Deploying Honeynets Outside and Inside Your Network and Integration with Your SIEM

Honeynets have been around for a while but it's becoming easier and more compelling to deploy them on both sides of your network. In case you aren't familiar, a honeynet is like a honey pot system but on steroids. Instead of presenting a single system to attackers you present an entire network of apparent systems.

In the past honeynets were used chiefly for research purposes to help you learn how attackers operation. But they have become valuable as a true defensive technology by:

1. Providing real-time, accurate and specific threat intelligence. A colleague recently complained that a lot of threat intelligence feeds, despite their sophisticated collection and distribution technologies, are often like getting a message that Ghenghis Kahn is running amok on your eastern frontier when you are in the twentieth century worried about a cold war foe. On the other hand, a honeynet can tell you who is attacking you right now and with a low rate of false positives.
2. Distracting and diverting attackers from your real network destinations. Honeynets can present a virtual network of thousands of systems so that your real computers become needles in the haystack

That is a 2-prongred weapon: detect attackers while slowing them down at the same time.

And honeynets are just for your external Internet facing network either. In fact I think deploying honeynets on your internal network may be even more valuable for most organizations. After all, we know we are being scanned by every script kiddie, bot net and hijacked IoT device on the Internet. But on the internal network the noise is much lower and the stakes higher. Honeynets are another way to lay tripwires throughout your internal, production network that the persistent attacker who's infiltrated your network won't know about until they've already set off the alarm.

In this webinar we'll look at your options for honeynets and explain honeypot concepts like the haystack and doppelgangers.

But how do you deploy a honeynet without disrupting your network? And what does it take to integrate it with you SIEM because you obviously want to correlate what your honeynet is telling with all the other activity on your network. A. N. Ananth from our sponsor EventTracker will briefly show you their new Honeynet offering and how it fits into your network and integrated with SIEM technology.

Don't miss this real training for free ™ event. Please register now!