are /24 CIDR blocks or smaller.

Honeypot Exclusions

What is a honeypot exclusion?

A cybersecurity honeypot is a decoy system or resource set up to attract and detect attackers by mimicking a real target. Honeypots can generate realistic-looking findings in the Bitsight platform due to their nature as deception devices. 

Bitsight will remove honeypot assets from the rating if an organization attests to the location of the honeypots by IP or hostname. Findings on these assets will not appear in the system or impact the rating.

The exclusion lasts for a renewable 1-year period. Before the end of the 1 year exclusion period, Admins will be notified to review the honeypot exclusions and renew the attestation.

Instructions for Self-Attesting Honeypots for Exclusion

1. Enter the IP addresses and domains into the attestation form (you must be signed in to access this file).
2. Have a C-level official, Director of IT or similar role sign the form.
3. Send the form to Bitsight Support.

What happens when an exclusion expires?

Each exclusion lasts one year. Before the end of that period, Bitsight notifies Admins to review the exclusions and renew the attestation.