Honeypots for proactively detecting security incidents
•Download as PPTX, PDF•
1 like•720 views
Presented by Adli Wahid at the 10th National Conference on Cybersecurity held in Colombo, from 28 August to 1 September 2017.
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Honeypots for proactively detecting security incidents
Similar to Honeypots for proactively detecting security incidents (20)
More from APNIC
More from APNIC (20)
Recently uploaded
Recently uploaded (9)
Honeypots for proactively detecting security incidents
- 1. Honeypots for Proactively Detecting Security Incidents Adli Wahid Senior Internet Security Specialist (APNIC)
- 2. Let’s Connect • Adli Wahid o Senior Internet Security Specialist @ APNIC o Board Member of Forum of Incident Response and Security Teams (FIRST) • APNIC o Regional Internet Registry for the AP region • FIRST o Association of CERTs/CSIRTs o 30th AGM & Conference in 2018 (Kuala Lumpur)
- 3. Plan 1. Honeypots & Honeynets 2. Using Honeypots Inside Enterprise 3. Honeytokens 4. Main Points
- 4. Honeypots
- 5. Honeypots in a Nutshell • Resources deployed to be attacked & compromised • Emulate services, systems or hosts • Interaction with adversaries • Easy to deploy & integrate with existing security controls
- 6. Benefits • Differentiate noise & suspicious / malicious traffic • Information can be collected about attacks and/or adversaries o IP addresses / Domains o Files / Hashes / Malware Samples o TTPs • CERTs / CSIRTs o Understand context about attacks o Research and Development
- 7. APNIC Community Honeynet Project
- 8. SSH / Telnet Honeypot: Cowrie
- 12. File Hash
- 14. Recap • Different types of Honeypots • Lots of Open Source Tools Available • Implementation within Enterprise Networks?
- 15. Cyber Kill Chain 15 The Cyber Kill Chain ["Security Intelligence: Attacking the Cyber Kill Chain", Cloppert, Michael, http://computer-forensics.sans.org/blog/2009/10/14/security-intelligence-attacking-the-kill-chain/
- 17. Honeytokens A honeytoken is data or a computing resource that exists for the purpose of alerting you when someone accesses it.
- 18. Scenario • Adversary _already_ inside your infrastructure or valueable target • Multiple Forms: o Usernames / Passwords o URL / Links o Files o Web Pages o Etc • Adversary use / open tokens and announce their presence
- 21. Scan to get Server Information https://www.canarytokens.org
- 22. Implementation • Canarytokens o Canarytokens.org by Thinks o Opensource Source (on Github) o https://github.com/thinkst/canarytokens • Dcept by Secureworks o Opensource o ActiveDirectory o https://github.com/secureworks/dcept o Commercial Solutions are available
- 23. Conclusion 1. Consider honeypots to increase chance of detecting adversaries or attack 2. Check out Honeynet Project Website for more information o Annual Conference in Canberra in November o Community Information sharing 3. Security Response Community o https://www.first.org 4. General Cyber Security o https://academy.apnic.net
- 24. Thank You adli@apnic.net | adli@first.org Twitter:@adliwahid LInkedIn: Adli Wahid
Editor's Notes
- Step 1: Reconnaissance. The attacker gathers information on the target before the actual attack starts. He can do it by looking for publicly available information on the Internet. Step 2: Weaponization. The attacker uses an exploit and creates a malicious payload to send to the victim. This step happens at the attacker side, without contact with the victim. Step 3: Delivery. The attacker sends the malicious payload to the victim by email or other means, which represents one of many intrusion methods the attacker can use. Step 4: Exploitation. The actual execution of the exploit, which is, again, relevant only when the attacker uses an exploit. Step 5: Installation. Installing malware on the infected computer is relevant only if the attacker used malware as part of the attack, and even when there is malware involved, the installation is a point in time within a much more elaborate attack process that takes months to operate. Step 6: Command and control. The attacker creates a command and control channel in order to continue to operate his internal assets remotely. This step is relatively generic and relevant throughout the attack, not only when malware is installed. Step 7: Action on objectives. The attacker performs the steps to achieve his actual goals inside the victim’s network. This is the elaborate active attack process that takes months, and thousands of small steps, in order to achieve.