Emulate various services and capture verbose data on attacks
15
Analysis Tools • Log Rhythm Network Monitor and SIEM
16
Routers and Switches
17
High Interaction – Warning!
18
Document Bugging
19
More Tricks
20
Monitoring • Dedicated SOC - Security Operations Center
21
Enterprise Threat Intelligence
22
Event Correlation
23
Honeypot Dashboards • Honey Drive3 comes complete with dashboards and enhancement scripts to display interesting data.
24
Closing Thoughts
25
Works Cited & Recommended Reading • Strand, John, and Asadoorian, Paul Offensive Countermeasures: The Art of Active Defense 2013
Description:
Explore active defense strategies through honeypots in this 49-minute conference talk from Central Ohio Infosec 2015. Delve into traditional defensive concepts, InfoSec realities, and the importance of internal honeypots. Learn about various honeypot types, including Windows Powershell Honeyports and Artillery Logging. Discover practical use cases, such as file integrity monitoring and learning from attackers. Examine tools like Web Labyrinth, fake login panels, and Honeybadger for emulating services and capturing attacker data. Gain insights into analysis tools, high-interaction honeypots, and enterprise threat intelligence. Explore monitoring techniques, event correlation, and honeypot dashboards. Conclude with closing thoughts and recommended reading on offensive countermeasures and active defense strategies.
Honeypots for Active Defense - A Practical Guide to Deploying Honeynets Within the Enterprise